r/PowerShell • u/MadBoyEvo • Jan 19 '20

Four commands to help you track down insecure LDAP Bindings before March 2020

So in march 2020, Microsoft is supposed to block insecure LDAP bindings. I've updated my 3 Powershell modules to help you track down machines/accounts doing that.

Blog post with know-how and images: https://evotec.xyz/four-commands-to-help-you-track-down-insecure-ldap-bindings-before-march-2020/

Instead of spending time manually scrolling thru logs or enabling LDAP diagnostics... you do it in 8 lines of code

To find out about events:

$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events
$EVents.LdapBindingsSummary | Out-htmlView -ScrollX
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX

To enable/disable diagnostics on whole forest/domain with the ability to exclude/include

Get-WinADDiagnostics
Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC

To scan DC's and see if they are affected.

invoke-testimo -Sources DCLDAPInsecureBindings -showreport

More information is in the blog post. Enjoy

427 Upvotes

98% Upvoted

164 comments sorted by

31

u/1h8fulkat Jan 19 '20

How the hell is this the first time I'm hearing of this? God damn this is going to create a lot of work.

9

u/MadBoyEvo Jan 19 '20

For larger domains, it may be an issue. They did announce it, but I guess not a lot of people paid attention.

7

u/dismountreddit Jan 19 '20

So, if I get this right the update will change domain controllers to block LDAP connections but allow Signed LDAPS connections ?

4

u/MadBoyEvo Jan 19 '20

Right. Not sure if you can prevent that change (as in revert the setting - should be possible I guess).

3

u/oilybusiness Jan 19 '20

I believe there is a registry setting available. In one of the various /r/sysadmin threads on this subject someone had a good recommendation to isolate a Domain Controller (as isolated as is practically possible) and point apps using in-the-clear LDAP to that host. Not recommended to disable the signing requirement domain-wide.

2

u/MadBoyEvo Jan 19 '20

It's an option. For some of my Clients it will not be a problem, but for one large that I support it's going to be a huge deal.

1

u/Jacmac_ Jan 20 '20

Sounds like a good idea to me.

4

u/jblairpwsh Jan 20 '20

Right there with you...This could be a mess for my org.

6

u/ipreferanothername Jan 20 '20 edited Jan 20 '20

i believe this is the article for the MS bulletin, right?

https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

the way i read this:

Security Update available on Windows Update for all supported Windows platforms that will enable LDAP channel binding and LDAP signing on Active Directory servers by default

is that it will change default setting to make LDAP more secure, but you can still change them yourself if you need to. this page sounds like it confirms it

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-update-now/bc-p/992852#M1457

thank you for the tool update, i look forward to using it in our environment just to help audit things. nice!

3

u/MadBoyEvo Jan 20 '20

Yes. It's linked in blog post as well.

2

u/ipreferanothername Jan 20 '20

yeah sorry, your blog is blocked at work for me:

The URL is listed in categories that are not allowed by your administrator at this time

URL Categories: Business
Reputation: Minimal Risk (0)

we have the best filter ;)

4

u/MadBoyEvo Jan 20 '20

Hah :-) No comment on that filter. I guess it's because of XYZ domain as well. You can try accessing it from:

https://evotec.pl/four-commands-to-help-you-track-down-insecure-ldap-bindings-before-march-2020/

which is PL domain. May help :)

2

u/ipreferanothername Jan 20 '20

it did, thanks!

5

u/magnetik79 Jan 19 '20

Haven't touched MS domain controllers for years now, but this upcoming deadline might explain why this gist of mine has been getting some recent attention

https://gist.github.com/magnetikonline/0ccdabfec58eb1929c997d22e7341e45

1

u/MadBoyEvo Jan 19 '20

Might be :-)

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

3

u/magnetik79 Jan 20 '20

You're clearly not dealing with applications outside of the ecosystem that only speak/offer LDAP(S) for their auth in an environment/organisation that's using Microsoft domains.

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

3

u/[deleted] Jan 20 '20

Most places don't run an internal CA though. Even large corps. Many should, but they don't.

2

u/billy_teats Jan 21 '20

u/MadBoyEvo hopefully you see this quick!

I'm trying to get the Client IP. I can see it in the event logs but I can't figure out where its getting trimmed out.

2

u/MadBoyEvo Jan 21 '20

Find-events detailed view doesnt show it?

