ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
APPENDIX D: DIRECTORY INFORMATION GATHERING
This appendix of the Checklist describes tools and methods that could be used to gather directory
information. This is certainly not an exhaustive list. It is intended to point out some of the
simpler and less invasive tools that are available. Although multiple tools are described, the
emphasis is on the simplest command line tools and methods.
D.1 Active Directory
The tools and processes in this section are used to gather information about Active Directory
implementations. SAs may consider compiling some of these tools into batch scripts that could
be used to automate information gathering for their specific environment.
Note: Some of the procedures described here require that the user performing the actions is a
member of the Domain Admins security group.
Note: Some of the tools described here require specific Windows releases or the installation of
additional programs:
- Methods that are identified with “Windows Server 2003” use programs that are present on
domain controllers that are running that release or later.
- Methods that are identified with “Windows Support Tools” use programs that are installed
with the Windows Support Tools optional component. Although present on the OS server
installation CD, these programs are not installed by default.
- Methods that are identified with “Script” use the Windows Script Host (WSH) to execute
scripts written in the Microsoft Visual Basic Scripting Edition (VBScript) language. The
scripts invoke the Active Directory Service Interfaces (ADSI) components to get information
from AD. These components are present on all Windows 2000 and later releases, but it is
possible that the execution of VBScript scripts is restricted or disabled on individual
machines.
D.1.1 Identifying Domain Controllers
The following are methods to get a list of all the domain controllers in a domain.
Method 1: Microsoft Management Console
a. Start the Active Directory Users and Computers console (“Start”, “Run…”, “dsa.msc”).
b. Select and expand the left pane item that matches the name of the domain being reviewed.
c. Select the Domain Controllers OU.
d. Each domain controller is represented as an object in this OU.
Notes: This method assumes that domain controller computers are members of the Domain
Controllers OU. This is the default AD configuration and Microsoft recommends strongly
against changing it.
UNCLASSIFIED
D-1