1 00:00:00,450 --> 00:00:06,450 So in this we will be waiting in C-sharp script to find the answer to this. 2 00:00:09,310 --> 00:00:14,650 We need to find the users with the option bond IDs that. 3 00:00:20,970 --> 00:00:27,370 If I were to test one user properties and go to a comp and scroll down and here you can see granted 4 00:00:28,210 --> 00:00:31,630 Kerberos probe indication this one is not cheap. 5 00:00:31,960 --> 00:00:35,830 So that means this user have the Kerberos indication and it will. 6 00:00:36,580 --> 00:00:44,580 And if you will do that, the user should go to Icon and here you can see Kerberos is not here. 7 00:00:44,890 --> 00:00:53,050 In this case the attacker can ask for the user's dignity and we not need to encrypt the timestamp and 8 00:00:53,230 --> 00:00:57,900 directly get the is replaced. 9 00:00:58,240 --> 00:01:01,570 So in that case of how the user has, she can try to correct them. 10 00:01:02,380 --> 00:01:07,930 So we'll be finding these information in this user script. 11 00:01:10,110 --> 00:01:17,640 If you go to properties and go to attribute editor and one attribute is user account control and here 12 00:01:17,640 --> 00:01:19,080 you can see if this is the number. 13 00:01:19,430 --> 00:01:27,150 Uh, there are different uh, uh, attributes here in normal account and here you can see normal contact 14 00:01:27,360 --> 00:01:29,700 and don't expect password. 15 00:01:30,000 --> 00:01:34,080 And if you expand this one here, you can see it won't require ID. 16 00:01:34,650 --> 00:01:38,460 So this integer we to understand this one. 17 00:01:39,510 --> 00:01:46,170 So let's go back and search for your numbers and go to this website. 18 00:01:48,540 --> 00:01:52,440 And here, uh, this is the list of all the values. 19 00:01:52,770 --> 00:01:55,380 So whenever there is an icon, by default, it is. 20 00:01:55,980 --> 00:02:00,210 Well, I guess, uh, flight values for normal account. 21 00:02:00,540 --> 00:02:04,230 And then if you add these properties, the value will increase. 22 00:02:05,910 --> 00:02:08,340 Um, so you can see normal quantities. 23 00:02:08,340 --> 00:02:08,880 Very well. 24 00:02:09,990 --> 00:02:17,670 And if the account has the right, it would be index of password and you add fighter plus 76. 25 00:02:18,150 --> 00:02:26,810 And in our case we also have this, uh, one ID you said that is this part for 19 that's out of 41 X. 26 00:02:27,300 --> 00:02:36,660 So here, if any account with this option and it would be the user account at control, they will be 27 00:02:36,660 --> 00:02:37,590 higher than this one. 28 00:02:37,920 --> 00:02:40,350 So then you might want to check this. 29 00:02:40,590 --> 00:02:41,820 So you can copy this one. 30 00:02:46,690 --> 00:02:52,240 So let's push the value here and now that are going to create a new function. 31 00:03:01,040 --> 00:03:02,900 Let's get sort of brushed about. 32 00:03:03,860 --> 00:03:11,450 We're not going to pass any compelling arguments, certainly not functional arguments. 33 00:03:12,800 --> 00:03:18,350 So what we're going to win is first, we'll be fighting the forest fighting arguments. 34 00:03:21,980 --> 00:03:25,820 Before, but we need to right click on this, add some references. 35 00:03:27,410 --> 00:03:28,040 Uh. 36 00:03:28,340 --> 00:03:35,690 Scroll down and you see Standard Directory services and services, that account management and that 37 00:03:35,690 --> 00:03:36,860 deserves a lot of us. 38 00:03:37,190 --> 00:03:45,280 So check these, uh, namespaces and click on object and you need to put them here. 39 00:03:45,290 --> 00:03:55,340 I ordered imported and the first one we need to get is the forest forests dot and get current forest. 40 00:03:56,120 --> 00:04:01,940 So if you use the get forest, you need to pass the directory context, you need to create another temperature. 