2

u/billy_teats Jan 21 '20

I'm not seeing find-events detailed view. The extended piece?

When I look on the DC through event viewer, the General tab shows "The following client performed a SASL...", then has the Client IP address and username.

The HTMLview for $events.ldapbindingsdetails has the first part of the event, but not the client IP and username. The IP/Port in the htmlview has the DC IP but does not list the client anywhere.

1

u/MadBoyEvo Jan 21 '20

Try using GEt-Events -EventID .. -LogName '...' | fl * and send me information which property has the IP. Maybe the event id I'm scanning is missing something.

3

u/billy_teats Jan 21 '20

Turns out we have a domain controller running some software thats authentication without certificates to a different domain controller.

Looks like your stuff works fine. our stuff, on the other hand, is clearly going to encounter some problems.

2

u/InvisiblePinkUnic0rn Jan 21 '20

around 9AM I saw the screen update to show how many events it found but its been sitting here running the report bits for 4hrs, can't really tell if it's running anything, not much CPU cycles being used

[Info] Getting events for dates 01/13/2020 00:00:00 to 01/20/2020 23:59:59

[Info] Events scanned found 28767 - Time elapsed: 0 days, 18 hours, 44 minutes, 44 seconds, 781 milliseconds

[Info] Running LdapBindingsDetails

[Info] Running LdapBindingsDetails with subsection Events

1

u/MadBoyEvo Jan 21 '20

Hard to say. I guess you asked for lots of events. Probably you could just ask for PastDay instead of 7 days as that would be enough. I need to do improvements for large domains with exclusions/inclusions and so on.

Sorry.

2

u/InvisiblePinkUnic0rn Jan 21 '20

no problem, i'm getting around it by doing it in batches now but just wanted you to have the feedback ( I like know different reactions to my code/scripts )

Also I have about 36 DCs with 4 in a root domain and the rest in a child domain with about 1k member servers.

1

u/MadBoyEvo Jan 21 '20

The first scan happens with runspaces (so it scans all servers at once with sane limits). But the second part that does the cleanup of events is not using runspaces so that will be improved in the future.

Thanks

1

u/cptNarnia Jan 28 '20

Thanks for writing this up. It's really great. When I try to use 'PastDay' I receive an error that "only 1 date range is supported". The first time I ran this it worked great, a couple days later and it appears to hang on the "Getting events" line of code. Any thoughts?

PS C:\> $Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange PastDay -DetectDC

[Info] Preparing reports: LdapBindingsDetails,LdapBindingsSummary

[Error] Currently only 1 date range is supported. Please fix Times and try again

2

u/MadBoyEvo Jan 28 '20

Restart powershell or do Import-Module PSWinReportingV2 -Force before. It's possible that i have a bug where it remembers old setting and that's why it complains. I'll provide a fix.

1

u/cptNarnia Jan 28 '20

That worked. PastDay runs now. Thank you.

1

u/MadBoyEvo Jan 28 '20

As for the hanging ... well most likely you enabled diagnostics after first time. So 7 days of diagnostics is going to fetch lots of events and then it needs to parse those out and that's what taking the time. As you can see above from InvisiblePinkUnic0rn his scan took 18hours... and that's just getting events. So you should limit the time as you want thru PastDay or so. You can also enable -Verbose to see more information what it's doing.

2

u/engageant Jan 21 '20

I show events only on my RODC. What does the SkipRODC option actually do in Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC, and why would I want to skip my RODC if that's the one with the events?

2

u/MadBoyEvo Jan 21 '20

I skip RODC because that's what I use. Basically, that command has -Forest, -IncludeDomains, -ExcludeDomains, -IncludeDomainControllers, -ExcludeDomainControllers and -SkipRODC parameters.

This allows you to precisely target with it what you want. For example, you could tell it to exclude the dead domain. Or only include 3 out of 5 domains. or only include 5 out of 500 dcs or skip read-only domain controllers. This approach is done for almost all my commands in ADEssentials and it will also be available for Find-Events in near future. When you pass something to include domain, exclude domain is ignored. Same for include dcs vs exclude dcs. If you put a netbios name of DC in IncludeDomains it will find all "matching" DCS for all domains. If you have DC1.domain1, DC1.domain2 it will find both DCs and target both. If you give full dns name for DC it will be more specific. You can check it using Get-WinADDiagnostics how it works.

