Hack The Box: Introduction to Active Directory

A Fundamentals course from Hack the Box Academy

Recently new fundamental modules were released on the Academy site, with this one offering foundational knowledge in Active Directory. One of my goals over the next 6 months was to improve my knowledge of AD administration, and become better at auditing security in such environments. This seems like a good opportunity to review the new free module and start improving.

Summary of the Module

As a fundamental level course at “Hack the Box Academy” the module is basically free. It provides coverage of a long list of topics related to general set up of an Active Directory environment. A general overview of structure, domains, forests, groups, users, and background on how everything fits together is provided.

For anyone not familiar with the structure of the site each module is broken down into sections and each section will provide information on a specific topic, and then have interactive questions that you can answer as a knowledge review.

In the case of this module, you have two sections that are devoted to a hands on guided lab. The student gets to do basic administrative tasks related to creating users, groups, and GPOs. There are instructions on how to complete tasks if you don’t know what you are doing, but ideally we will do a bit of research and try to figure it out.

A Look at Some of the Lab Examples

Creating New Users

The first task we were asked to do in our guided lab was to simply create some new users. We were given names for the users provided the OU where the users would go and provided the format for the user Email address.

1. To get started we are going to start this with the gui. We can just open the tools option on the Server Manager Dashboard and select the Active Directory Users and Computers tool.

2. Once we have this tool open we will be able to browse to the OU we need on the left hand side. Once we are in the correct location we can right click and select new and user to open up the user creation window.

3. In the user creation window we can provide the users name, set their password, and ensure that they have to reset their password when they log on the first time.

Moving users from one OU to Another

We ended up creating 3 users in the Analysts (organizational unit) and then make sure they were assigned to the Analysts security group. We decided to do this with PowerShell.

1. The first thing here was to create a variable that would hold the OU path of the users I wanted to assign. We can then combine two commands with a pipe to place the users into a group.

2. Here we use the Get-ADUser cmdlet, and filter based on our previously assigned variable. Then, because it allows piped input use Add-ADPrincipalGroupMembership to add the users to the specific group.

3. Just for good measure we can also show in the properties of the group that our commands did work. All 3 users that were in the OU from our variable were moved to the group.

Overall Impression

The lab isn’t overly difficult to complete with simple user creation and moves between groups, but for people who may not have a background in basic Windows administrative tasks it is a good primer. With the other tasks that included copying and modifying a GPO adding a device to a domain and removing old users it is actually a good course that would benefit most help desk technicians I have worked around in the past.

On top of that the use of the lab machine provide you with ample time to see how you can do things in multiple ways. You can look at adding the users with PowerShell, and see how many options there are, or how you will assign the required properties. After you figure everything out, or go through the tasks you can take a look at how they solved the tasks. Maybe you learn an alternative method.

As an example, I had added users by creating a secure string in one PowerShell variable, and then passed that variable to my new user with the -AccountPassword argument. They had used parenthesis to gather user input from the terminal and pass it to the new user.

If you don’t have a strong AD background and want a good primer on how it works and a free machine to practice a few basic examples on I think this is a good opportunity.