{"id":32302,"date":"2023-10-12T22:21:04","date_gmt":"2023-10-12T22:21:04","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=32302"},"modified":"2023-10-13T15:46:27","modified_gmt":"2023-10-13T15:46:27","slug":"a-powershell-script-to-mitigate-active-directory-security-risks","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/","title":{"rendered":"A PowerShell Script to Mitigate Active Directory Security Risks"},"content":{"rendered":"\n<p>Cyber attackers frequently use legacy technology as part of their attack strategies, targeting organizations that have yet to implement mitigations or upgrade obsolete components. In an Active Directory environment, one such component is legacy protocols, which attackers can use to gain access to Active Directory.<\/p>\n\n\n\n<p>While <a href=\"https:\/\/www.esecurityplanet.com\/networks\/patch-management\/\">patching<\/a> (or even <a href=\"https:\/\/www.esecurityplanet.com\/applications\/virtual-patching\/\">virtual patching<\/a>) might help address obsolete components, most legacy components have been thoroughly evaluated by adversaries to determine whether they should be replaced with a newer version or disabled entirely. That&#8217;s the case with Active Directory legacy protocols, so to help you secure your Active Directory environment, we&#8217;ve created a script to help you ensure that legacy protocols are disabled.<\/p>\n\n\n\n<p>Your primary goal in securing Active Directory infrastructure is to reduce the attack surface. There are numerous other issues that must be considered in order to reduce the attack surface for Active Directory, but legacy protocols is an important one identified recently. We&#8217;ll explain legacy protocols in Active Directory and then look at how to check whether they are disabled or not on all domain controllers in an Active Directory forest.<\/p>\n\n\n\n<p><strong>Also read: <a href=\"https:\/\/www.esecurityplanet.com\/networks\/active-directory-compromised\/\">How to Tell if Active Directory is Compromised<\/a><\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What AD Legacy Protocols Should Be Disabled<\/h2>\n\n\n\n<p>Credential theft remains relatively easy to accomplish if legacy protocol exposure isn&#8217;t reduced, as most attackers will try to exploit vulnerabilities associated with legacy protocols and their components. Microsoft has advised that the following legacy protocols be disabled in newer versions of operating systems:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TLS Version 1.1<\/li>\n\n\n\n<li>NTLM Version 1.1 or LAN Manager<\/li>\n\n\n\n<li>SMB Version 1<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Considerations Before Disabling Legacy Protocols<\/h2>\n\n\n\n<p>It is important to understand that Active Directory applications use these protocols, so be sure to perform a thorough evaluation of Active Directory applications that use these protocols before disabling any of them. If an important application is still using any of these protocols, do not disable it unless you understand the consequences. And before disabling support for legacy protocols, you must upgrade all devices and applications to use newer protocol versions. We explain how to do so below.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disabling TLS Version 1.1<\/h2>\n\n\n\n<p>TLS is a nearly two decades old protocol and has been identified as vulnerable to attacks like BEAST and POODLE mechanisms. There are several disadvantages associated with the TLS 1.1 protocol:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>As is the problem with all the legacy protocols, TLS 1.1 supports weak cryptography, which is a security risk as there are tools available to decrypt packets with weak cryptography.<\/li>\n\n\n\n<li>TLS 1.1 also doesn\u2019t help in rendering modern connections securely.<\/li>\n\n\n\n<li>TLS 1.0 has the flaw of supporting insufficient cryptography. TLS 1.2 has surpassed TLS 1.1 in most software implementations, making the latter relatively uncommon. However, from the standpoint of an attacker, any use of TLS 1.1 becomes a potential weapon in their arsenal.