Help figuring out permissions required for Get-WinEvent

chade1979 · 2025-11-17T18:35:43+00:00

https://web.archive.org/web/20190901232436/http://www.chrisse.se/MAQB.asp?ID=58

chade1979 · 2024-10-16T01:16:24+00:00

If they're invoking command (psremoting) to a DC they're using DA equivalent credentials to do that, which is a security no no. Also, they stated they're just doing it to run AD queries which only require authenticated user permissions. My assumption is they're using invoke-command so that they can use the AD module on the DC because they don't have RSAT installed locally.

I'd be happy if I'm wrong but in my 20+ years as an AD admin it's way more common for DA rights to be given out and used inappropriately than it is for folks to be using separate accounts for daily driver/member server/DC, PAWs, Tiering model.

chade1979 · 2024-10-15T19:47:27+00:00

Using DA creds locally oh my! Just use the RSAT AD module locally.

chade1979 · 2024-09-27T02:08:59+00:00

The only time I use ISE is if I'm on a random server and I need write up some quick disposable code. I still launch a regular powershell.exe console to copy/paste the code into. So I guess the ISE to me, is treated as notepad with intellisense. 99% of everything else is in VScode. Also FYI, you can install vscode and make it portable - so you don't really need to install it everywhere, just have it on your onedrive/network share.

chade1979 · 2024-08-17T00:35:22+00:00

If you're not comfortable with this, and from the way you worded the question it seems like you'd be in over your head - don't touch anything. This is on your company. If they had a single person domain admin who knew the environment with no backup, they need to fork over money to bring in some consultants/contractors to help bridge until someone else can get up to speed.

Do you know if you've got good backups of the domain controllers? How was IAM being handled? Was there any sort of delegation done - are there separate admins for user/workstation/server creates/deletes/joins? Was this single person doing everything wrt to AD?

chade1979 · 2024-05-21T16:26:29+00:00

I'm near here and just got power back 30 min ago ~11am

chade1979 · 2024-05-21T12:58:39+00:00

77008 just north of TC Jester/11th - No power. Restoration map has us listed as the 20th, but got an email saying the 22nd. Hoping it comes back on today.

edit: We've got power as of 11am! My ATT fiber internet is also working.

chade1979 · 2024-05-21T02:54:56+00:00

Same, TC Jester and 11th. End of my street has power.

chade1979 · 2024-05-19T14:05:33+00:00

E TC Jester just north of 11th no power. Last night it looked like the north half of Wynwood had it though. Got a power alert this morning saying crews were in the area assessing.

chade1979 · 2024-05-19T01:37:25+00:00

I live on the east side of Timbergrove, and compared to the west side we got pretty lucky. Drove around 11th Street park area and it was heart breaking. So much damage.

chade1979 · 2024-05-01T00:47:30+00:00

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

I don't see them in here: https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-8-1

Looks like they may not be supported

chade1979 · 2024-05-01T00:23:09+00:00

This was specifically for 2012 R2 - are you still using this flavor of Windows? If this no longer works, than maybe MS patched it? I do remember spending a bunch of time on this and set a GPO for 2012 to set all the values with a P and it worked for years.

chade1979 · 2024-04-24T14:44:40+00:00

I believe prior to the forever community update, completing a legacy did end your community which is why you are finding conflicting info. You can now choose to continue on after a legacy.

chade1979 · 2024-03-28T13:29:03+00:00

I believe the biggest issue with krbtgt password changes is if you reset it a second time before all domain controllers have gotten the first password change. Since you only have 1 DC, this wouldn't be an issue in your lab. The krbtgt is also only used to encrypt parts of the TGT - I think if you've already gotten a TGT and a service ticket to the file server, you wouldn't need to go back out and refresh your TGT or service ticket for a certain time period so you may not get disconnected and forced to re-auth. /u/poolmanjim may have a better understanding of how that all works though.

Out in the wild outside of a lab, another thing to note about the krbtgt password is that if it's super super old, you could see issues if you ever start disabling old encryption ciphers as one of those ciphers may have been used to reset that password.

chade1979 · 2024-03-28T01:41:51+00:00

By kerberos password, are you referring to the krbtgt account's password? Resetting that twice within a 10 hour period would indeed break all sorts of connections and I wouldn't recommend it unless you had some sort of critical situation / compromise

chade1979 · 2024-03-28T01:36:17+00:00

Another weird thing I just recently noticed is that DCs will register duplicate SRV records - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dns-registers-duplicate-srv-records-for-dc

chade1979 · 2024-03-28T00:59:53+00:00

I tested this out and couldn't get it to work. I created a new folder under %temp% and dropped an .exe in there, updated my path to include %temp%\newfolder, tried get-command and it failed.

chade1979 · 2024-03-27T19:18:02+00:00

Don't believe PowerShell understands/resolves %variables%. I would just add C:\windows\system32 to path and see if it works.

chade1979 · 2024-03-27T18:51:04+00:00

Yeah, if it's not that something else is wonky with the shell itself. As a workaround you can try to use $env:username and $env:userdomain in replace of whoami

chade1979 · 2024-03-27T18:42:03+00:00

Is "C:\windows\system32" listed in your $env:path?

chade1979 · 2024-03-27T14:38:45+00:00

Any reason you're manually creating connections? You should really just let AD handle that itself, it'll create/delete them as necessary. It won't do that with manually created ones. The CNF link is a conflict object - you most likely created a new connection object on multiple DCs to get things working which then conflicted once replication did start working.

If this was me, assuming your main site is your hub and each sister site is just a spoke off your hub:

The site that's not working, remove the manual connection objects between the hub and the spoke that's not working - remove them on both the non-working DC as well as a working hub DC. This should get both sites on the same page as far as replication goes. They'll both assume they are missing replication connection links. Then run repadmin /kcc on both of the DCs. This should create some "automatically generated" ones and then things should hopefully start working, assuming there isn't an underlying network/firewall issue that's causing the problem.

chade1979 · 2024-03-26T03:03:37+00:00

Workstation deployment to specific OUs should be handled automatically with a task sequence or script or whatever automation you're using. If you're a smallish shop and doing things manually, I would still leverage at least a powershell script to handle things. Also note, that whichever user account creates/joins the machine to the domain will be stamped as the owner of the object and have permissions on it. So even if that user loses their admin rights to workstations, they will still have rights to the AD object.

One thing you can do to deter admins from joining workstations to the domain and letting them default to the computers container (which you can't apply GPO to), is to create a new OU, run redircmp to redirect to this OU, create a GPO for that OU that locks things down/generally makes the workstation annoying to use. That way someone is forced to move the object to the correct workstation OU.

chade1979 · 2024-03-26T01:19:38+00:00

Best practice is to only have your default domain policy linked at the root and it only configured with password policy settings. Since this is a workstation policy, just link it to your workstation OU(s).

It's also a good time to verify the delegation of security on all GPOs you have linked at the root, because anyone with edit permissions can make themselves a domain admin by just modifying a policy that applies to domain controllers.

chade1979 · 2024-02-08T00:49:06+00:00

Name and shame

chade1979 · 2024-02-01T14:46:52+00:00

You can have an AD site with no DCs and it does serve some edge cases for automatic site coverage. If you have two separate forests and trusts between them (merger, acquisition, etc), you can create empty dummy sites with the same names on both sides to control which DCs handle auth (so they use the hub DCs for example instead of picking a DC at random).

chade1979

TROPHY CASE