【TryHackMe】Active Directory Basics：Walkthrough

# 概要

TryHackMe「Active Directory Basics」のWalkthroughです。

https://tryhackme.com/r/room/winadbasics

# Task2

## **Q1**.*In a Windows domain, credentials are stored in a centralised repository called...*

**A**.**Active Directory**

## **Q2**.*The server in charge of running the Active Directory services is called...*

**A**.**Domain Controller**

# Task3

## **Q1**.*Which group normally administrates all computers and resources in a domain?*

**A**.**Domain Admins**

## **Q2**.*What would be the name of the machine account associated with a machine named TOM-PC?*

命名規則により最後に`$`が付きます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/776fc9a6-fd4e-b153-420c-19aca2662afe.png)

**A**.**TOM-PC$**

## **Q3**.*Suppose our company creates a new department for Quality Assurance. What type of containers should we use to group all Quality Assurance users so that policies can be applied consistently to them?*

**A**.**Organizational Units**

# Task4

## **Q1**.*What was the flag found on Sophie's desktop?*

`Active Directory Users and Computers`->`View`->`Advanced Features`にチェックを入れます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/50c4add6-5c35-9809-dc0c-d1801497cb73.png)

`Research and Development`->`Properties`->`Object`から`Protect object from acciental deletion`のチェックを外します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/4f1ac02d-48ed-4f2c-d855-180e5b9a587c.png)

`Research and Development`を削除します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/1ef55926-f504-92d3-8f53-b33fac2f59dd.png)

`Sales`->`Delegate Control`画面へ遷移します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/6d134f3c-1ec9-63e9-af88-e0f7dabf4050.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/b37b980a-4605-b33c-c4d3-48b0b4b1517f.png)

`Add`ボタンをクリックし、`phillip`ユーザーを追加します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/79a440df-22c2-94df-a81f-d0b20323233c.png)

パスワードリセット権限にチェックを入れ設定します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/5585c781-fdb6-970f-e750-5d7220533317.png)

`phillip`にRDPで接続します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/959dce1d-c0be-3ab8-3119-e6c35625798f.png)

PowerShellから`sophie`アカウントのパスワードをリセットします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/b5fc7e09-0434-efdd-3d61-053d6cbec6b1.png)

`sophie`へRDPで接続し、デスクトップのファイルからフラグを入手できました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/520bc47f-2fc9-672b-3a75-055cca5e2678.png)

**A**.**THM{thanks_for_contacting_support}**

## **Q2**.*The process of granting privileges to a user over some OU or other AD Object is called...*

**A**.**delegation**

# Task5

## **Q1**.*After organising the available computers, how many ended up in the Workstations OU?*

`thm.local`にOUを追加します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/2a647ea6-2782-7cf5-aba3-baae8b551712.png)

`Workstations`,`Servers`というOUを2つ追加します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/0a11ea1d-7277-bab9-6caa-cee3ab6818c3.png)

`Computers`のラップトップ,PCは`Workstations`にサーバーは`Servers`に移動させます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/f25655a2-0dd5-4e4b-3861-816aa3bd6abf.png)

`Workstations`のコンピュータは`7`個になりました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/2cf9d119-ee47-f6bf-da37-f478869efdf5.png)

**A**.**7**

## **Q2**.*Is it recommendable to create separate OUs for Servers and Workstations? (yay/nay)*

**A**.**yay**

# Task6

## **Q1**.*What is the name of the network share used to distribute GPOs to domain machines?*

**A**.**SYSVOL**

## **Q2**.*Can a GPO be used to apply settings to users and computers? (yay/nay)*

**A**.**yay**

# Task7

## **Q1**.*Will a current version of Windows use NetNTLM as the preferred authentication protocol by default? (yay/nay)*

**A**.**nay**

## **Q2**.*When referring to Kerberos, what type of ticket allows us to request further tickets known as TGS?*

**A**.**Ticket Granting Ticket**

## **Q3**.*When using NetNTLM, is a user's password transmitted over the network at any point? (yay/nay)*

**A**.**nay**

# Task8

## **Q1**.*What is a group of Windows domains that share the same namespace called?*

**A**.**Tree**

## **Q2**.*What should be configured between two domains for a user in Domain A to access a resource in Domain B?*

**A**.****