BP Brochure

Security Starts with the Basics
Despite the mediocre results realized from significant investments in perimeter, network, and endpoint
security defenses, many organizations can’t seem to come to the realization that their lack of
success stems from focus on the wrong attack paths.
Like most things, the solution to this problem starts with the basics; proper configuration of critical
security settings and visibility into the tell-tale signs of breach. All the controls you need are already
built in to what you’re trying to secure, you just have to make sure they’re turned on and configured
properly.
To help shine a light on where you’re most vulnerable, STEALTHbits has engineered a comprehensive
set of security configuration and best practices checks for your Windows infrastructure into one, easyto-use
assessment. In minutes, you’ll have clear insight into the security stature of the most critical
configurations within Active Directory and your Windows Server infrastructure; configurations every
attacker aims to exploit.
Explore our report set and why each is critical to a layered, proactive security program.
Domain Controller Logon Rights……………………………………………………………………………………………………………… 3
DSRM Admin Security……………………………………………………………………………………………………………………………… 4
Potential Plaintext Passwords…………………………………………………………………………………………………………………. 5
AD Extended Rights…………………………………………………………………………………………………………………………………. 6
Additional LSA Protection………………………………………………………………………………………………………………………. 7
Restrict Anonymous Access……………………………………………………………………………………………………………………. 8
Security Support Providers…………………………………………………………………………………………………………………….. 9
WDigest Settings……………………………………………………………………………………………………………………………………… 10
All Installed Applications……………………………………………………………………………………………………………………….. 11
Run at Boot……………………………………………………………………………………………………………………………………………. 12
Scheduled Tasks…………………………………………………………………………………………………………………………………….. 13
Local Administrators……………………………………………………………………………………………………………………………… 14
Microsoft LAPS Overview……………………………………………………………………………………………………………………….. 15
Suspicious PowerShell Commands…………………………………………………………………………………………………………. 16
Toxic Conditions……………………………………………………………………………………………………………………………………… 17
Password Status……………………………………………………………………………………………………………………………………… 18
2

Domain Controller Logon Rights
Description: The Domain Controller Logon Rights report identifies potential vulnerabilities in enterprise privileged
identities. Many organizations focus only on well-known privileged groups like Enterprise Admins/Domain Admins/
Administrators, and forget or neglect to acknowledge that other groups can also allow interactive logon to Domain
Controllers; a right that a select few in any organization should have.
Impact: Not knowing who has this level of privilege results in an inability to protect privileged identities and any
assets they can provide access to. It also equates to a significant blind-spot within any Privileged Identity Management
program.
3

DSRM Admin Security
Description: The DSRM Admins report highlights potential vulnerability in the DSRM account, as it is the only real
privileged “local” account on a Domain Controller.
Impact: Because DSRM passwords aren’t controlled by policy, DSRM passwords are often never or rarely changed.
Understanding if the DSRM account can log on to the Domain Controller interactively, versus in DSRM recovery mode,
is a critical configuration to understand as the use of this account in a non-recovery mode indicates attacker activity.
4

Potential Plaintext Passwords
Description: This report produces results corresponding to searches performed for potential password
vulnerabilities.
Impact: Admins are notorious for pushing down local admin passwords via scripts or CMD/SYS files. These
passwords are often stored in clear text within XML files. Being that Microsoft published the AES private key on MSDN,
attackers are able to find and decrypt passwords stored in this manner, without elevated rights.
5

Active Directory Extended Rights
Description:
Impact:
6

Additional LSA Protection
Description:
Impact:
7

Restrict Anonymous Access
Description:
Impact:
8

Security Support Providers
Description:
Impact:
9

WDigest Settings
Description:
Impact:
10

All Installed Applications
Description:
Impact:
11

Run at Boot
Description:
Impact:
12

Scheduled Tasks
Description:
Impact:
13

Local Administrators
Description:
Impact:
14

Microsoft LAPS Overview
Description:
Impact:
15

Suspicious PowerShell Commands
Description:
Impact:
16

Toxic Conditions
Description:
Impact:
17

Password Status
Description:
Impact:
18

About STEALTHbits
Identify threats. Secure data. Reduce risk.
STEALTHbits Technologies is a data security software company focused on protecting an organization’s credentials
and sensitive information. By removing inappropriate data access, enforcing security policy, and detecting
advanced threats, we reduce security risk, fulfill compliance requirements and decrease operations expense.
19

20