Determine listening ports (and associaeted processes)

Scenario: You want to determine which ports are listening on an Microsoft server and the belonging process

Run the command netstat -ano |find /i "listening"

The last column shows the PID (ProcessID) the port belongs to. Use Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653) to find out the name of the executable that belongs to the PID .

Kerberos pre-authentication failed on DC from 127.0.0.1

Scenario: You recieve a large amount of Event ID 675 on a DC where client Adress is 127.0.0.1. It is usally from the administrator account.

This can be a result of a number of issues, first check that no service or process is using the particular account.

In my case it was problem with the DHCP DNS registration that were set to use the Administrator account. So, go look at:

Manage Your Server –> Manage this DHCP server –> In the DHCP dialog; right click the server and choose Properties –> Advanced tab –> Credentials. Make sure the account entered there have necessary rights and that the password is correctly entered (see http://support.microsoft.com/kb/816592 for details).

Get computer serialnumber from windows

Useful command:

‘wmic bios get serialnumber’

read more at http://support.microsoft.com/kb/558124

‘net send’ vs msg.exe

This article aims to investigate the possibilities, limitations and differences between the old NT command “net send” and the newer msg.exe utility.

net send (usage: net send [computername] [message]

Conditions:

• The machine must be running XP or 2003 Server (net send is not available in Vista, Win7 or Server 2008
• The service “Messenger” must be running (sending and receiving machine) It is disabled by default from XP sp2 and later
• NetBIOS must be enabled (sending and receiving machine)
• The ports 137/UDP and 139/TCP must be open (receiving machine)
• Domain-independent

msg.exe

Conditions

• Available in 2003 Server, XP sp2/sp3, 2008R2, Vista, Win7
• Sending and receiving machine must be members of the same domain
• Not NetBIOS dependent
• Only uses port 445/TCP (SMB)
• Possible to use IP instead of machinename
• Not dependent on the messenger service.

Note: If you have trouble with “Access denied” problems, try this registry hack: Locate the DWORD key “AllowRemotePRC” in HKLM/System/CurrentControlSet/Control/Terminal Server. it should be set to “1”. 

If none of these meet your requirements, the following third party softwares are available:

• Net Send (freeware=
• WinMessenger (freeware)
• LantalkNet (shareware)
• LANegram http://www.vbforums.com/showthread.php?t=589156 (open source)

Account lockout problems

Scenario: User accounts are continuosly being locked out as a result of numerous failed password attempts.

 

Microsoft tool “Account Lockout and Management Tools” (http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en) kan användas.

Documentation: http://technet.microsoft.com/en-us/library/cc738772(WS.10).aspx

Check functions that be configured to use specific user accounts to run under, for example:

Mapped shares/drives

Services

Scheduled tasks

Software that uses cashed credentials.

Forward Windows Events

Requires at least Windows Vista

http://msdn.microsoft.com/en-us/library/aa390433(VS.85).aspx

Server 2003, 2008 log references

http://www.windowsecurity.com/articles/Event-IDs-Windows-Server-2008-Vista-Revealed.html

Useful tools for Active Directory

netdiag

dcdiag

nltest

nslookup