Quickly let's talk about the token impersonation mitigation strategies.
So with this we can limit user and group token creation permissions.
That one's a little tricky.
It will not fully prevent everything.
I don't believe not in my opinion the better idea here in the beating down you know some of the repetition
that we're gonna have here account hearing very important your domain administrators should be logging
into the machines that they need to access which should only be domain controllers.
If for some reason that domain administrator logs into a user computer or a server and that user computer
or server gets compromised.
Guess what.
We can impersonate that token if we compromised the domain controller.
What do we need to impersonate the token for.
We've already compromised that domain controller.
So yes we can still do a token impersonation attack on the domain controller but you know there's no
point there.
But if we you know somewhere else in the network on a user or a server a different server then we can
compromise that become domain Avrin Advent and leverage that so that's one to local Advent restriction
comes into play yet again if users are not local admins on their computers we cannot get a shell on
that computer with their account that prevents us from getting onto the computer and utilizing this
kind of attack.
So we need to have a hearing we need to have a local admin restriction in the network.
And when I say account hearing as well it should be noted that users typically have two accounts when
we have accounts hearing you might have Bob and then you may have Bob dash a.
So Bob will have his everyday regular user account and then when he wants to go access the Domain Controller
he's in a log in as Bob dash a which stands for admin and he's only going to log in the Domain Controller
and isolate his accounts with this hearing.
So that way anywhere else that Bob has access or privilege to you're not going to be able to get a domain
controller if you compromised Bob's regular user account.
And typically the domain admin accounts have a longer password policies and are more strict with their
permissions.
So something to think about in terms of defeating this and it's just beating a dead horse in a lot of
this right.
Just a lot of repetition on some very simple policies.
And if these policies are in place which in most networks they're not then you can stop an attacker
with a lot of attacks.
So that's it for that.
We're gonna go ahead and move on to cover us now.
So I will see you over in the next video.