70-294: MCSE Guide to Microsoft Windows Server 2003 Active Directory Chapter 9: Active Directory Authentication and Security

70-294: MCSE Guide to Microsoft Windows Server 2003 Active

Directory

Chapter 9: Active Directory

Authentication and Security

Guide to MCSE 70-294, Enhanced 2

Objectives

• Describe security principles and how they are identified

• Describe the user authentication process in an Active Directory domain using the NTLM and Kerberos authentication protocols

• Demonstrate the use of DACLs to control access to objects in Active Directory


Objectives (continued)

• Demonstrate the use of SACLs to control auditing of objects in Active Directory

• Describe how network resources can be protected using security based on Active Directory


Security Principles

• User object• inetOrgPerson object• Computer object• Security group object• Have an SID:

• Windows security subsystem uses to identify security principals


Security Identifiers

• Attribute as binary value • Specifies the SID of user object

• Unique value used to identify user as security principal

• Number of formats:• Hexadecimal notation

• Security Descriptor Definition Language (SDDL)


Security Descriptor Definition Language (SDDL)

• Begins with S• Followed by three to seven numbers:

• Separated by hyphens

• First number is revision level of SDDL format

• Next identifier authority

• Next subauthority identifier

• “Well-known” SIDs:• Identify certain users or groups

• Recognized by OS


Domain and Relative Identifiers

• Domain identifier• Calculated when domain created

• 3 32-bit numbers

• Guaranteed to be unique

• Relative Identifier (RID)• 32 bits

• Identifies object within domain


Access Tokens

• Contains several important pieces of information• User’s SID

• SID for every group of which user is member

• Security subsystem • Examines user’s access token

• Determines if user or one of groups of which user is member has access to resource

• Generated based on authentication protocol used


Activity 9-1: Access Tokens

• Objective: View the contents of an access token• Use whoami command to view access token


Permissions and Rights

• Used to control access on system• Permissions

• Rules associated with object

• Define which users can gain access to object

• What actions users can perform on object

• Rights• Define what tasks or operations user can perform on

computer system or domain


Active Directory Authentication

• Authentication methods used in Windows Server 2003: • NT LAN Manager (NTLM)

• Kerberos


NTLM Authentication

• Supported for backward compatibility • For Windows NT 4.0 client computers

• Not primary means of authentication in Windows Server 2003

• Based on older authentication protocol called LAN Manager


NTLM Authentication Example


NTLM Issues

• Each time user wants to access resource user must be reauthenticated by domain controller

• Only provides client authentication• Easy to capture NTLM challenge and use hacking

tools to discover password


Kerberos Authentication

• Default protocol for network authentication for all Windows Server 2003 computers

• Components:• Security principal requesting access

• Key Distribution Center (KDC)

• Server holding resource or service being requested


Kerberos Authentication (continued)

• KDC services:• Authentication

• Ticket-granting Service

• Authentication Service• Ticket-granting ticket (TGT)

• Issued to user when first authenticated during successful logon

• Allows user to request session tickets


Kerberos Authentication (continued)

• Authentication Service• Ticket-granting ticket (TGT)

• Valid for 10 hours

• Ticket-granting Service• TGT is submitted to Ticket-granting Service on KDC

• Sends two copies of session ticket back to user’s machine


Kerberos in Action


Down-level Client Authentication

• Older clients referred to as down-level clients• Pre-Windows 2000

• Create security concern

• Directory Services Client • Available as add-on component to Windows 95/98

• Enables these clients to use NTLMv2 on Windows 2000/2003 network


Two-factor Authentication

• Factors that help identify you for authentication:• Something you know

• Something you have

• Something you are

• More of these factors used, more secure resource is• Increase security of network or computer system by

introducing second factor

• Called two-factor authentication


Public Key Infrastructure for Authentication with Smart Cards

• Active Directory supports use of smart cards• Part of Public Key Infrastructure (PKI)• Cryptography terms:

• Symmetric keys• Public key cryptography• Private/public key pair• X.509 digital certificate



(continued)

• Use Active Directory as repository for X.509 certificates

• Smart card: • Provides nonvolatile memory • Stores owner’s certificate and private key• Small amount of computing power to perform

encryption and decryption requiring private key on card itself



(continued)

• Use smart cards and certificates to increase security of the Windows-authentication process• System uses user’s private key

• KDC employs public key of user to decrypt it

• Can configure domain to require smart cards for logons:• Can make them optional