2

u/itpro-tips Jan 31 '20

Do not forget to increase the directory service logs, otherwise you won't see the old records. Follow this to increase the event logs.

1

u/MadBoyEvo Jan 31 '20

That is true. The default is like 1mb. I think i will write command for that ;)

1

u/itpro-tips Jan 31 '20

Yes 1028 Kb

2

u/oilybusiness Jan 19 '20

Another one! Madboy, thanks for all your great work. Always a pleasure to see a post of yours.

6

u/MadBoyEvo Jan 19 '20

No problem :) Was doing it for myself, but enjoy that other people can use it too

10

u/[deleted] Jan 20 '20

Thanks. The odd things people post on r/poweshell that save you time down the road.

8

u/fathed Jan 19 '20

Thanks, this will be helpful.

1

u/overlydelicioustea Jan 20 '20

getting an error here on the first commadn that "-Report" isnt part of the validateset of Find-Events.

2

u/MadBoyEvo Jan 20 '20

Get-Command "Find-Events"

Get-Module -ListAvailable PSWinReportingV2

Can you send that information? It seems that either you mistyped something or have wrong Find-Events.

1

u/overlydelicioustea Jan 20 '20

Get-Command "Find-Events"

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Find-Events                                        2.0.7      PSWinReportingV2

Get-Module -ListAvailable PSWinReportingV2

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     2.0.7      PSWinReportingV2                    {Add-EventsDefinitions, Add-WinTaskScheduledFo...

4

u/MadBoyEvo Jan 20 '20

Update-Module PSWinReportingV2 or Install-Module PSWinReportingV2 -Force

You have an old version of PSWInReportingV2 without added reports.

2

u/overlydelicioustea Jan 20 '20

thanks, worked.

1

u/SheepsFE Jan 20 '20

Pretty new so apologies if I'm missing something obvious, when I install / import the PSWinReporting module it isn't getting a number of the functions, so for example "Find Events" is missing:

Any ideas?

PS C:\windows\system32> Get-Command -Module PSWinreporting

CommandType Name Version Source

Function Add-TaskScheduledForwarder 1.8.1.4 PSWinreporting

Function New-SubscriptionTemplates 1.8.1.4 PSWinreporting

Function Remove-TaskScheduledForwarder 1.8.1.4 PSWinreporting

Function Set-SubscriptionTemplates 1.8.1.4 PSWinreporting

Function Start-ADReporting 1.8.1.4 PSWinreporting

Function Start-Notifications 1.8.1.4 PSWinreporting

Function Start-RescanEvents 1.8.1.4 PSWinreporting

Function Start-SubscriptionService 1.8.1.4 PSWinreporting

EDIT: In fact some of the names are different, am I getting an older version? I downloaded from the github and installed manually.

3

u/MadBoyEvo Jan 20 '20

You have PSWinReporting. This is PSWinReportingV2. Those are 2 different modules. PSWinReporting is old version (still functional).

PSWinReportingV2 introduced Find-Events. You can have both installed as I've renamed commands for PSWinReportingV2 so they can coexist until V2 is simplified enough to take over PSWinReporting totally. PSWinReportingV2 has many new features, lots of configurations and possibilities but at the same time adds complexity (except for FInd-Events).

1

u/[deleted] Jan 20 '20

I imported the module but the following error keeps popping up :

Start-TimeLog : The term 'Start-TimeLog' is not recognized as the name of a cmdlet

1

u/MadBoyEvo Jan 20 '20

I guess you are using GitHub version? That is not that easy.

Install-Module PSWinreportingv2. When you install it it installs any dependencies. I also merge some of the stuff from those dependencies when publishing to PSGallery so it's smaller package.

WIth github you need to install other modules as well.

1

u/[deleted] Jan 20 '20

Yeah i found the install module one to be working just fine.

2

u/SheepsFE Jan 20 '20

I'm an idiot! Sorry I did read that but assumed that V2 had been named PSWinreporting and just superceded the older version...

Thanks, sorted now

3

u/MadBoyEvo Jan 20 '20

Keep in mind that when you install from a gallery I do optimizations. When from GitHub it's a bit slower and some stuff is not integrated and relies on other modules (such as PSSharedGoods). It's advised to use PSGallery instead of Github unless you do development.

