20.500.12556/RUL-183574 Zmanjševanje tveganj napadov Kerberos in pršenja gesel v okolju Windows Active Directory Windows Active Directory security mitigating the risks of Kerberos and password spraying attacks V clanku opisujemo Windows Active Directory ter mo ˇ znosti za ˇ sˇcite pred napadi, ki ogro ˇ zajo ˇ uporabnike in integriteto podjetja, ki to storitev uporablja. Podrobno smo analizirali in reproducirali tri vrste napadov: enumeracijski napad, napad Kerberos in napad s prsenjem gesel. Vsi trije napadi so usmerjeni proti ˇ uporabnikom ter na razlicne na ˇ cine pridobivajo zgo ˇ sˇcene vrednosti gesel, ki jih napadalci s tehnikami grobe ˇ sile nato pretvarjajo v dejanska uporabniska gesla. Tako lahko s pove ˇ canjem privilegijev pridobijo nepoobla ˇ sˇcen ˇ dostop do omreznih virov in ogrozijo celotno infrastrukturo podjetja. V nadaljevanju predstavimo ustrezne ˇ preventivne ukrepe za zasˇcito stre ˇ znika in najbolj ˇ se prakse za obrambo pred opisanimi napadi, kot so pravilna ˇ konfiguracija Active Directory, okrepitev politike gesel in uvedba rednega spremljanja varnosti streznika. This article describes Windows Active Directory and the possibilities of protection against attacks that threaten users and the integrity of the company that uses this service. We have analyzed in detail and experimentally implemented three types of attacks: enumeration attack, Kerberos attack and password spraying attack. All three attacks are directed against users and in various ways obtain hashed values of passwords, which attackers then convert into actual user passwords using bruteforce techniques. With the obtained passwords, unauthorized individuals can gain access to network resources, increase privileges and compromise the entire company infrastructure. We also present appropriate preventive measures for server protection and best practices for defense against such attacks, such as correct configuration of Active Directory, strengthening password policy and introducing regular monitoring of server security. Windows Active Directory enumeracijski napad napad Kerberos napad s pršenjem gesel Windows Active Directory enumeration attack Kerberos attack password spraying attack true false false Slovenski jezik Angleški jezik Članek v reviji 2026-06-15 12:56:21 2026-06-15 12:56:22 2026-06-16 04:04:31 0000-00-00 00:00:00 2025 0 0 Str. 203-2111 št. 4 Letn. 92 2025 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 004.056 0013-5852 257363459 RAZ_Tajnsek_Aljaz_2025.pdf RAZ_Tajnsek_Aljaz_2025.pdf 1 F0DD989B5526B30F0E077F6DCB079DFF 1a04d0533296d00132630f24b8b7563ed7c73ab982e33cff456ac70f6ab3ac78 cb925a8c-68a8-11f1-9b0d-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=235653 https://ev.fe.uni-lj.si/4-2025/Tajnsek.pdf 0 092b45bc-68a9-11f1-9b0d-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=235654 Fakulteta za elektrotehniko 0 0 0