Detections
Analytics

Domain with Unsafe Backward-Compatibility Configuration

low

Language:

Description

It is possible to customize Active Directory behavior by adjusting fundamental attributes, but some of these modifications can potentially compromise security.

Solution

Remediate the security-sensitive fields of an Active Directory attribute dSHeuristics.

See Also

dSHeuristics attribute reference

Disabling the fLDAPBlockAnonOps field

Changing the value of dwAdminSDExMask

Enabling the fAllowPasswordOperationsOverNonSecureConnection field (AD LDS only)

Indicator Details

Name: Domain with Unsafe Backward-Compatibility Configuration

Codename: C-DSHEURISTICS

Severity: Low

MITRE ATT&CK Information:

Tactics: TA0004, TA0043

Techniques: T1078