mimikatz. A tool to play with windows security. Take care when download precompiled binaries. Better get the source code from github and compile it yourself. Its very easy
last week I had to deploy 25virtual Windows (XP) Clients an on VMware ESX Cluster. One of the requirements was that the clients must be member of a Windows Active Directory.
After setting up vCenter (copy sysprep) I installed a reference Windows XP vm, convert them to a template and defined a Customization Specification like this:
Initial Customization Specification
During the cloning process, by using the template with the recently created custom spec, the domain join always fails and the Computer Account was disabled at each try.
Ok, now I tried modify some parameter of the Custom Specification:
Changing the Domain from fqdn to the NetBIOS Domain “SUB”
Altered the Username to SUB\joinuser or joinuser@SUB or joinuser@sub.domain.org
for test purposes it could be necessary to backup a computer by an image tool, i.e. Acronis TrueImage, and after the test is completed or in situations of a failure reset the computer back to it’s initial state by restoring the image.
In domain environments this could be a problem, because each computer which is member of a Windows Active Directory Domain is negotiating a password with the domain and this password is changed after 7 Days. If your Image is older the domain member ship is broken and you have to rejoin.
The password change is initiated by the client and this behaviour could be prevented by setting a registry value. Set this value, make an image afterwards and you will be able to restore the image as often you want or need without to leave the domain.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogon\Parameters]
"DisablePasswordChange"=dword:00000001
Set it by command line reg ADD HKLM\SYSTEM\CurrentControlSet\services\Netlogon\Parameters /v DisablePasswordChange /t REG_DWORD /d 1 /f
Attention: If plan a update to VMware vSphere/vCenter 5.1.0 Update 1. Currently this version contains a bug which prevents User from Login. VMware is working on an Fix. See KB2050941
=> Bug is solved in 5.1.0 Update 1a
Hi everybody,
since VMware vCenter 5.1 a new service SSO, the Single Sign On Service, handles the authentication for all logons. The advantage is that multiple authentication sources are possible. For example Local User and groups, OpenLDAP Directory Services and of course Microsofts Active Directory.
This post is related to vCenter Version 5.1.0b and describes how to add an Active Directory Domain as Identity source and get this running by using the “Reuse session” Authentication Type. The last one is the tricky part :-).
Let us start. Start the vSphere WebClient with a login which owns the appropriate rights, for example admin@system-domain or any other user who owsn has the SSO administrator privileges, and navigate to Administration/Sign On and Discovery/Configration. In the default configuration two identity sources are added by default. The SSO database and the user management of the local server.
To add an Active Directory as identity source the following informations are required
The Domain fully qualified domain name
The Domains NetBIOS Name
At least one domain controller
The Base DN for the users and groups
The attached powershell script GetSSOParameters.ps1 should determine this for your domain. You must start the script with the fully qualified domain name as parameter. Try it!
PS c:\>GetNetBiosDomainName.ps1 yourdomain.com
Basic Config for VMware SSO Identity source
NAME: YOURDOMAIN
Primary Server: ldap://domaincontroller1.yourdomain.com
Secondary Server: ldap://domaincontroller2.yourdomain.com
BaseDN Users: DC=yourdomain,DC=com
Domain: yourdomain.com
Domain Alias: YOURDOMAIN
BaseDN Groups: DC=yourdomain,DC=com
If you have the necessary information you can add the Identity source. See Screenshot below. First try to add by specifing a Username and a password which have the rights to query the Active Directory
My Knowledgebase for things about Linux, Windows, VMware, Electronic and so on…
Place for Advertisment to support michlstechblog.info
This website uses cookies to improve your experience and to serv personalized advertising by google adsense. By using this website, you consent to the use of cookies for personalized content and advertising. For more information about cookies, please see our Privacy Policy, but you can opt-out if you wish. AcceptRejectRead More
Privacy & Cookies Policy
Privacy Overview
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.