14. Active Directory

Lawliet works with Active Directory in four ways. None of them needs the Lawliet server to join the domain.

Agents also report domain membership: the Environment > Hosts list shows standalone, member <domain> or DC <domain> under each host. Deploying agents with a domain account is in chapter 13; rolling them out with Group Policy is in chapter 12.

14.1 What you need from the domain#

Find the values on a domain controller:

(Get-ADDomain).DNSRoot            # DNS domain
(Get-ADDomain).NetBIOSName        # NetBIOS domain name
(Get-ADDomain).DistinguishedName  # base DN
Get-ADDefaultDomainPasswordPolicy | Select LockoutThreshold, LockoutObservationWindow
Get-ADGroup "Lawliet Admins" | Select DistinguishedName, SID

14.2 Procedure: set up directory sign-in#

Required permission: Manage users. Four-eyes: yes (saving is a user-management change, critical action "Change users").

Before you start: keep at least one active local super administrator. Lawliet refuses to turn directory sign-in on without one. It is your way in if the directory is unreachable.

1. Open Settings > Authentication.

2. Under Directory sign-in, fill in:

   Field	What to enter
   Enabled	Tick to switch directory sign-in on
   Domain controllers	One per line, host or IP with optional port: dc1.corp.example.com:636. Tried in order; the next one is used only when one is unreachable
   Transport	LDAPS (636) or StartTLS (389). Plain LDAP is not offered
   Failed sign-ins per account	1 to 4 per window. Must stay at least 2 below the domain's lockout threshold. The page shows the domain's policy once it has been read
   Session lifetime	1, 2, 4, 8, 12 or 24 hours (default 8). The user signs in again after this
   DNS domain	corp.example.com
   NetBIOS domain name	CORP. Accounts of any other domain are refused
   Base DN	DC=corp,DC=example,DC=com
   CA certificate (PEM)	Upload the CA file (max 64 KB). Without it only publicly trusted certificates are accepted, so an internal CA must be uploaded
   Service account (optional)	Recommended. Read-only. Needed for the background sync, for UPN names, and for Windows sign-in
   Service account password	Encrypted on the server and never shown again. Retype it whenever you change the servers, transport, CA or account

3. Under Group to role, click Add rule for each mapping. Name the group by sAMAccountName (Lawliet Admins), distinguished name, or SID, and pick the role. The first matching rule wins: put the most privileged rule first (use Up / Down). With no rules, "No rules: no directory account can sign in."

4. Click Test connection. Each server is reached over TLS and its certificate checked; the base DN is read; with a service account, the lockout policy is read and the cap checked. What you see: per server TLS verified or Failed with the reason.

5. Click Save changes. With dual control on: "Sent for approval. It takes effect once it is signed off and executed." Have it approved and execute it from Approvals.

What users see: the sign-in page offers Sign in with directory account. They enter DOMAIN\user (or a UPN when a service account is configured) and their AD password. On the first sign-in they must enrol an authenticator app. Two-factor is always required for directory accounts.

If it fails:

Lockout safety: Lawliet counts every bind before it sends it, and refuses without contacting the DC once an account reaches the cap. Lawliet's own binds never take an account closer than 2 attempts to the domain's lockout threshold. Failures from other systems (workstations, mail) still count against the same threshold.

Roles: the role is recomputed from the groups at every sign-in. An administrator can still deactivate a directory user in Settings > Users; that wins over the directory. The last active super administrator is never demoted by a group change; such a user's sign-in is refused with a message to use the local break-glass account.

14.3 Procedure: directory sync#

Directory sync re-reads every active directory user in the background (service account required). A user who is disabled, locked, expired, deleted or no longer in a mapped group loses all console sessions at once, and the Lawliet account is deactivated. A changed role is applied.

Required permission: Manage users. Four-eyes: only for Apply anyway.

1. In Settings > Authentication > Directory sync, choose Sync every (1 to 60 minutes, default 5). It is saved with the settings above (Save changes).
2. Click Sync now to run a cycle at once (at most once a minute).
3. Read Status: the last sync, its result, users checked and changed, and errors.

If the directory cannot be read, nothing is revoked; Lawliet retries with backoff and raises one alert.

Mass changes are held back. If 3 or more users, and more than half of those read, would lose access in one cycle, nothing changes and an alert is raised (a service account that lost read rights looks exactly like that). Check the service account and the mappings. If the directory is right, click Apply anyway (four-eyes). It is applied only if a fresh cycle finds exactly the same users and reasons.

A user the sync deactivated is reactivated by their next successful directory sign-in. A user an administrator deactivated stays deactivated.

14.4 Procedure: Windows sign-in (Kerberos single sign-on)#

People on a domain computer press Sign in with Windows (Kerberos) and are signed in with their Windows ticket. The account then goes through directory sign-in exactly as after a password (groups, disabled checks, second factor). NTLM is never accepted.

Required permission: Manage users. Four-eyes: yes for uploading the keytab, switching Windows sign-in on, allowing RC4, and skipping the authenticator code. Switching off and removing the keytab take effect on one signature.

