{"id":982,"date":"2022-08-30T11:48:46","date_gmt":"2022-08-30T08:48:46","guid":{"rendered":"https:\/\/www.erenali.com\/?p=982"},"modified":"2022-08-30T11:50:25","modified_gmt":"2022-08-30T08:50:25","slug":"gpo-ile-domainde-guvenlik-onlemleri","status":"publish","type":"post","link":"https:\/\/www.erenali.com\/index.php\/2022\/08\/30\/gpo-ile-domainde-guvenlik-onlemleri\/","title":{"rendered":"GPO ile Windows G\u00fcvenlik \u00d6nlemleri"},"content":{"rendered":"<div class=\"38128c0007b0f41e35c6013bb0abf0bf\" data-index=\"1\" style=\"float: left; margin: 10px 10px 10px 0;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-3908223554810378\"\r\n     data-ad-slot=\"5522206140\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\n<\/div>\n\n<p><\/p>\n\n\n\n<p>Active Directory yap\u0131s\u0131 mevcut olan ortamlarda al\u0131nmas\u0131 gereken bir \u00e7ok \u00f6nlem mevcuttur. Kurumun yap\u0131s\u0131na ve tutumuna g\u00f6re bu \u00f6nlemler tabiki de\u011fi\u015fiklik g\u00f6sterecektir. Bu yaz\u0131da herkesin ihtiyac\u0131 olaca\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fcm bir ka\u00e7 g\u00fcvenlik \u00f6nleminin GPO ile nas\u0131l yap\u0131land\u0131r\u0131laca\u011f\u0131ndan bahsedece\u011fim.<\/p><div class=\"38128c0007b0f41e35c6013bb0abf0bf\" data-index=\"1\" style=\"float: left; margin: 10px 10px 10px 0;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-3908223554810378\"\r\n     data-ad-slot=\"5522206140\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\n<\/div>\n\n\n\n\n<h2>Hash bilgisinin tutulmamas\u0131<\/h2>\n\n\n\n<p>Windows&#8217;un&nbsp;<strong>SAM<\/strong>(Security Accounts Manager) veritaban\u0131nda tuttu\u011fu hesaplar\u0131n&nbsp;<strong>hash&nbsp;<\/strong>bilgisi zaafiyet olu\u015fturan ve \u00e7ok kolay bir \u015fekilde istismar edilebilen bir ortam sunmakta bu y\u00fczden makinelerin hash bilgilerini tutmamas\u0131 i\u00e7in GPO ile bir \u00f6nlem al\u0131nabilir.<\/p>\n\n\n\n<p>DC makinesinde&nbsp;<strong>Group Policy Management Editor<\/strong>&nbsp;a\u00e7\u0131yoruz;<\/p>\n\n\n\n<p><strong>Computer Configuration ==&gt; Windows Settings ==&gt; Security Settings ==&gt; Local Policies ==&gt; Security Options<\/strong><\/p>\n\n\n\n<p>Men\u00fcs\u00fc alt\u0131nda \u201c<strong>Network security: Do not store LAN Manager hash value on next password change<\/strong>\u201d kural\u0131na \u00e7ift t\u0131klayarak d\u00fczenliyoruz ve&nbsp;<\/p>\n\n\n\n<p>\u201c<strong>Define this policy setting<\/strong>\u201d se\u00e7ene\u011fini ve \u201c<strong>Enabled&#8221;&nbsp;<\/strong>k\u0131sm\u0131n\u0131 se\u00e7ili hale getiriyoruz.<\/p>\n\n\n\n<p>Bu ayarlar\u0131 \u201c<strong>Apply<\/strong>\u201d ve \u201c<strong>OK\u201d\u00a0<\/strong>diyerek uyguluyoruz.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz2.png\"><img loading=\"lazy\" width=\"851\" height=\"874\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz2.png\" alt=\"\" class=\"wp-image-985\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz2.png 851w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz2-292x300.png 292w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz2-768x789.png 768w\" sizes=\"(max-width: 851px) 100vw, 851px\" \/><\/a><figcaption>hash bilgisinin tutulmamas\u0131 i\u00e7in gpo ayar\u0131<\/figcaption><\/figure>\n\n\n\n<p>Bu ayarlama bilgisayarlar policyi ald\u0131k\u00e7a bilgisayarlara uygulanacakt\u0131r.