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-esplanet-white-color has-esplanet-purple-background-color has-text-color has-background has-link-color wp-elements-74fad99fe1244831fc54ec214f7e415c\"><strong>Azure tip:<\/strong> It should be noted that Microsoft has already disabled PowerShell&#8217;s support for the TLS 1.1 protocol. If you attempt to run a PowerShell script to connect to Azure, an error message will appear indicating that the TLS 1.1 protocol must be disabled before the script can be executed. More information about the TLS disabling statement can be found here: <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/azure\/active-directory\/enable-support-tls-environment?tabs=azure-monitor\" target=\"_blank\" rel=\"noreferrer noopener\">Enable TLS 1.2 support as Azure AD TLS 1.0\/1.1 is deprecated &#8211; Active Directory | Microsoft Learn<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Identifying if devices and applications still use TLS Version 1.1<\/h3>\n\n\n\n<p>It is difficult to determine which .NET applications are using the TLS 1.1 protocol in your environment unless you use a combination of techniques such as enabling Secure Channel logging on the domain controller, using a packet capture tool, or most likely using Wireshark.<\/p>\n\n\n\n<p>To determine whether any of your .NET applications are still using the TLS 1.1 protocol in your environment via the Secure Channel method, enable Secure Channel logging on domain controllers. Look for Event ID 36880 after enabling Secure Channel logging, which will log the protocol version used to establish the connection. To understand the IP of the client that attempted to negotiate the lower version of the TLS 1.1 protocol, you will need to correlate multiple events.<\/p>\n\n\n\n<p>In most cases, you can check with the application vendor to see if the application is still using the TLS 1.1 protocol. If the application is designed in-house, check with the development team to disable TLS 1.1 support and use the newer version for better security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disabling NTLM Version 1.1 or LAN Manager<\/h2>\n\n\n\n<p>When doing Active Directory security assessments for customers, I often find out that customers still utilize the legacy NTLM Version 1 protocol for their applications, or they have just left it enabled even if the applications in their environment are not using the NTML Version 1.0 protocol at all.<\/p>\n\n\n\n<p>The NTLM protocol is mostly used by the devices and applications running in your Active Directory environments. Note that NTLM was designed to perform authentication based on the challenge\/response-based authentication system in which a client sends the plaintext username to the domain controller. The domain controller, when receiving the plaintext username from the client, generates a random number called a \u201cchallenge\u201d and sends it back to the client. The client uses password hash to encrypt the challenge and sends it back to the domain controller as a &#8220;response.&#8221;<\/p>\n\n\n\n<p>The catch here is that if a client is using NTLM 1.1, the client takes the \u201cchallenge\u201d received from the server as is, adds the client nonce, encrypts it using DES encryption, and sends it back to the server. On the other hand, if the client uses NTML version 2.0, the client adds other parameters, such as client nonce + server nonce + timestamp + username + target. The difference between NTML Version 1 and NTLM Version 2 lies in the parameters used when sending the response back to the domain controller. These additional parameters can help you protect the conversion between a client and a server.<\/p>\n\n\n\n<p>The domain controller queries the SAM database and compares the \u201cchallenge\u201d stored in the database and received from the client. If the data matches, then the client is allowed to authenticate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Identifying if devices and applications still use NTLM version 1.0<\/h3>\n\n\n\n<p>To check if any of your devices and applications are still using the NTLM Version 1.0 protocol in your environment, look on domain controllers for <strong>Event ID 4624<\/strong> \u2013 An account was successfully logged on. Open the event and find the section \u201cDetailed Authentication Information\u201d in which you can see the \u201cAuthentication Package\u201d that is in use. If the \u201cPackage Name\u201d says \u201cLM or NTLM v1,\u201d that means the device or application that authenticated to the domain controller used the NTLM Version 1.0 protocol. That device or application needs to be upgraded to NTML Version 2.0 for better security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disabling SMB Version 1.0<\/h2>\n\n\n\n<p>Another legacy protocol that must be disabled in an Active Directory environment is SMB Version 1.0. SMB 1.0 is an old protocol that was designed to allow devices to communicate with one another across various networking layers. To access SMB shares, for example, an SMB client can connect to a server running SMB.