• Require them for some users, but not others


Active Directory Authorization

• Used to determine what actions user can or cannot do

• Discretionary access control list (DACL) • Defined as: “an access control list that is controlled by

the owner of an object and that specifies the access that particular users or groups can have to the object”


Discretionary Access Control List (DACL)

• Associated with resources• List of access control entries (ACEs)

• Specifies a “who” and a permission

• Can be very specific

• Allow or deny access

• If no match is found between access token and DACL• Access is not permitted


Discretionary Access Control List (DACL) (continued)

• Most access control entries allow access• Deny ACEs used to change effect of permissions

that user would otherwise have as member of group

• Owner of object can always gain access to object by resetting its permissions• Owner of most Active Directory objects is Domain

Admins Group


Inheritance

• Permissions can be inherited from parent objects• Referred to as inheritance• Each ACE marked to indicate whether it is

directly applied or inherited


Groups in Security• Security group

• Container object used to organize collection into single security principal

• Can contain:• Users

• Computers

• Other groups

• Simplify administration by assigning rights and permissions to group rather than to individual users


Groups in Security (continued)

• No good reason to grant rights and permissions explicitly to individual users


Delegation of Control

• Giving data owners ability to manage their own objects

• To delegate control:• Organize directory so that all objects in organizational

unit have same data owner

• Use Delegation of Control Wizard to create appropriate ACEs in DACL on the organizational unit

• Allow them to be inherited to objects in organizational unit


Activity 9-4: Using the Delegation of Control Wizard

• Objective: Set the permissions on an organizational unit using the Delegation of Control Wizard

• Follow instructions to delegate control


Granular Control

• Can delegate control with precision• Important part of flexibility of Active Directory• Advanced Security Settings dialog box

• In Active Directory Users and Computers

• Tab to display effective permissions


Permission Types

• Standard • Used for everyday tasks

• Found on main Security tab of object

• Special permissions • Represent exact and granular permissions available

• Can be very specific


Active Directory Auditing

• System access control list (SACL)• Used for auditing object access

• Very similar to DACLs


System Access Control List (SACL)

• Same basic structure as DACL• Determines if access is audited


Activity 9-7: Auditing Object Access

• Objective: Create a SACL on an Active Directory object so that access to the object can be monitored. Part of this activity requires you to work with a partner

• Follow instructions to create a SACL


Auditing Event Categories

• Audit account logon events

• Audit account management

• Audit directory service access

• Audit logon events

• Audit object access

• Audit policy change

• Audit privilege use

• Audit process tracking

• Audit system events


Protecting Network Resources

• Number of other resources on network also rely on Active Directory for security• Use DACLs

• Objects:• NTFS

• Printers

• Shares

• Registry keys


NT File System (NTFS)

• Assigns security descriptor to each object• Object in file system has:

• Owner

• DACL

• SACL

• NTFS DACL permissions relate to what users can do with the files and folders


Standard File Permissions in NTFS


Printers

• Have security descriptor with: • Owner

• DACL

• SACL

• Standard permissions:• Who can print to printer

• Who can change printer settings

• Who can manage documents


File Shares

• User must first be allowed access to share, and then access to file

• Very few choices• Allow or deny

• Full control

• Change

• Read access

• Use NTFS permissions to further restrict access to folder


Registry Keys

• Values stored in registry control how computer system operates

• Each registry key has typical Windows 2003 security descriptor with:• SACL

• DACL

• Specified owner


Other Applications

• Many applications do not perform any authentication or authorization• Can be given access control by setting NTFS

permissions on executable files or directory

• Some applications perform authentication and authorization internally• Can also gain added protection using NTFS

permissions


Other Applications (continued)

• More sophisticated applications often use Active Directory for authentication• But provide own authorization

• A few applications use Active Directory for authentication and authorization


Summary

• SIDs work with ACEs in DACLs to control access to resources or objects and with ACEs in SACLs to control auditing of resource use

• DACLs are list of ACEs used to define permission• SACLs are list of ACEs used to define auditing• Delegation of control refers to assigning

permissions on Active Directory objects so that data owners can manage their own objects


Summary (continued)

• The two primary user authentication methods in Windows Server 2003 network are NTLM and Kerberos

• Active Directory supports smart cards and X.509 certificates with extensions to the Kerberos protocol, enabling asymmetric encryption during the exchange

• Other applications may use Active Directory for authentication, authorization, both, or neither

Documents

70-294: MCSE Guide to Microsoft Windows Server 2003 Active Directory Chapter 9: Active Directory Authentication and Security