41 00:04:02,270 --> 00:04:06,890 So this current forest will need to get the current forest. 42 00:04:07,400 --> 00:04:10,490 The user is running this script. 43 00:04:12,540 --> 00:04:15,660 So get current forest. 44 00:04:18,020 --> 00:04:18,620 So I don't know. 45 00:04:19,250 --> 00:04:22,490 Let's hold on to this and you can see the return by this first subject. 46 00:04:22,910 --> 00:04:24,950 Let's go and create this first object. 47 00:04:25,430 --> 00:04:31,070 And we have the first subject, and it's in these documents. 48 00:04:31,160 --> 00:04:34,090 So this gives the other domains. 49 00:04:35,960 --> 00:04:36,920 Hold onto this. 50 00:04:36,920 --> 00:04:38,030 And then this. 51 00:04:38,030 --> 00:04:39,020 Domain collection. 52 00:04:40,550 --> 00:04:41,810 Domain collection. 53 00:04:42,950 --> 00:04:45,500 That's the basis. 54 00:04:48,600 --> 00:04:50,940 We can just say the word correction demeans. 55 00:04:53,370 --> 00:05:04,800 And when you do a trade or business, each bounce for it, we can use for it for each domain be in domains. 56 00:05:05,490 --> 00:05:13,590 So for each and every domain object in this domains collection, we are going to simply I think did 57 00:05:13,590 --> 00:05:14,130 not name. 58 00:05:16,320 --> 00:05:22,500 So we are just first printing now let's build this or we are not coding the function. 59 00:05:22,830 --> 00:05:29,550 Let's create an object which is this class one sees equals to new class one. 60 00:05:30,390 --> 00:05:40,410 Now we can see that that is sort of profitable and we can also try out if there is any exception, we 61 00:05:40,410 --> 00:05:43,980 can just simply ignore that. 62 00:05:45,120 --> 00:05:46,230 Now let's build this. 63 00:05:52,700 --> 00:05:53,900 So with this one. 64 00:06:02,610 --> 00:06:03,390 So let's run this. 65 00:06:03,390 --> 00:06:05,400 And you can see there is only one domain. 66 00:06:05,400 --> 00:06:06,000 The district's. 67 00:06:21,010 --> 00:06:27,380 And what we're going to do is we are going to convert this dealer name, industry string domain name, 68 00:06:27,430 --> 00:06:30,880 musical instrument dealer name to screen. 69 00:06:31,030 --> 00:06:33,010 So these are touchscreen function. 70 00:06:34,330 --> 00:06:37,930 Yes, we are making sure that it is a string format. 71 00:06:40,990 --> 00:06:44,570 So the domain name will be Tex 69. 72 00:06:46,870 --> 00:06:47,860 And we need to 73 00:06:51,880 --> 00:06:53,410 add the directory entry. 74 00:06:55,060 --> 00:06:59,470 So the entry is like a binding being set in object. 75 00:07:00,100 --> 00:07:04,520 The easy question, letter three in paragraph. 76 00:07:04,800 --> 00:07:10,930 Now here we want to add a up and here we need to say this is equal. 77 00:07:10,930 --> 00:07:17,740 Should partitioning come out, this is equal to local and we need to build this dynamically. 78 00:07:17,760 --> 00:07:21,410 So that means we need to split the string. 79 00:07:21,430 --> 00:07:22,840 According to this, a dot. 80 00:07:23,050 --> 00:07:29,380 So if you spread the string with the dot, you get the P values and local and we can add them here. 81 00:07:31,030 --> 00:07:37,930 And there will be some general domains then something about partitioned and Oracle. 82 00:07:38,110 --> 00:07:41,650 And in that case, you need to dynamically create this spring. 83 00:07:42,130 --> 00:07:47,290 So first, what we need is a domain name dot split. 84 00:07:47,560 --> 00:07:48,910 So there is a split function. 85 00:07:53,650 --> 00:07:55,090 Well, on what basis? 86 00:07:55,090 --> 00:08:05,790 We are splitting on business of that and the return type is string area and we can do a string and basis 87 00:08:05,900 --> 00:08:09,610 is equal to this. 88 00:08:10,030 --> 00:08:16,000 So no bases of gyro contains positioning and bases of one contents. 89 00:08:17,110 --> 00:08:19,000 Now we are going to generate dusting. 