FAM - DFS - Domain Controller Issue

[matthewfry]

Okay we have DFS set up in our domain, and many of the DFS pointers are linked to shares that live on our Domain Controllers (not best practice, I know, but it is what it is). So because the FAM DFS application cannot do anything except Crawling, I have built Windows File Server connectors for our Domain Controllers, and am running crawls/perms coll’s/dc’s with those. However, something odd that we are noticing is this: After doing this, we are getting user names showing up in our forensics lookups that are showing the domain controller names as the NETBIOS domain name for the users… for example:

So say our domain NETBIOS name is XXX, hence my username is XXX\matthew.fry. However, we are seeing other names now that are duplicates of our domain names, but with the individual NETBIOS names of the domain controllers, such as DC01\matthew.fry.  See the attached screenshot.

Maybe I’m not understanding something about DFS or Domain Controllers here, but this just seems very odd. Also, Domain Controllers by default do NOT have local accounts, so this is very odd behavior.

Any ideas?

@yitshak_merin

[ranjith_koppu]

@matthewfry ,

I haven’t tried this anytime. This is a bit odd use case I should say to on-board Domain controllers as windows servers.

Was there a reason you wanted to scan Domain controllers ? Are there any shares or some kind of data on these domain controllers that you expect users/groups to have access to ?

As you already know, FAM only supports domain based DFS. FAM crawls the DFS namespace and records all the DFS links and correlates them to the actual links.

When there is an activity performed via the actual or the DFS link, the activity forensics page would show you the exact path taken by the user to perform the action.

If the user accessed a resource via one of the server links, the forensics screen would show you that path and also the relevant DFS path in the activity details.

Regards,

Ranjith