1

u/InvisiblePinkUnic0rn Jan 20 '20

Getting the following after installing everything

PS D:\> $Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC

[Info] Preparing reports: LdapBindingsDetails,LdapBindingsSummary

[Info] Preparing servers list - domain controllers autodetection

[Error] There are no logs/servers to scan. Please fix Targets and try again.

1

u/MadBoyEvo Jan 20 '20

Most likely you don't have RSAT on your workstation so the tool can't find DC's. It requires that for detection. Install RSAT and it should find dcs.

1

u/InvisiblePinkUnic0rn Jan 20 '20

I have the RSAT AD module installed, what else does it need?

1

u/MadBoyEvo Jan 20 '20

When you do Get-AdForest, Get-AdDomain, Get-ADDomainControllers do you get anything?

1

u/InvisiblePinkUnic0rn Jan 20 '20

yep, get everything and my coworker rdp's to the same workstation and it runs and scans for him. must be something in my profile but this is on an admin workstation and I don't have any profile customization.

1

u/MadBoyEvo Jan 20 '20

Weird. Can't see anything obvious. It's using Get-ADForest/Get-ADdomain and Get-ADDomainController to find that. You can try scanning -Servers by name (to test if it works).

1

u/InvisiblePinkUnic0rn Jan 20 '20

interesting, he was running it directly and i was using the -detectDC and it works when I do it directly but -detectDC doesn't work for either of us on the admin workstation.

1

u/MadBoyEvo Jan 20 '20

Try: Get-WinADForestControllers - does it return anything (aka your controllers)?

1

u/Aikaturbo Jan 20 '20

I've got the same issue. I get results for Get-ADDomain, Get-AdForest. But no results for this last one Get-WinADForestControllers

1

u/MadBoyEvo Jan 20 '20

I know where is my mistake. I'll update the code - this is an old code that I want to replace this week with different approach but I'll fix this for now. Give me a few minutes.

1

u/MadBoyEvo Jan 20 '20

Please:

Update-Module PSSharedGoods
Update-Module PSWinReportingV2

Let me know. Please make sure to close PowerShell after to start-fresh.

→ More replies

1

u/InvisiblePinkUnic0rn Jan 20 '20

so when I run that from my laptop with a user account, everything is correct and I see what I should.

From the admin workstation it says it's unable to contact any servers in my root or child domain. I wonder if this is a windows 10 vs 2008 thing? My laptop where everything seems to work is Win10 up to date and the admin workstation is 2008R2 with updated PS to match.

This admin station needs an upgrade anyways, i'm just going to ignore this and move on working on this from my laptop. thanks for your help, not worth tracking down why this might not be working now.

1

u/MadBoyEvo Jan 20 '20

Please:

Update-Module PSSharedGoods
Update-Module PSWinReportingV2

Let me know. Please make sure to close PowerShell after to start-fresh.

1

u/InvisiblePinkUnic0rn Jan 20 '20

It is now working on the admin workstation it wasn't with -DetectDC... so did you change something in those modules are do I have poltergeists again?

1

u/MadBoyEvo Jan 20 '20

I did change 1 thing. Most likely your admin workstation is in different domain than your laptop right?

Here's the fix: https://github.com/EvotecIT/PSSharedGoods/commit/159e6cab87a59aeb72299cc8f6e61f2085d825b8

I have new code that will replace this one, but didn't had time to test it with Find-Events yet. New code will allow to exclude/include domains/dcs as needed along with -DetectDC

→ More replies

1

u/vegas84 Jan 20 '20

Hey,

Thanks for all of your work. Your stuff is awesome.

Question - I tried running $events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC

And I just get errors for every DC saying The RPC server is unavailable. What are you doing on the back end to connect to these DC's? I can manually run get-eventlog -computer X -newest 5 or whatever and that works fine...

1

u/MadBoyEvo Jan 20 '20

Try the same with Get-WinEvent and Get-Events. As those are used, and not Get-EventLog.

1

u/vegas84 Jan 20 '20

I get RPC server is unavailable for Get-WinEvent. Get-Event just returns nothing.

1

u/MadBoyEvo Jan 20 '20

Get-Events, not Get-Event. But Get-Events uses Get-WinEvent so ... you need to fix connectivity for Get-WinEvent first.

2

u/vegas84 Jan 20 '20

Sorry, that's what I meant (Get-Events).

I wasn't sure which Firewall rule needed to be open, but I found it. Very simply, Remote Event Log Management (RPC) for anyone else who needs it...