90 00:08:19,000 --> 00:08:23,290 That is something like this. 91 00:08:23,290 --> 00:08:26,580 Physical should tax nine is a cluster. 92 00:08:28,900 --> 00:08:35,470 So let's go in gender that five in by is equal to zero. 93 00:08:37,150 --> 00:08:40,350 I was then busy dot line. 94 00:08:41,470 --> 00:08:42,670 I press press 95 00:08:45,550 --> 00:08:53,320 and we are going to there is already position in this area element we need to just prepare and this 96 00:08:53,660 --> 00:09:03,960 this equals two so we can see this offer is equal to these bases equals to plus this yourself. 97 00:09:05,590 --> 00:09:11,140 So this is something already contains sectioning and we are just preventing this easy question and we 98 00:09:11,140 --> 00:09:17,260 are assigning that same assigning the whole value doesn't seem relevant. 99 00:09:17,830 --> 00:09:20,260 Now if you print to discuss. 100 00:09:22,800 --> 00:09:24,120 To print books. 101 00:09:24,480 --> 00:09:25,890 We can just print here. 102 00:09:26,580 --> 00:09:28,500 This is our fight. 103 00:09:32,330 --> 00:09:33,410 It's better. 104 00:09:33,440 --> 00:09:33,950 This one. 105 00:09:37,720 --> 00:09:43,360 And if you're on this and here you can see we got the postings basically because the Texas state and 106 00:09:43,360 --> 00:09:45,700 local so should be good to go. 107 00:09:48,370 --> 00:09:57,430 And now we are going to add here and have far too much to specify at zero and. 108 00:10:00,340 --> 00:10:03,240 We need to format the string format. 109 00:10:03,490 --> 00:10:07,870 Otherwise it will be taken as your pool of parameters. 110 00:10:10,600 --> 00:10:11,640 Like being past. 111 00:10:14,390 --> 00:10:14,780 Okay. 112 00:10:16,220 --> 00:10:18,170 Now we need to concatenate all this. 113 00:10:18,320 --> 00:10:20,900 So there is a function string that join. 114 00:10:24,410 --> 00:10:25,420 So what is this doing? 115 00:10:25,430 --> 00:10:29,420 Function as the separator and the string at it. 116 00:10:30,110 --> 00:10:35,720 So separator is comma and the string arrays business. 117 00:10:37,070 --> 00:10:44,320 So what happens is we have business equals to text nine and also we have a disease control logger. 118 00:10:44,630 --> 00:10:47,420 So these are two elements of this disease. 119 00:10:48,170 --> 00:10:56,460 So this design will join these elements and put this common separator in between them. 120 00:10:57,620 --> 00:11:01,940 If you have another third element, it will join it. 121 00:11:01,940 --> 00:11:06,150 We put another command disease to net. 122 00:11:07,310 --> 00:11:11,570 So we can create the dynamic string like this. 123 00:11:12,950 --> 00:11:16,820 And we have created this object to bind double. 124 00:11:17,120 --> 00:11:19,820 We need to search through this object. 125 00:11:21,620 --> 00:11:25,400 So there is a class called directory setter. 126 00:11:28,990 --> 00:11:32,710 The FCC construed you better to be so sure. 127 00:11:33,010 --> 00:11:37,240 And we need to pass some. 128 00:11:38,500 --> 00:11:41,840 We need to modify the members of this would be subject be. 129 00:11:44,260 --> 00:11:46,000 And here you can see the filter. 130 00:11:46,150 --> 00:11:48,310 So this is the ED filter we are going to use. 131 00:11:48,520 --> 00:11:52,030 And also we are going to add this to searchable by. 132 00:11:52,030 --> 00:11:52,390 Yes. 133 00:11:53,230 --> 00:11:55,090 Because this should be treated as a rule. 134 00:11:57,340 --> 00:11:58,270 So you can also 135 00:12:02,110 --> 00:12:05,830 check out our methods as our biggest statistical study. 136 00:12:06,160 --> 00:12:09,700 So from this object, we are going to update this filter. 137 00:12:10,870 --> 00:12:16,180 So it's a normal added after the filter is. 138 00:12:26,160 --> 00:12:26,920 Object. 139 00:12:27,150 --> 00:12:29,130 The class is second to user. 140 00:12:29,490 --> 00:12:31,610 And also we don't want computers. 