Prerequisites:

1. Directory sign-in with a service account (14.2).
2. The domain as a Kerberos realm under Environment > Hosts > Deploy agents remotely > Kerberos realms (chapter 13.4). The realm is the directory's domain in capitals.
3. A DNS name for the console that people type, for example lawliet.corp.example.com. An IP address does not work (the browser then offers NTLM, which is refused).
4. A service keytab for HTTP/<console name>@<REALM>, made by the domain administrator:

   New-ADUser -Name svc-lawliet-http -AccountPassword (Read-Host -AsSecureString) -Enabled $true -PasswordNeverExpires $true -CannotChangePassword $true
   Set-ADUser svc-lawliet-http -KerberosEncryptionType AES128,AES256
   setspn -S HTTP/lawliet.corp.example.com CORP\svc-lawliet-http
   ktpass /princ HTTP/[email protected] /mapuser CORP\svc-lawliet-http /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL /pass * /out lawliet.keytab

   The keytab is the console's service key: whoever holds it can make tickets to the console for any user. Copy it only to the machine you upload from, upload it, delete it.

5. Browsers told to trust the console name: add https://lawliet.corp.example.com to the Local intranet zone, or set the browser policy AuthServerAllowlist to lawliet.corp.example.com (Edge, Chrome). Firefox: network.negotiate-auth.trusted-uris.

Steps:

1. Settings > Authentication > Windows sign-in (Kerberos). Each realm has a card. If none: "No Kerberos realm is configured. Add the domain under Remote deployment > Kerberos realms first."
2. Under Service keytab, enter the Console host name (as people open it) and click Upload keytab. Choose the file. Have the request approved and executed. What you see: the principal, key version and encryption types. The file must hold exactly HTTP/<host>@<REALM> and nothing else.
3. Tick Offer Windows sign-in and click Save. Have it approved and executed.
4. Optional switches:
   • Allow RC4 keys: only for a service account without AES keys.
   • Do not ask for the authenticator code after Windows sign-in: applies only to enrolled users whose role cannot approve or perform critical actions (in the built-in roles: analyst, auditor, viewer). Administrators, officers and super administrators are always asked.
5. The card lists anything still missing ("What is missing"). The sign-in page shows the button only once nothing is.

If it fails (reason in the audit trail, resource directory_signin, method kerberos):

Procedure: replace or remove the keytab, or turn Windows sign-in off#

Replace the keytab when the service account's password changed (ticket_refused).

1. Settings > Authentication > Windows sign-in (Kerberos), the realm's card.
2. To replace it, click Replace keytab and choose the new file. Have it approved and executed.
3. To stop offering Windows sign-in but keep the keytab, untick Offer Windows sign-in and click Save.
4. To remove the keytab, click Remove keytab. You see "Keytab removed; Windows sign-in is off for this realm." Removing takes effect on one signature (it takes access away).

Users can still sign in with their local or directory password while Windows sign-in is off.

The server's clock must be within 5 minutes of the domain's. Check KDCs shows the offset. Keep Redis persistence on where Windows sign-in is enabled (it remembers used tickets for 10 minutes).

14.5 AD assessment#

AD assessment (sidebar, under Network & Data) analyses a domain from a collected snapshot: privileged accounts, findings, attack paths, compliance controls, and agent coverage.

Permissions: View compliance to view; Manage compliance to register domains and collect; Write to Active Directory for any write to the domain (always four-eyes, critical action "Write to Active Directory").

Procedure: register a domain and collect#

Collection is read-only. It never changes the directory.

1. Open AD assessment. In Register a domain, enter the DNS name (corp.example.com) and click Add.
2. Make sure directory sign-in has a service account and points at this domain (14.2). Directory sign-in itself does not have to be enabled.
3. Pick the domain in Domain and click Collect permissions now. What you see: "Collecting directory objects and permissions over LDAPS. This page updates when it ends."
4. When it ends, pick the collection in Collection (#id - source - date). The tiles show Principals, Findings, Attack paths and Controls failing.

If it fails:

The tabs#

Deploy agents via GPO (Coverage tab)#

The Deploy agents via GPO button sends a four-eyes request ("Submitted - approve it in Approvals."). When approved and executed, a Windows agent on a domain controller creates a GPO named "Lawliet Agent Deployment", links it at the domain root, and sets a machine RunOnce value on it.

In 1.5.13.s: the console sends no installer address with this request, so the GPO is created and linked with a placeholder command and does not install the agent. Do not use the button; use the Windows MSI for Group Policy instead (chapter 12.4).

If the button was pressed and executed, undo it (Risk: none, the GPO does not install anything):

1. On a domain controller or a management host, open Group Policy Management.
2. Find the GPO "Lawliet Agent Deployment" linked at the domain root.
3. Right-click the link and clear Link Enabled (or delete the link), then delete the GPO if nobody needs it.
4. What you see: gpresult /r /scope computer on a member no longer lists the GPO after its next policy refresh.

Removing a domain#

The console has no button to remove a registered domain or its collections in this release, and findings have no status buttons here. Each collection keeps its own findings: pick the newest collection in Collection to see the current state. A domain you no longer assess simply stays in the list; nothing is collected from it unless someone presses Collect permissions now.

More detail: directory sign-in reference and Windows sign-in reference.