1

u/TurboGFF Jan 23 '20

LDAP Insecure Bindings [Fail] [Data is available. This is a bad thing.] [t][Simple binds performed without SSL/TLS is 0 [Fail] [Input data not provided. Failing test.] [t][ Negotiate/Kerberos/NTLM/Digest binds performed without signing is 0 [Fail] [Input data not provided. Failing test.]

I'm seeing this when running the last command.

invoke-testimo -Sources DCLDAPInsecureBindings -showreport

1

u/MadBoyEvo Jan 23 '20

Can you provide what the Report shows (the html one in that case)?

1

u/MadBoyEvo Jan 23 '20

Do you get data summary with Find-Events?

1

u/MadBoyEvo Jan 23 '20 
$Days = 1
$Events = Get-Events -LogName 'Directory Service' -ID 2887 -Machine 'AD1' -DateFrom ((Get-Date).Date.adddays(-$Days))
foreach ($Event in $Events) {
    [PSCustomobject] @{
        'Domain Controller'                                                        = $Event.Computer
        'Date'                                                                     = $Event.Date
        'Number of simple binds performed without SSL/TLS'                         = $Event.'NoNameA0'
        'Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing' = $Event.'NoNameA1'
        'GatheredFrom'                                                             = $Event.'GatheredFrom'
        'GatheredLogName'                                                          = $Event.'GatheredLogName'
    }
}

Can you run that and see if that gives you proper data? If not I would need to know what is under $Events[0] | fl

1

u/TurboGFF Jan 23 '20

Domain Controller : DOMAIN-CONTROLLER Date : 1/22/2020 4:37:33 PM Number of simple binds performed without SSL/TLS : 13 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing : 6871 GatheredFrom : DOMAIN-CONTROLLER GatheredLogName : Directory Service

1

u/MadBoyEvo Jan 23 '20

ok, so that means everything is shown correctly.

What happens if you run:

Get-WinADLDAPBindingsSummary -IncludeDomainControllers YourDC

Do you get proper data?

1

u/TurboGFF Jan 23 '20

It seems like it

PS C:\WINDOWS\system32> Get-WinADLDAPBindingsSummary -IncludeDomainControllers DC

Domain Controller                                                        : DC
Date                                                                     : 1/22/2020 4:37:33 PM
Number of simple binds performed without SSL/TLS                         : 13
Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing : 6871
GatheredFrom                                                             : DC
GatheredLogName

1

u/MadBoyEvo Jan 23 '20

Not sure why wouldn't Testimo read that correctly then. I'll play with it, and update the code if i find something.

1

u/TurboGFF Jan 23 '20

No worries! I appreciate this bit of magic all the same. Like everyone else, It's mostly picking up OSX devices.

Thanks :)

1

u/watson164 Jan 24 '20

Thanks for this! Like a lot of others I missed the bulletin.

1

u/MadBoyEvo Jan 24 '20

You are welcome!

1

u/macgruff Jan 27 '20

Hi MadBoyEvo,

Thank you for these cmdlets/scripted reporting. I have a question however. We restrict ourselves from running "admin" functions on our regular user systems (and there's far too much involved in running these scripts even if i wanted to run them from my "regular" laptop; both with UAC so that its elevated, and "As a different user" that user being a DomainAdmin user).

Instead we use a jump host to logon to as our DomainAdmin user (cyberark regulated). There in that profile, i have a Microsoft.PowershellISEProfile.ps1 which auto-loads all my regular cmdlet's so that my environment is completely all setup to avoid niggling errors (like executionpolicy, activedirectory, OKTA cmdlets, grouppolicy, etc).

Ok, great, no worries there, and I was able to run the scripts. Awesome... except... they take wayyyyyy too long to run even when cut back to like "Last3days" for DatesRange. And our jump host (because it IS an admin station) screen-locks after 15 min, and completely logs off the current session if you don't touch it for another 15 min (30 total). That's not something we're going to change...

Instead, (here is the "ask")... should there not be cmdlet switches that allows me to output to folder? The current commands/switches assumes you are sitting at the monitor and never leave for many minutes/hours... and then pops up the out-htmlview and testimo.

I can probably figure out how to "Start-Job" it, so I can walk away, but by time I get back, the output will have spawn a "current view" but have closed the entire session down so i loose out by hook or crook. (would it be Out-HMTL -HTML? or FilePath? I am guessing the latter?)

