Reporting on Active Directory User Account Lockouts Event 644

Active Directory Security - Even with complex password and lockout policies in place, in theory a very slow brute force attack could compromise a privileged user password.  i.e. 5 attempts before lockout, lockout for 5 mins, means someone could attempt about 60 passwords an hour, 1440 in a 24-hour period.  If a user doesn't notices that they account is locked out and notified IT for an unlock, i.e. while away on vacation, someone with a few password hints might have enough time to slowly brute force their way in.

As such, it's a good idea to get reports of when a lockout occurs of User AD accounts.  Even if only so that an Administrator can see that the same account is repeatedly locked out, and thus potentially the target of a repeated password guess attack.

There are Active Directory Tools and Log Reporting Suites that can do great job of this task and a whole lot more, but for smaller shops this might be too expensive or complex to install and maintain.

A simple control, would a small Windows Power Shell script that reports via email, all Active Directory User Lockout Events in the last 24 hours.  If the same account is repeatedly locked out, you either have a very distressed user or a potential password compromise attack.

The following is designed for Windows Server 2003 Domains.

Windows Power Shell (2.0) Script: LOCKOUT-ALERT.PS1

# get start date

$start = get-date

# get 644 events from server ad1 for last 24 hours $msg_ad1 = get-eventlog -log security -computer ad1 | where-object {$_.EventID -match "^644" -AND $_.TimeGenerated -gt (get-date).AddHours(-24) } | Format-List | Out-String

$msg_ad2 = get-eventlog -log security -computer ad2 | where-object {$_.EventID -match "^644" -AND $_.TimeGenerated -gt (get-date).AddHours(-24) } | Format-List | Out-String

# ... repeat for each server in your domain ...

# get start date
$end = get-date

$msg = $msg_ad1 + $msg_ad2

if ($msg) { # if anything to report
  $msg = "Script run on hostname. " + $start.ToString() + $msg + $end.ToString()
  Send-MailMessage -To "itadmin@mydomain.com" -Subject "Lockout Alerts" -Body $msg -SmtpServer 10.10.10.10 -From "lockout@domain.com" 
}

Step to Install & Configure Event 644 Lockout Monitoring:

1. Ensure that your Security Event log on each server is set large enough to hold well over 24 hours of logging.
2. Install PowerShell (http://support.microsoft.com/kb/968929) if not already installed.
3. Start > Programs > Accessories > Windows Power Shell > Windows Power Shell
4. In order to run PowerShell scripts you need to execute the following command within PowerShell :> Set-ExecutionPolicy Unrestricted
5. Create a batch script to run the PowerShell script, one-line: c:\windows\system32\windowspowershell\v1.0\powershell.exe -NoLogo -NonInteractive c:\apps\ps\lockout-alert.ps1
6. Schedule the script to run once a day.

VPN using two-tier authentication: Radius & Active Directory (AD)

Using two-tiers of user authentication to permit VPN access to your corporate network is a best practice.  This ensures that even if a user's commonly used login (Active Directory) password is compromised, (can happen even with complex and aged passwords), that a different initial connection password is required to establish VPN connectivity.

I have used MS ISA Server along with FreeRadius.net to implement this design and best-practice security requirement.

However, one problem we had was the connecting PC when VPN'ed in, would get confused as to which set of credentials to use when accessing Windows Network resources, such as lettered drives.  As such, the user would be incorrectly denied access to normally available Windows Network resources.  The Windows Credential Manager needs to be informed NOT us use the RAS credentials for anything other that the RAS connection.

This can be set as follows: (Win7)

• Open the following file with notepad:  %userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk 
• Set: UseRasCredentials=0 instead of 1