<\/p>\n\n\n\n<p>It is important to note, however, that SMB 1.0 is a 30-year-old protocol that has seen many improvements over the SMB protocol family. We now have SMB 3.0, which supports encryption and signing using weak hashing methods. Because of increasing cybersecurity threats and Active Directory being the primary target for attackers, it is recommended that domain controllers disable SMB 1.0 completely and use SMB 2.0 or higher. However, before disabling SMB 1.0, devices that are still communicating over the SMB 1.0 protocol must be identified.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Identifying if devices\/applications still use SMB 1.0 protocol<\/h3>\n\n\n\n<p>You must examine SMB sessions on all of your domain controllers to determine which version the client is using when connecting to the domain controllers via SMB. The SMB version used between the client and the domain controller (server) will be the most recent version that both support. For example, if a Windows 8 machine communicates with a Windows 2012 server, the SMB 3.0 protocol will be used, whereas if a lower version of Windows client communicates with a Windows server and SMB 1.0 is enabled, the SMB 1.0 protocol will be used. Log on to the Domain Controller and then run the <strong>Get-SmbConnection<\/strong> command to check the SMB sessions.&nbsp; All connections and &#8220;Dialect&#8221; will be listed by the Get-SmbConnection command. The &#8220;Dialect&#8221; field indicates whether clients are requesting connections via SMB 1.0, SMB 2.0, or SMB 3.0.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PowerShell Script to Check for Legacy Protocols on Domain Controllers<\/h2>\n\n\n\n<p>The PowerShell script below can be used to verify that all of the above-mentioned protocols are disabled on domain controllers. When the PowerShell script is finished, it generates a CSV file with the status of all domain controllers for each protocol, which can be seen in the respective protocol column.<\/p>\n\n\n\n<p><strong>Script Requirements:<\/strong> Please ensure that you meet all of the requirements listed below before running the script.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Run the script using a Domain Admin account, as the script will connect to each domain controller in an Active Directory domain to check registry entries and then report the status of the protocols.<\/li>\n\n\n\n<li>Make sure the computer is joined to the domain.<\/li>\n\n\n\n<li>Make sure the C:\\Temp directory exists on the computer where the script is executed.<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-preformatted\">$ResultFile = \"C:\\Temp\\LegacyProtocolsStatus.CSV\"\n<strong>Remove-Item<\/strong> $ResultFile -ErrorAction SilentlyContinue\n$STR = \"Domain Controller, Connection Status, TLS 1.1 Status, SMB 1 Status, NTLM Status\"\n<strong>Add-Content<\/strong> $ResultFile $STR\n\n$GDCList = \"C:\\Temp\\AllDCs.TXT\"\n<strong>Remove-Item<\/strong> $GDCList -ErrorAction Continue\n\n$R = (Get-ADForest).Domains | <strong>%<\/strong> { Get-ADDomainController <em>-Discover<\/em> <em>-DomainName<\/em> $_ } | <strong>%<\/strong> { Get-ADDomainController <em>-server<\/em> $_.Name <em>-filter<\/em> * } | <strong>Select<\/strong> HostName, Domain, Forest, IPv4Address, Site\nforeach ($Item in $R)\n{\n     <strong>Add-Content<\/strong> $GDCList $Item.HostName\n}\n\nForeach ($ItemName in <strong>Get-Content<\/strong> \"$GDCList\")\n{\n   $TLStatus = \"Unknown\"\n   $SMBStatus = \"Unknown\"\n   $NTLMStatus = \"Unknow\"\n   <strong>Write-Host<\/strong> \"Checking Connection for Domain Controller: $ItemName\"\n\n   $Error.Clear()\n   $ConnectionCheck = <strong>Get-WMIObject<\/strong> Win32_Service -computer $ItemName\n   IF ($Error.Count -ne 0)\n   {\n      $STR = $ItemName + \",Connection Error\" + $TLStatus + \",\" + $SMBStatus + \",\" + $NTLMStatus\n      <strong>Add-Content<\/strong> $ResultFile $STR\n   }\n   else\n   {\n      <strong>Write-Host<\/strong> \"Connection Success!