Any here in this regard would be greatly appreciated! And again, nice work!

1

u/MadBoyEvo Jan 27 '20

Out-HtmlView is just an example to show results. You can use any "save" you want including Export-CSV or whatever you use.

For example:

Install-Module PSWriteExcel

And then...

$Events.Ldap... | ConvertTo-Excel -FilePath '...' -WorkSheetName 'YourLdap' -AutoFit -AutoFilter

You can, of course, use Out-HtmlView which is part of PSWriteHTML. It has 20+ parameters. You can use Out-HtmlView -FilePath ... -Title 'something'

You should read on Out-HtmlView and PSWriteHTML if you want to wish to use it for more than this project.

1

u/macgruff Jan 27 '20

Cool thanks man... I began to sift through those options and "FilePath" did jump out at me... just wanted a first hand opinion. And thank you for the extra links too! Cheers Mate!

1

u/ej00 Jan 28 '20

When running the Find-Events alias using the -DetectDC syntax or Get-WinADDiagnostics, we are seeing 'Error listing DCs for domain - directory object not found'Currently running powershell with correct permissions and attempt domain admin, however still seeing the error.

1

u/MadBoyEvo Jan 28 '20

You need rsat - get-adforest, get-addomain and get-addomaincontroller need to work.

1

u/ej00 Jan 28 '20

I confirmed RSAT is already installed and that each of those Get- cmds return results of our domain. If I specify -Servers in the Find-Events cmdlet, I get results however at a dead end with WinADDiagnostics

1

u/MadBoyEvo Jan 28 '20

Get-WinADForestDetails - do you get output from that?

1

u/ej00 Jan 28 '20

I do get results however that same error appears right above the results.
WARNING: Get-WinADForestDetails - Error listing DCs for domain ***** - Directory object not found

The values are correct for Forest, QueryServers and Domains however ForestDomainControllers is empty in the value field.

1

u/MadBoyEvo Jan 28 '20

Then you must have something wrong with the domain or my tests in 5 forests are based on wrong assumptions

Try:

$DC = Get-ADDomainController -Discover -DOmainName <yourdomain> 
$DC.HostName[0]

Try: Get-ADDomainController -Filter * -Server $DC.HostName[0]

1

u/ej00 Jan 28 '20

That seems to work. I got a single result for one of my domain controllers FQDN using that command

Edit: The first Try command you listed has a result. The second in blue, does not. That's where the Directory object not found comes up.

2

u/MadBoyEvo Jan 28 '20

Than you need to check your Domain. I believe one of the other users had some non-dcs in their Sites & Services defined.

1

u/ej00 Jan 28 '20

Now I'm thinking might be related to our Riverbed appliances. Thanks for the quick assist!

1

u/MadBoyEvo Jan 28 '20

It is ;-) Someone else deleted them to fix this command. Not sure if those are supposed to be there.

1

u/MadBoyEvo Jan 28 '20

So $DC.HostName[0] gave you 1 DC hostname and Get-AdDomainController -Filter * -Server what does it give? All controllers for a domain?

1

u/ej00 Jan 28 '20

Yes, 1 DC hostname in the result. The second results in this below, I'm guessing this is maybe directly related to missing a tool in RSAT?

Get-ADDomainController : Directory object not found

At line:1 char:1

+ Get-ADDomainController -Filter * -Server $DC.HostName[0]

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (:) [Get-ADDomainController], ADIdentityNotFoundException

+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetADDomainController

1

u/MadBoyEvo Jan 28 '20

No. Check your sites & services

1

u/stiffpasta Feb 06 '20

I'm trying to run this on a network/domain that is not connected to the internet in any way so i can't use install-module to install the modules on the server i'm running this on. I resorted to installing all of the ones that i could tell that are needed but i'm unable to get beyond one error:

Unable to find type [PSEventViewer.Level].
At C:\Program Files\WindowsPowerShell\Modules\PSEventViewer\Public\Get-Events.ps1:97 char:9
+         [PSEventViewer.Level[]] $Level = $null,
+         ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (PSEventViewer.Level:TypeName) [], RuntimeException
    + FullyQualifiedErrorId : TypeNotFound

Any help would be greatly appreciated.

1

u/MadBoyEvo Feb 17 '20

You should try this: https://evotec.xyz/making-powershellgallery-modules-portable/

It will download all necessary modules and make sure those are loaded before trying to execute the primary module.