<\/p>\n\n\n\n<h2>CMD ye eri\u015fimin engellenmesi<\/h2>\n\n\n\n<p>Son kullan\u0131c\u0131lar\u0131n komut sat\u0131r\u0131na eri\u015fmeleri sorun te\u015fkil edebilecek bir durum oldu\u011fu i\u00e7in reg\u00fclasyonlarda bu durumun kapat\u0131lmas\u0131 \u00f6nerilmektedir. Bunun i\u00e7in a\u015fa\u011f\u0131daki gibi bir GPO haz\u0131rlanarak kullan\u0131c\u0131lar\u0131n bu eri\u015fimi k\u0131s\u0131tlanabilir. Bunun i\u00e7in&nbsp;<strong>Group policy management editor<\/strong>&nbsp;aray\u00fcz\u00fcnde&nbsp;<\/p>\n\n\n\n<p><strong>User Congifuration ==> Policies ==> Administrative Templates ==> System<\/strong>\u00a0Sekmesine geliyoruz ve burada yer alan \u201c<strong>Prevent access to command prompt<\/strong>\u201d kural\u0131n\u0131 enable yap\u0131yoruz.\u00a0<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>Policy&#8217;nin uyguland\u0131\u011f\u0131 ou i\u00e7ersinde giri\u015f yapan kullan\u0131c\u0131n\u0131n olmas\u0131 gerekti\u011fini unutmamak gerekir.<\/p><\/blockquote>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz.png\"><img loading=\"lazy\" width=\"785\" height=\"874\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz.png\" alt=\"\" class=\"wp-image-986\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz.png 785w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz-269x300.png 269w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz-768x855.png 768w\" sizes=\"(max-width: 785px) 100vw, 785px\" \/><\/a><figcaption>komut sat\u0131r\u0131na eri\u015fimi engellemek i\u00e7in gpo ayar\u0131<\/figcaption><\/figure>\n\n\n\n<p>Bu uygulanan kural t\u00fcm kullan\u0131c\u0131lar\u0131 kapsayaca\u011f\u0131 i\u00e7in bilgi i\u015flem kullan\u0131c\u0131lar\u0131n\u0131 hari\u00e7 tutmak istiyoruz. Bunun i\u00e7in\u00a0<strong>CmdEngelle\u00a0<\/strong>illkesine geliyoruz ve\u00a0<strong>Delegation\u00a0<\/strong>sekmesini a\u00e7\u0131yoruz. Burada\u00a0<strong>Advanced\u00a0<\/strong>butonu ile yeni pencere a\u00e7\u0131yoruz. A\u00e7\u0131lan pencerede hari\u00e7 tutmak istedi\u011fimiz kullan\u0131c\u0131 ya da grubu\u00a0<strong>Add\u00a0<\/strong>butonu ile ekliyoruz ve ilgili kay\u0131t se\u00e7iliyken a\u015fa\u011f\u0131daki yetki matrisinden \u201c<strong>Apply group policy<\/strong>\u201d se\u00e7ene\u011finde\u00a0<strong>Deny\u00a0<\/strong>kutucu\u011funu i\u015faretliyoruz. Bu sayfay\u0131 Apply ve Ok diyerek kapat\u0131yoruz.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz3.png\"><img loading=\"lazy\" width=\"583\" height=\"671\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz3.png\" alt=\"\" class=\"wp-image-987\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz3.png 583w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz3-261x300.png 261w\" sizes=\"(max-width: 583px) 100vw, 583px\" \/><\/a><figcaption>gpo da kullac\u0131 hari\u00e7 tutma<\/figcaption><\/figure>\n\n\n\n<p>Yap\u0131lan bu ayarlamalar\u0131n istenilen cihazda g\u00fcncellemesini sa\u011flad\u0131ktan sonra a\u015fa\u011f\u0131daki kontrol y\u00f6ntemleri ile policynin g\u00fcncelli\u011fini kontrol edebiliriz.