Forum Discussion
Active Directory Starter Scan Background As part of our...
Active Directory Starter Scan
Background
As part of our endeavor to help reduce our customers’ cyber exposure, we are releasing a Starter Scan template along with plugins that will peel the onion around Active Directory Security. We hope customers will leverage these plugins as a starting point and consider an Active Directory Vulnerability Management solution for more holistic determination, given Active Directory breaches are ever-increasing and extremely devastating.
Change
Ten plugins checking for common Active Directory misconfigurations / vulnerabilities are being released. Active Directory controller credentials will be required for these plugins to run. Active Directory specific scan templates are also being released for Nessus Professional, Tenable.sc and Tenable.io. Dashboards for Tenable.sc and Tenable.io will also be available.
Impact
Customers will be able to run scans highlighting Active Directory issues. Note that these are starter Active Directory checks. For more complete coverage, we strongly recommend considering an Active Directory VM solution.
Note that these plugins are not available on Nessus Agents.
Plugins
150480 AD Starter Scan - Kerberoasting
150481 AD Starter Scan - Weak Kerberos encryption
150482 AD Starter Scan - Kerberos Pre-authentication Validation
150483 AD Starter Scan - Non-Expiring Account Password
150484 AD Starter Scan - Kerberos Krbtgt
150485 AD Starter Scan - Unconstrained delegation
150486 AD Starter Scan - Dangerous Trust Relationship
150487 AD Starter Scan - Primary Group ID integrity
150488 AD Starter Scan - Null sessions
150489 AD Starter Scan - Blank passwords
Release Date
Thursday 29 of July 2021
12 Replies
It's frustrating that you have to search the community discussions forum to find out how to use new features like these :-(
Here's how I got it working in Tenable.sc:
- Create a new policy using the Active Directory Starter Scan template (eg. called ADSCAN).
- Accept all the defaults for Port scanning, Assessment and Results tabs.
- On the Authentication tab, click Add Authentication Settings and choose type=Miscellaneous then ADSI, then click Select.
- For Domain Controller, I enter the FQDN of a DC near one of my managed Nessus scanners.
- For Domain, I entered the NETBIOS domain name.
- For Domain Admin, I entered the samaccountname of a domain administrator account, and then obviously the password in the Domain Password field.
- Click Submit to save the policy.
- Then create a new Active Scan.
- Give it a name and for the Policy, select the policy created above (ie. ADSCAN)
- On Settings tab, I just import into my normal repository for vulnerabilities.
- On Targets tab, I specified the same FQDN of the DC used in step 4 above.
- On Credentials tab, I chose the credential that I know has Domain Admin rights (same one I used in step 6 above).
- Click Submit to save the scan.
- Run the scan and then view the results.
It seems to only fire one of the new plugins when something bad is found, so for me, I didn't get results for all 10 new AD plugins - only a few.
Hope this helps someone else.
Is just one AD server required in the Targets section? Does this need Domain Admin creds in Credentials section? (when I try add an existing Managed Credential they are all greyed out, and only allows me to add a Miscellaneous/ADSI cred). Thx
is there any instructions on how to setup the scan. I have the same issue as well?
what kind of credentials are required, or to put it differently, why are credentials required at all? we have nessus agents installed on our DCs to avoid sensitive credentials floating around somewhere.
@Jesus Galan
So I am guessing if we wanted to scan multiple AD/DC's when we setup the credentials in the policy under Authentication>Misc>ADSI we would need to have an entry for each server we setup in the active scan under targets?
Also, if we are using port 636 rather than 389 is the policy/scan smart enough to figure that out? All the Tenable.SC documentation I can find only references port 389 when using the ADSI creds. I can't find anything about being able to specify port 636.
Lastly, are there any efforts being worked by tenable to allot the use of "managed" credentials? If we use an integration with an IAM Tool to manage credentials is Tenable working on a solution to allow the use of the managed creds in the policy or via the active scan like all other creds? Do we need to open a feature request for something like this?
For Nessus porfessional AD Starter Scan I have the following error:
adsi_enum.nbin: ADSI error
ADSI server (example.com) could not connect to server.
For a credentialed vulnerability scan, credentials work OK.
For AD Starter Scan no.
What to put on ADSI Domain Controller / Domain credentials?
I cannot get the credentials to work in Nessus Pro - getting the same adsi_enum error.
The steps used by @Scott Hislop above worked for me. (Expand his post) I didn't use the netbios domain and for the account I needed to use my account name only (no @FQDN) that seemed to be the two changes I needed to get this going without the ADSI error.
Greetings? Did you have any support on this?
For Nessus porfessional AD Starter Scan I have the following error:
adsi_enum.nbin: ADSI error
ADSI server (example.com) could not connect to server.
For a credentialed vulnerability scan, credentials work OK.
For AD Starter Scan no.
What to put on ADSI Domain Controller / Domain credentials?
