📄
Bufu-Sec Wiki
GithubTwitter
  • Bufu-Sec Wiki
  • Active Directory
    • General
      • General
      • Installation
      • DNS
      • Kerberos
      • Kerberos Delegation
    • Enumeration
      • AD Module
      • Bloodhound
      • PowerShell Cheatsheet
      • PowerView Cheatsheet
      • Users
      • Groups
      • Computers
      • OUs
      • GPOs
      • ACLs
      • Domains
      • Trusts
      • Forest Mappings
      • Files and Shares
      • Kerbrute
    • Privilege Escalation
      • Kerberoasting
      • AS-REP Roasting
      • Constrained Delegation
      • Unconstrained Delegation
      • DNS Admins
    • Lateral Movement
      • PS Remoting
      • Credential Dumping
      • DC Sync
      • Overpass the Hash
      • Ticket Harvesting
      • Pass the Ticket
    • Persistence
      • Golden Tickets
      • Silver Tickets
      • ACL Attacks
      • Custom SSPs
      • DC Shadow
      • Skeleton Key
      • DSRM
    • Trust Attacks
      • Cross Domain Attacks
      • Cross Forest Attacks
      • MSSQL Servers
    • MITM & Relay Attacks
      • LLMNR Poisoning
      • SMB Relay
      • IPv6 Attacks
    • Detection & Defense
      • Domain Admins
      • Architectural Changes
      • Microsoft ATA
Powered by GitBook
On this page
  • Setup DNS
  • Install AD DS on Server Core
  • Add Domain Controller
  • Create DC from IFM Media
  • Clone DC
  • Join Computer To Domain
  1. Active Directory
  2. General

Installation

Setup DNS

# Install normal DNS server
Install-WindowsFeature DNS

# Register DNS records
cmd /c ipconfig -registerdns

Install AD DS on Server Core

# Install AD DS and management tools
Install-WindowsFeature -Name ad-domain-services -IncludeManagementTools

# Install new forest and domain
Install-ADDSForest -DomainName "lab.local"

Add Domain Controller

# Add domain controller and prompt for credentials
Install-ADDSDomainController -DomainName "lab.local" -Credential (Get-Credential Lab\Administrator)

Create DC from IFM Media

" Create directory for image
mkdir C:\ifm

" Launch ntdsutil
ntdsutil
ntdsutil: activate instance ntds
ntdsutil: ifm
ifm: create sysvol full c:\ifm

Transfer folder to target computer then run

Install-ADDSDomainController -DomainName "lab.local" -Credential (Get-Credential Lab\Administrator) -InstallationMediaPath "C:\ifm"

Clone DC

# Get list of applications that do not support cloning
Get-ADDCCloningExcludedApplicationList

# Create list of applications that do support cloning
Get-ADDCCloningExcludedApplicationList -GenerateXml

# Create config file
New-ADDCCloneConfigFile -Static -IPv4Address "192.168.47.13" -IPv4DNSResolver "192.168.47.10" -IPv4SubnetMask "255.255.255.0" -CloneComputerName "DC04" -IPv4DefaultGateway "192.168.47.2"

# Shutdown computer and clone VM
Stop-Computer

Join Computer To Domain

# Add computer to domain and restart
Add-Computer -DomainName "lab.local" -Restart

# Rename computer and add to domain
Add-Computer -DomainName "lab.local" -NewName "test" -Restart
PreviousGeneralNextDNS

Last updated 2 years ago