Hello,
As you may know, you can sign your scripts to ensure they’ll run on “AllSigned” policy, or to be sure about their integrity. Continue reading
Sign PowerShell scripts
Reply
Tag Archives: Security
Weak password encryption in Group Policy Preference
Hello,
Since Windows Server 2008, we are able to set local administrator password thanks to Group Policy Preference but, this “encryption” key is available on MSDN, so, anyone can read the clear text password with a few lines of PowerShell. Continue reading
Get Remote Registry Access ACL
Hello,
You can see who has remote registry access on your server with the ACL on that registry key : Continue reading
Display stored usernames and passwords
Hello,
If you’re troubleshooting lockout issues or if you have some security concerns, you can display stored usernames and passwords with : Continue reading
Modify Active Directory Computer Password Maximum Age
Hello,
You can modify maximum computer password age with GPO :
Continue reading
[UpDate] Find the bitlocker key of a deleted computer in ActiveDirectory
Hello,
Here an update about that old post, I made a PowerShell function an posted it on technet.
Continue reading
Deny “Password Never Expire” for Everyone
Hello,
Hereunder a nice “feature” I just learned about :
It’s possible to deny the permission to tick the case “Password Never Expire”, while keeping the possibility to enable/disable the account, and manipulate the other bits of the “UserAccountControl”.
I think this is useful for help desk people and delegated administrators, to ensure they change their passwords regularly, without affecting their ability to work.
This is an ACL at the domain level :
Note : This ACL is defaulted to “Allow”.
I just modified to deny this permissions, and try to tick that case with the “Administrator” account :
This case is click-able, but you can’t apply your modifications :
You have some others permissions that can be pretty handy domain-wide :
Deny Password Never Expire for Everyone
Hello,
Hereunder a nice “feature” I just learned about :
It’s possible to deny the permission to tick the case “Password Never Expire”, while keeping the possibility to enable/disable the account, and manipulate the other bits of the “UserAccountControl”. Continue reading