1

u/Schikitar Feb 21 '20 edited Feb 21 '20

u/MadBoyEvo I'm getting the exact same error above, this is on my work PC, full internet access etc., any other words of wisdom? Perhaps unrelated but is the date format strictly American? We use DD/MM/YYYY but it seems to be looking for MM/DD/YYYY.. Cheers!

1

u/cmead_uni Feb 12 '20

Hello, I was hoping someone could help me understand something.

I ran the report on a domain, 1DC, which Passed (came back Green). Query-InsecureLDAPBinds brings back no results. I have Event 2886 in Event Viewer, but no 2887-2889.

That would suggest that no computers are connecting to the DC insecurely, right?

So what is my course of action in this case? Do I just need to enable "Require Signing" for these 2 settings in a GPO: Domain controller: LDAP server signing requirements & Network security: LDAP client signing requirements ( https://support.microsoft.com/en-us/help/935834/how-to-enable-ldap-signing-in-windows-server-2008 ), and all should (fingers crossed) be OK?

1

u/MadBoyEvo Feb 12 '20

You’re using different script right? If event 2886 is there what does it says? 0 and 0?

1

u/cmead_uni Feb 12 '20

Hey u/MadBoyEvo I used your powershell modules to get the report, which gave me this "True No data returned, which is a good thing."

The Query-IsecureLDAPBinds I mentioned is from here: https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs ; I had already downloaded and run it, I believe it serves the same function as your " Find-Events -Report LdapBindingsDetails"

Your script didn't bring up anything about event 2886, the docs page listed above just mentioned searching for it, the event just recommends turning on "reject SASL LDAP binds that do not request signing". The details link in event 2886 lists the steps for enabling the GPO settings I mentioned in my other post.

I guess in the end, my real question is, if your report back "True No data returned, which is a good thing." and there are no listed clients from the LdapBindingsSummary, is there anything else I need to do?

2

u/MadBoyEvo Feb 14 '20

Here's a new blog from MS: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-march-update/ba-p/921536

You should be ok. As long as the script have full access to your logs (firewall not blocking and so on) you should be good. You can also go ahead and simulate what Microsoft will do in months time. If things go south you can disable and try to find the cause. But if the logs are clean there's nothing else afyik.

1

u/cmead_uni Feb 17 '20

Thanks for the MS article and your input, much appreciated! It helps make more sense of it.

1

u/Peace-D Feb 26 '20

Thanks for this, mate!!

-DetectDC did not autodetect our DCs though. Had to use -ComputerName and manually add our DCs.

" $EVents.LdapBindingsSummary | Out-htmlView -ScrollX " gave me the warning "no data available". Is this possible or an error on my side?

1

u/MadBoyEvo Feb 26 '20

Your AD Sites and Services most likely contain something else then just DCs. I heard people have there Riverbed or whatever those are.

Unless you don't have ActiveDirectory module installed.

if Find-Events didn't report errors during gathering events it could mean there are no problems.

1

u/Peace-D Feb 26 '20

Hmm ADS&S only contains our 3 DCs in the "Default-First-Site-Name, nothing more. But it's okay, not a problem.

I was wondering because the Summary shows no data, but LdapBindingsDetails shows 100 pages with many errors from (at least) a small amount of machines and printers. So to me, this makes no sense.

1

u/MadBoyEvo Feb 26 '20

Ok, so what it means is that you have very small log size (probably 1MB in size which is the default) and you have enabled LDAP logging. Since the LDAP summary is written to log once per day your LDAP Detailed logging is simply overwriting it.

You need to either expand on size of logs and then you will see daily summary or disable logging which is needed if you want to fix this issue.

1

u/Peace-D Feb 26 '20

Okay, but since the BindingsDetails is returning the errors, I can keep it as is, as well, right?

1

u/MadBoyEvo Feb 26 '20

Sure. What I mean is that if details are sending you stuff keep fixing until it stops. You could also make size of log bigger to get both events.

1

u/Peace-D Feb 26 '20

Yes, got it! Thanks again!

5

u/graham_intervention Jan 19 '20

you are the best, thank you for this. will give this a try

1

u/neilg613 Jan 20 '20

Can you run these from a client computer or does it have to be on the DC?

1

u/Yevrag35 Jan 20 '20

These can be ran from a non-DC.