\n\n      <strong>Write-Host<\/strong> \"Checking TLS 1.1. Status...\"\n      $result = <strong>Invoke-Command<\/strong> -ComputerName $ItemName -ScriptBlock {\n         $supported = [Net.ServicePointManager]::SecurityProtocol\n         [PsCustomObject]@{\n            SystemDefault = [bool]($supported -eq 0)\n            Tls11 = [bool]($supported -band 768)\n            }\n      }\n      $TLStatus = $result.Tls11\n\n      <strong>Write-Host<\/strong> \"Checking SMB 1.0 Status...\"\n      $ThisRegKey = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LANManServer\\Parameters\"\n      $ThisRegEntry = \"SMB1\"\n      $Error.Clear()\n      $dbs = <strong>Invoke-Command<\/strong> -ComputerName $ItemName -ScriptBlock { <strong>Get-ItemProperty<\/strong> -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LANManServer\\Parameters' -Name \"SMB1\" }\n      IF ($Error.Count -eq 0)\n      {\n         $CheckValue = $dbs.SMB1\n         IF ($CheckValue -ne \"0\")\n         {\n            $SMBStatus = \"Enabled\"\n         }\n         else\n         {\n            $SMBStatus = \"Disabled\"\n         }\n      }\n      else\n      {\n         IF ($Error.Exception.Message -match \"Property SMB1\" -or $Error.Exception.Message -match \"Cannot find path\")\n         {\n            $SMBStatus = \"Enabled\"\n         }\n         else\n         {\n            $SMBStatus = \"ConnectionError\"\n         }\n      }\n\n      <strong>Write-Host<\/strong> \"Checking NTLM Status...\"\n      $ThisRegKey = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Lsa\"\n      $ThisRegEntry = \"LmCompatibilityLevel\"\n      $Error.Clear()\n      $dbs = <strong>Invoke-Command<\/strong> -ComputerName $ItemName -ScriptBlock { <strong>Get-ItemProperty<\/strong> -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Lsa' -Name \"LmCompatibilityLevel\" }\n      IF ($Error.Count -eq 0)\n      {\n         $CheckValue = $dbs.LmCompatibilityLevel\n         IF ($CheckValue -ne \"5\")\n         {\n            $NTLMStatus = \"Enabled\"\n         }\n         else\n         {\n            $NTLMStatus = \"Disabled\"\n         }\n      }\n      else\n      {\n         IF ($Error.Exception.Message -match \"Property LmCompatibilityLevel\" -or $Error.Exception.Message -match \"Cannot find path\")\n         {\n            $NTLMStatus = \"Enabled\"\n         }\n         else\n         {\n            $NTLMStatus = \"ConnectionError\"\n         }\n      }\n\n      $STR = $ItemName + \",Connection Ok\" + $TLStatus + \",\" + $SMBStatus + \",\" + $NTLMStatus\n      <strong>Add-Content<\/strong> $ResultFile $STR\n   }\n}<\/pre>\n\n\n\n<div style=\"height:2em\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>When the above script completes, you will see a report file in &#8220;C:Temp LegacyProtocolsStatus.CSV&#8221; containing the status of all protocols, as shown in the screenshot below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"652\" height=\"152\" src=\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security-figure_a.jpg\" alt=\"Screenshot of a legacy protocols status sample.\" class=\"wp-image-32304\" srcset=\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security-figure_a.jpg 652w, https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security-figure_a-300x70.jpg 300w\" sizes=\"(max-width: 652px) 100vw, 652px\" \/><\/figure>\n\n\n\n<div style=\"height:1em\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>Please keep in mind that if any of the protocols are enabled, you must check the domain controllers and take steps to disable the protocol in order to mitigate security risks in your Active Directory forest.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bottom Line: Disabling Legacy Protocols in Active Directory is Critical<\/h2>\n\n\n\n<p>Active Directory and Azure Active Directory (now Microsoft Entra ID) comprise roughly 60% of the <a href=\"https:\/\/www.esecurityplanet.com\/products\/best-iam-software\/\">identity and access management<\/a> (IAM) market and are the primary target of hackers, so shoring up Active Directory security is critically important for protecting an organization&#8217;s assets. Disabling legacy protocols is an important step toward better Active Directory security. Hackers are looking for these vulnerabilities, so you should be too.