Cachedump in Auditing - Book Report/Review Example

Cached allow the user to authenticate the offline domain members, and also help when some server has taken control of the domain without getting noticed by the user.

It resolves issues in machines with networking problems. Cached credentials are used for several things like the authentication of offline members. The cached domain admin credentials may be dangerous because they are all over the Windows and hard to be tracked. A lot of security issues impart the need to protect them as much as possible. The cached credentials are protected from attackers by default. Nobody but the system user has read/write access to the security hive that is right when the user is booted inside the operating system.

There are certain scenarios that lead to the caching of domain admin credentials. Many of the cached credentials are common administrative tasks, like domain admin logs into it, and the domain member fixes the software and permissions issue. It invokes the WINLOGON process even when the user is not properly logging into the system all over the network and uses the Runas functionality in Windows 2000 and above. As a result of this, a stored cached value is created on the system. Different versions of cached credentials can be obtained and downloaded online or the source patch can be purchased and cracked.

Protection of the cached credentials is of extreme importance. To protect and stop the domain admin cached credentials, booting from all media should be disabled, and passwords on all systems should be established. It is very important to ensure that no user has local administrative privileges on the computers as it is one of the best practices of Microsoft. To use the cachedump to audit cached credentials on a domain member, a slow VB script can be created that executes a group policy setting that starts up and shuts down all domain members, cleans out the username values, and then looks into the active directory and enumerates the group membership, and accordingly prepares the list to decide whether the credential has to be removed or not depending upon the group membership. There are certain issues with the proposed solution. For example, cachedump must be accessible via network share on the local system. It must be run under the context of the system user. This solution is reactive and cannot solve the root cause of the cache credential creation and storage. The perfect world solution is to update the group policy and the WINLOGON process functionality in different ways. Cachedump did not work with the 1.1 version of Windows Vista because 1.2 was the latest.