I was working with Active Directory a couple of days ago and discovered something very interesting. I created a user account using a VB script. I mistyped the domain name in the UPN, which led to this discovery. First of all, here’s what the script looks like:<\/p>\n
Set objOU=GetObject(“LDAP:\/\/OU=Executives,DC=nwtraders,DC=msft”)
\nSet objUser=objOU.Create(“User”, “cn=BillG”)
\nobjUser.Put “sAMAccountName”, “BillG”
\nobjUser.SetInfo
\nobjUser.AccountDisabled=FALSE
\nobjUser.ChangePassword “”, “P@ssw0rd”
\nobjUser.Put “userPrincipalName”, “BillG@bogus.com”
\nobjUser.Setinfo<\/p>\n
Notice the domain I used in the UPN “BillG@bogus.com<\/b>“. When I created the account, I was able to logon as that account. The user account Properties showed that the UPN is BillG@bogus.com. It looked like bogus.com was an alternate suffix because the dropdown box listed both the nwtraders.msft domain and the bogus.com domain. However, I verified that bogus.com was NOT listed as an alternate suffix in AD Domains and Trusts.<\/p>\n
What’s interesting is that I can logon as the UPN BillG@bogus.com and continue to work fine but as soon as I logon with the UPN BillG@nwtraders.msft once, it deletes the bogus.com entry in the user’s Property (account tab).<\/p>\n
I am wondering if there’s a way to take advantage of this “hidden” alternate suffix as far as security is concerned. If you have any thoughts, I’ll love to hear them.<\/p>\n","protected":false},"excerpt":{"rendered":"
I was working with Active Directory a couple of days ago and discovered something very interesting. I created a user account using a VB script. I mistyped the domain name in the UPN, which led to this discovery. <\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[6,38],"tags":[],"class_list":["post-5","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-windows-2003"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t