<\/p>\n\n\n\n<p><strong>Further reading:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.esecurityplanet.com\/products\/active-directory-security-tools\/\"><strong>Top Active Directory Security Tools<\/strong><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.esecurityplanet.com\/networks\/living-off-the-land-attacks\/\"><strong>Living Off the Land Attacks: LOTL Definition &amp; Prevention<\/strong><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.esecurityplanet.com\/threats\/powershell-security\/\"><strong>Cybersecurity Agencies Release Guidance for PowerShell Security<\/strong><\/a><\/li>\n<\/ul>\n\n\n<div id=\"ta-campaign-widget-66d6d1a2a12a7-popup-wrapper\" class=\"ta-campaign-widget__popup-wrapper\">\n    \n<div\n    style=\"\n        --ta-campaign-plugin-primary: #3545ed;\n        --ta-campaign-plugin-button-text: #fff;\n        --ta-campaign-plugin-button-hover-background: #3231b4;\n        --ta-campaign-plugin-button-hover-text: #fff;\n        --ta-campaign-plugin-button-toggle-background: #3231b4;\n        --ta-campaign-plugin-button-toggle-text: #3231B4;\n    \"\n    data-ajax-url=\"https:\/\/www.esecurityplanet.com\/wp\/wp-admin\/admin-ajax.php\">\n    <div\n        id=\"ta-campaign-widget-66d6d1a2a12a7\"\n        class=\"ta-campaign-widget ta-campaign-widget--popup\"\n        data-campaign-fields='{\"properties\":{\"campaign_type\":\"popup\",\"campaign_category\":false,\"sailthru_list\":[\"cybersecurity-insider\"],\"popup_type\":\"exit_intent\",\"appearance\":{\"colors\":{\"primary_color\":\"#3545ed\",\"button\":{\"button_text_color\":\"#fff\",\"hover\":{\"button_hover_background_color\":\"#3231b4\",\"button_hover_text_color\":\"#fff\"},\"toggle\":{\"button_toggle_background_color\":\"#3231b4\",\"button_toggle_text_color\":\"#3231B4\"}}},\"custom_scss\":\"\"},\"behavior\":{\"opt_in_enabled\":true},\"language\":{\"tagline\":\"Get the Free Cybersecurity Newsletter\",\"subtagline\":\"\",\"content\":\"Strengthen your organization&#39;s IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday\",\"email_placeholder\":\"Work Email Address\",\"opt_in\":\"By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time.\",\"subscribe_button\":\"Subscribe\"}},\"identifier\":\"66d6d1a2a12a7\",\"campaign_id\":26045,\"campaign_type\":\"popup\",\"popup_type\":\"exit_intent\",\"newsletters\":[\"cybersecurity-insider\"],\"behavior\":{\"opt_in_enabled\":true},\"appearance\":{\"colors\":{\"primary\":\"#3545ed\",\"button\":{\"text\":\"#fff\",\"hover\":{\"background\":\"#3231b4\",\"text\":\"#fff\"},\"toggle\":{\"background\":\"#3231b4\",\"text\":\"#3231B4\"}}},\"custom_css\":\"\"},\"language\":{\"tagline\":\"Get the Free Cybersecurity Newsletter\",\"subtagline\":\"\",\"content\":\"Strengthen your organization&#39;s IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday\",\"email_placeholder\":\"Work Email Address\",\"opt_in\":\"By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time.\",\"subscribe_button\":\"Subscribe\"}}'>\n\n                <div class=\"ta-campaign-widget__exit\">\n            <svg class=\"w-8\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" viewBox=\"0 0 24 24\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" aria-hidden=\"true\">\n                <path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\"><\/path>\n            <\/svg>\n        <\/div>\n        \n        <div class=\"ta-campaign-widget__wrapper\">\n            <div class=\"ta-campaign-widget__header mb-6\">\n                                <h3 class=\"ta-campaign-widget__tagline\">\n                    Get the Free Cybersecurity Newsletter                <\/h3>\n                \n                \n                                <p class=\"ta-campaign-widget__content mt-6\">\n                    Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday                <\/p>\n                            <\/div>\n\n            <form class=\"ta-campaign-widget__form\">\n                <div class=\"ta-campaign-widget__input mb-4\"  data-field=\"email\">\n                    <label\n                        class=\"sr-only\"\n                        for=\"email-66d6d1a2a12a7\">\n                        Email Address\n                    <\/label>\n                    <input\n                        class=\"ta-campaign-widget__input__text\"\n                        placeholder=\"Work Email Address\"\n                        id=\"email-66d6d1a2a12a7\"\n                        name=\"email\"\n                        type=\"email\">\n                <\/div>\n\n                                <div class=\"ta-campaign-widget__checkbox mb-4\" data-field=\"opt_in\">\n                    <div class=\"flex items-start\">\n                        <input\n                            id=\"opt-in-66d6d1a2a12a7\"\n                            class=\"ta-campaign-widget__checkbox__input mr-2\"\n                            name=\"opt-in\"\n                            type=\"checkbox\"\/>\n                        <label\n                            class=\"ta-campaign-widget__checkbox__label\"\n                            for=\"opt-in-66d6d1a2a12a7\">\n                            By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time.                        <\/label>\n                    <\/div>\n                <\/div>\n                \n                <button class=\"ta-campaign-widget__button\" type=\"submit\" >\n                    Subscribe                <\/button>\n            <\/form>\n        <\/div>\n    <\/div>\n<\/div>\n\n<style>\n<\/style><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.<\/p>\n","protected":false},"author":114,"featured_media":32303,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_gazelle_contributing_experts":"","footnotes":""},"categories":[14],"tags":[4766,2369,3790,12335,3414,32024,730],"b2b_audience":[35],"b2b_industry":[],"b2b_product":[382,395,404,384,31781,381,31780,31775],"class_list":["post-32302","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-networks","tag-active-directory","tag-cloud-security","tag-cybersecurity","tag-iam","tag-network-security","tag-powershell","tag-security","b2b_audience-implementation-and-support","b2b_product-application-security-vulnerability-management","b2b_product-firewalls-and-intrusion-prevention-and-detection","b2b_product-hackers","b2b_product-identity-management-privacy","b2b_product-multi-factor-access-management","b2b_product-network-access-control-nac","b2b_product-patch-management","b2b_product-web-applications-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Use this PowerShell Script to Mitigate Active Directory Security Risks<\/title>\n<meta name=\"description\" content=\"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Use this PowerShell Script to Mitigate Active Directory Security Risks\" \/>\n<meta property=\"og:description\" content=\"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\" \/>\n<meta property=\"og:site_name\" content=\"eSecurity Planet\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-12T22:21:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-13T15:46:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1400\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nirmal Sharma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@eSecurityPlanet\" \/>\n<meta name=\"twitter:site\" content=\"@eSecurityPlanet\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nirmal Sharma\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\"},\"author\":{\"name\":\"Nirmal Sharma\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/7b72728d29edbee9d87a8abdc6d1688e\"},\"headline\":\"A PowerShell Script to Mitigate Active Directory Security Risks\",\"datePublished\":\"2023-10-12T22:21:04+00:00\",\"dateModified\":\"2023-10-13T15:46:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\"},\"wordCount\":1646,\"publisher\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg\",\"keywords\":[\"active-directory\",\"cloud security\",\"cybersecurity\",\"IAM\",\"network security\",\"powershell\",\"security\"],\"articleSection\":[\"Networks\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\",\"url\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\",\"name\":\"Use this PowerShell Script to Mitigate Active Directory Security Risks\",\"isPartOf\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg\",\"datePublished\":\"2023-10-12T22:21:04+00:00\",\"dateModified\":\"2023-10-13T15:46:27+00:00\",\"description\":\"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage\",\"url\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg\",\"contentUrl\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg\",\"width\":1400,\"height\":900,\"caption\":\"Image: kras99\/Adobe Stock\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.esecurityplanet.