141 00:12:31,620 --> 00:12:36,180 So you can say not object class is equal to computer. 142 00:12:36,990 --> 00:12:38,640 You can remove this as well. 143 00:12:41,340 --> 00:12:47,700 And now what are going to do is user account control greater than or equal to this value? 144 00:12:52,920 --> 00:12:54,090 Is equal, school is. 145 00:12:54,480 --> 00:13:01,050 Otherwise you get an error that is no greater than the ended up for senators. 146 00:13:01,050 --> 00:13:02,310 Only greater than equal to. 147 00:13:05,170 --> 00:13:07,030 And we are going to be. 148 00:13:07,060 --> 00:13:17,830 Yes, but find out find our dog with this valid query and this return search result collection you can 149 00:13:18,030 --> 00:13:21,580 are you giving you can see average. 150 00:13:23,350 --> 00:13:26,890 Such result as sarin being staff? 151 00:13:27,010 --> 00:13:27,360 No. 152 00:13:28,240 --> 00:13:34,030 So you are getting all of these objects into this search result. 153 00:13:37,150 --> 00:13:39,490 We can say yes are their properties. 154 00:13:41,140 --> 00:13:49,660 So the property and the properties, its like a dictionary of properties of where you can display the 155 00:13:49,660 --> 00:13:50,350 properties. 156 00:13:50,860 --> 00:13:55,150 So again, the name of Google. 157 00:13:55,930 --> 00:13:59,290 So if you print all of these properties, you're going to get that dictionary. 158 00:14:00,310 --> 00:14:07,990 The first one is the type, and this one is the properties of this value. 159 00:14:10,060 --> 00:14:15,970 In a similar way, you sense are properties of the user. 160 00:14:20,280 --> 00:14:20,910 I concur. 161 00:14:29,430 --> 00:14:34,170 So you can also bring to the members of this reserve property collection. 162 00:15:14,630 --> 00:15:15,440 What I can see. 163 00:15:15,440 --> 00:15:22,670 You can convert this into the dictionary entry and you can try to enumerate this key value page. 164 00:15:23,030 --> 00:15:25,010 So this is how it looks like. 165 00:15:28,270 --> 00:15:32,140 So you can hear you can see the sound code name of general. 166 00:15:33,880 --> 00:15:35,590 So it's going to print that username. 167 00:15:41,530 --> 00:15:44,620 So these are the object properties you can. 168 00:15:48,130 --> 00:15:51,310 You can print them as you wish. 169 00:15:53,470 --> 00:15:57,100 So they're just printing the same acronym and you can control for now. 170 00:15:57,490 --> 00:15:58,600 So that's where this one. 171 00:16:06,010 --> 00:16:14,410 Now if you on this and we got the user desktop and the user account where you have this one integer 172 00:16:14,500 --> 00:16:19,990 so you can use that PowerShell script that you can, uh, convert on line. 173 00:16:21,010 --> 00:16:23,110 So then you might find out about this. 174 00:16:23,110 --> 00:16:29,740 We need to know which, uh, in which the line this user is off because we are searching in our domains. 175 00:16:30,040 --> 00:16:31,300 So again, the user. 176 00:16:34,910 --> 00:16:39,350 Against a general format space where user. 177 00:16:41,280 --> 00:16:43,950 From their domain one. 178 00:16:45,480 --> 00:16:52,530 And come on, the first value goes into this zero and the second, why do you specify now goes to the 179 00:16:52,590 --> 00:16:55,860 one place we get to comma. 180 00:16:56,130 --> 00:17:08,970 We have our added domain name and we can also modify this output and user user account control. 181 00:17:22,300 --> 00:17:29,020 And if you run this and we can get much more user testing from this, this domain technician and the 182 00:17:29,020 --> 00:17:31,720 driver and this user are control. 183 00:17:34,110 --> 00:17:38,210 So that's how you use that luxury. 184 00:17:38,250 --> 00:17:40,260 So it's a very simple script. 185 00:17:40,260 --> 00:17:47,970 You can modify this filter and again, search for any other objects as well based on this filter.