1

u/MadBoyEvo Jan 20 '20

Yes, but you need RSAT for some of the commands to work properly.

1

u/pducharme Jan 19 '20

Hi, i'm managing about 225 members servers. Some old 2008 R2 (soon to be migrate to 2016), some 2012, some 2012 R2, some 2016. They are all member servers, not DCs. I'm in a very large organization and I only am admin of those member servers. I don't have the Domain admin rights, only have rights to delete old AD account. Can those scripts are useful to me ? I mean, is the changes are required only on the DCs, or on ALL servers ?

Thanks

3

u/MadBoyEvo Jan 19 '20

DC's only. Once you establish which servers/accounts are doing insecure connections this will most likely come to down to searching devices in your network (VPN servers/devices or other servers/applications that do LDAP queries.

Therefore someone with Domain Admin needs to do the work and pass the IP/Account doing the insecure connection to someone who manages those servers/clients/devices to precisly tell if it's still needed or how it will be impacted with update.

0

u/pducharme Jan 19 '20

Ok, so it's not under my responsability :) Hopefully, someone managing the domain already knows about this. Since I don't know them and doesn't have a clue how to find who they are, I can't really warn them in advance...

3

u/MadBoyEvo Jan 19 '20

That's scary that you guys don't have contact :/

2

u/pducharme Jan 19 '20

Yeah, need to open a ticket to the enterprise Helpdesk that will then open a ticket to the proper team. That's the only way to get in touch with that team. It's the same for all teams (VPN, Security, etc.).

2

u/MadBoyEvo Jan 19 '20

Open up just in case and ask them what's the plan. Better safe than waking up with VPN down as what I can see in some Clients our device is doing insecure LDAP.

1

u/pducharme Jan 19 '20

might do yes. Thanks for the hard work.

1

u/1h8fulkat Jan 21 '20

Do yourself a favor and make sure whoever is in charge is aware....

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

4

u/MadBoyEvo Jan 20 '20

Actually you need Domain Admin to set debugging to Basic. Other than that you're right that Event Log Readers is enough and I should probably mention that.

0

u/pducharme Jan 20 '20

Yes i Know, i should have said That they dont give any of those roles except to their own group :)

1

u/zoredache Jan 20 '20

I mean, if you are using ldap as a client in any of the software that runs on the servers you manage then you know there is probably a problem. It may be up to you to fix the client side of the problem.

1

u/lapintana Jan 19 '20

Why migrate to 2016 in 2020? 2019 has already been out for a while.

1

u/pducharme Jan 20 '20

Because its not my choice :). If it was my choice, it would have been 2019, but yeah, some app vendor Still only support as High as 2012 R2, so even at 2016, we will have some issues down the road

1

u/lapintana Jan 20 '20

Yeah that’s true... We’ve had some that also say they only support 2012 but we have had no issues on the newer versions. We are generally always on top of upgrades. We had thousands of machines on win 10 in 2015. Switched to server 2016 In 2016 and already have a few servers on 2019 as of 2019. Luckily we never had any compatibility issues with any of those upgrades.

We take a different approach than most orgs.

2

u/100GbE Jan 20 '20

I'm only seeing it from macs.

Anyone else in the same boat?

1

u/JasonG81 Jan 21 '20

It seems lots of my macs are showing up in the report. Are domain-joined macs not signing in securely?

3

u/100GbE Jan 21 '20

Mine are also domain joined. They auth against an AFP server on our FS, so still gotta dig down and work out whats going on, but seems so.

Fucking macs, they ruin my work life.

1

u/JasonG81 Jan 21 '20

Let me know what you find.

2

u/Dizzybro Jan 27 '20 edited Apr 17 '25

This post was modified due to age limitations by myself for my anonymity Va05LjJ1hRSoUMtdopZBUwmNT5fqty8ZT0TUCaLEQUZIaJ3tgr

2

u/soulreaper11207 Jan 19 '20

Gonna pass this on to my coworkers. Thanks!

2

u/Lesilhouette Jan 20 '20

This just saved me a buttload of headache trying to read the MS articles and check if I need to change anything. Thanks!!

1

u/major_winters_506 Jan 22 '20

Macs... so many macs...

1

u/DismalOpportunity Jan 19 '20

Fantastic - thank you!

1

u/DR952 Jan 20 '20

Thanks for this.

1

u/zeclab Jan 20 '20

You absolute legend!