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A PowerShell Script to Mitigate Active Directory Security Risks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#website\",\"url\":\"https:\/\/www.esecurityplanet.com\/\",\"name\":\"eSecurity Planet\",\"description\":\"Industry-leading guidance and analysis for how to keep your business secure.\",\"publisher\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.esecurityplanet.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#organization\",\"name\":\"eSecurityPlanet\",\"url\":\"https:\/\/www.esecurityplanet.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2020\/10\/eSecurity_logo_MainLogo.png\",\"contentUrl\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2020\/10\/eSecurity_logo_MainLogo.png\",\"width\":1134,\"height\":375,\"caption\":\"eSecurityPlanet\"},\"image\":{\"@id\":\"https:\/\/www.esecurityplanet.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/eSecurityPlanet\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/7b72728d29edbee9d87a8abdc6d1688e\",\"name\":\"Nirmal Sharma\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/09\/nirmal-sharma.jpg\",\"contentUrl\":\"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/09\/nirmal-sharma.jpg\",\"caption\":\"Nirmal Sharma\"},\"description\":\"Nirmal K Ratawa (Sharma) is a former Microsoft MVP in Directory Services and is MCSEx3, MCITP, and Azure Certified. He has followed the progress of Microsoft Technologies since 1994 and is an expert in directory services, Microsoft Azure, M365, Failover clusters, Hyper-V, and System Center products. In his spare time, he likes to write tips and articles to help others and share his knowledge. Nirmal is currently serving as CTO at DynamicPacks Technologies and overseeing the development of the SmartProfiler for Active Directory product at https:\/\/microsoft-assessment.com\/.\",\"url\":\"https:\/\/www.esecurityplanet.com\/author\/nirmal-sharma\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Use this PowerShell Script to Mitigate Active Directory Security Risks","description":"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/","og_locale":"en_US","og_type":"article","og_title":"Use this PowerShell Script to Mitigate Active Directory Security Risks","og_description":"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.","og_url":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/","og_site_name":"eSecurity Planet","article_published_time":"2023-10-12T22:21:04+00:00","article_modified_time":"2023-10-13T15:46:27+00:00","og_image":[{"width":1400,"height":900,"url":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg","type":"image\/jpeg"}],"author":"Nirmal Sharma","twitter_card":"summary_large_image","twitter_creator":"@eSecurityPlanet","twitter_site":"@eSecurityPlanet","twitter_misc":{"Written by":"Nirmal Sharma","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#article","isPartOf":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/"},"author":{"name":"Nirmal Sharma","@id":"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/7b72728d29edbee9d87a8abdc6d1688e"},"headline":"A PowerShell Script to Mitigate Active Directory Security Risks","datePublished":"2023-10-12T22:21:04+00:00","dateModified":"2023-10-13T15:46:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/"},"wordCount":1646,"publisher":{"@id":"https:\/\/www.esecurityplanet.com\/#organization"},"image":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage"},"thumbnailUrl":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg","keywords":["active-directory","cloud security","cybersecurity","IAM","network security","powershell","security"],"articleSection":["Networks"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/","url":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/","name":"Use this PowerShell Script to Mitigate Active Directory Security Risks","isPartOf":{"@id":"https:\/\/www.esecurityplanet.