1

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are stored locally but I usually like to mount the dd image as a virtual machine using LiveView an access the users impersonating them. The problem is that I cannot log as the domain controller account because the user is not in the local SAM and I have not got the password.

Can I access the operative system login in as the active directory user?

Can I conver the domain controller account to a local account in order to access the operative system impersonating the user locally?

  • Well, you can pave over the cached credential with a well known value if there is one, and that should let you sign in, but that might be hit or miss if domain policy doesn't support cached creds. – Steve May 5 '15 at 16:42
  • Although you are doing forensic analysis, this really is a Windows OS question (converting accounts and gaining access to files). – schroeder May 5 '15 at 16:49
  • @schroeder A lot of forensic questions depend on the operating system: inspecting or parsing the filesystem, registers, etc. Why is this question different and it is not related to forensics in your opinion? – kinunt May 5 '15 at 17:18
  • The core question is about OS functionality - you are going to use that information for forensic purposes, but it is an OS question. What I'm saying is that there may be better people to answer in the OS-specific SE forum. Just as "technical support" questions are off-topic, questions about technology (OS) specifics are better asked in the other forums as they are specialized for that purpose. – schroeder May 5 '15 at 18:32
  • i would suggest using John the ripper to crack the password, sniffing the authentication protocol, and then attempt to access storage via logging in with cracked password. – Peter Teoh Jun 3 '15 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.