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage"},"image":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage"},"thumbnailUrl":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg","datePublished":"2023-10-12T22:21:04+00:00","dateModified":"2023-10-13T15:46:27+00:00","description":"Leverage this important PowerShell script to ensure that all legacy protocols are disabled in Active Directory to mitigate security risks.","breadcrumb":{"@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#primaryimage","url":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg","contentUrl":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/10\/esp_20231012-powershell-scripts-for-security.jpg","width":1400,"height":900,"caption":"Image: kras99\/Adobe Stock"},{"@type":"BreadcrumbList","@id":"https:\/\/www.esecurityplanet.com\/networks\/a-powershell-script-to-mitigate-active-directory-security-risks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.esecurityplanet.com\/"},{"@type":"ListItem","position":2,"name":"A PowerShell Script to Mitigate Active Directory Security Risks"}]},{"@type":"WebSite","@id":"https:\/\/www.esecurityplanet.com\/#website","url":"https:\/\/www.esecurityplanet.com\/","name":"eSecurity Planet","description":"Industry-leading guidance and analysis for how to keep your business secure.","publisher":{"@id":"https:\/\/www.esecurityplanet.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.esecurityplanet.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.esecurityplanet.com\/#organization","name":"eSecurityPlanet","url":"https:\/\/www.esecurityplanet.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.esecurityplanet.com\/#\/schema\/logo\/image\/","url":"https:\/\/assets.esecurityplanet.com\/uploads\/2020\/10\/eSecurity_logo_MainLogo.png","contentUrl":"https:\/\/assets.esecurityplanet.com\/uploads\/2020\/10\/eSecurity_logo_MainLogo.png","width":1134,"height":375,"caption":"eSecurityPlanet"},"image":{"@id":"https:\/\/www.esecurityplanet.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/eSecurityPlanet"]},{"@type":"Person","@id":"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/7b72728d29edbee9d87a8abdc6d1688e","name":"Nirmal Sharma","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.esecurityplanet.com\/#\/schema\/person\/image\/","url":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/09\/nirmal-sharma.jpg","contentUrl":"https:\/\/assets.esecurityplanet.com\/uploads\/2023\/09\/nirmal-sharma.jpg","caption":"Nirmal Sharma"},"description":"Nirmal K Ratawa (Sharma) is a former Microsoft MVP in Directory Services and is MCSEx3, MCITP, and Azure Certified. He has followed the progress of Microsoft Technologies since 1994 and is an expert in directory services, Microsoft Azure, M365, Failover clusters, Hyper-V, and System Center products. In his spare time, he likes to write tips and articles to help others and share his knowledge. Nirmal is currently serving as CTO at DynamicPacks Technologies and overseeing the development of the SmartProfiler for Active Directory product at https:\/\/microsoft-assessment.com\/.","url":"https:\/\/www.esecurityplanet.com\/author\/nirmal-sharma\/"}]}},"_links":{"self":[{"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/posts\/32302"}],"collection":[{"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/comments?post=32302"}],"version-history":[{"count":9,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/posts\/32302\/revisions"}],"predecessor-version":[{"id":32322,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/posts\/32302\/revisions\/32322"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/media\/32303"}],"wp:attachment":[{"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/media?parent=32302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/categories?post=32302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/tags?post=32302"},{"taxonomy":"b2b_audience","embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/b2b_audience?post=32302"},{"taxonomy":"b2b_industry","embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/b2b_industry?post=32302"},{"taxonomy":"b2b_product","embeddable":true,"href":"https:\/\/www.esecurityplanet.com\/wp-json\/wp\/v2\/b2b_product?post=32302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}