\u00a0<\/p>\n\n\n\n<h2>Misafir hesaplar\u0131n kapat\u0131lmas\u0131<\/h2>\n\n\n\n<p>Bilgisayarlarda misafir hesaplar\u0131n engellenmesi i\u00e7in olu\u015fturdu\u011fumuz GPO g\u00f6r\u00fcnt\u00fcs\u00fc a\u015fa\u011f\u0131daki gibidir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-2.png\"><img loading=\"lazy\" width=\"865\" height=\"563\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-2.png\" alt=\"\" class=\"wp-image-988\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-2.png 865w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-2-300x195.png 300w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-2-768x500.png 768w\" sizes=\"(max-width: 865px) 100vw, 865px\" \/><\/a><figcaption>guest hesaplar\u0131n\u0131n kapat\u0131lmas\u0131<\/figcaption><\/figure>\n\n\n\n<p><strong>Group policy management editor<\/strong>&nbsp;aray\u00fcz\u00fcnde&nbsp;<strong>Computer Configuration ==&gt; Policies ==&gt; Windows Settings ==&gt; Security Settings ==&gt; Local Policies ==&gt; Security Options<\/strong><\/p>\n\n\n\n<p>men\u00fcs\u00fc i\u00e7erisinde\u00a0<strong>&#8220;Accounts: Guest account status&#8221;<\/strong>\u00a0kural\u0131n\u0131n disable yap\u0131lmas\u0131 gerekmekte.<\/p>\n\n\n\n<h2>GPO lar\u0131n uygulanmas\u0131 ve kontrol edilmesi\u00a0<\/h2>\n\n\n\n<p>Olu\u015fturulan kurallar bilgisayarlara da\u011f\u0131t\u0131l\u0131rken bilgisayar\u0131n a\u00e7\u0131k olmas\u0131, oturumun kapanmamas\u0131 vs gibi sebeplerle 1-2 saat gibi s\u00fcrelerde uygulanabilir. Bu s\u00fcrenin k\u0131salt\u0131mlas\u0131n\u0131\u00a0<strong>gpupdate \/force<\/strong>\u00a0komutu ile sa\u011flayabiliriz.  Bu sayede bilgisayar\u0131n mevcut policiyleri bir an \u00f6nce almas\u0131n\u0131 zorlayabiliriz.\u00a0<\/p>\n\n\n\n<p>Bilgisayar\u0131n gpo lar\u0131 almas\u0131 sa\u011fland\u0131ktan sonra client taraf\u0131nda kontrolleri yapabilmemiz i\u00e7in\u00a0ba\u015flata\u00a0<strong>rsop.msc<\/strong>\u00a0yazarak bilgisayara ve kullan\u0131c\u0131ya uygulanan policyleri g\u00f6r\u00fcnt\u00fcleyebiliriz. Kullan\u0131c\u0131 admin yetkisi olmad\u0131\u011f\u0131 zaman sadece o kullan\u0131c\u0131 i\u00e7in ge\u00e7erli kurallar g\u00f6r\u00fcnt\u00fclenecektir.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3.png\"><img loading=\"lazy\" width=\"619\" height=\"1024\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3-619x1024.png\" alt=\"\" class=\"wp-image-989\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3-619x1024.png 619w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3-181x300.png 181w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3-768x1270.png 768w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/image-3.png 813w\" sizes=\"(max-width: 619px) 100vw, 619px\" \/><\/a><figcaption>rsop.msc ile mevcut gpo lar\u0131 g\u00f6r\u00fcnt\u00fcleme<\/figcaption><\/figure>\n\n\n\n<p>Ayr\u0131ca \u00a0<strong>gpresult \/Scope User \/v<\/strong>\u00a0\u00a0komutu ya da\u00a0<strong>gpresult \/Scope Computer \/v<\/strong>\u00a0komutlar\u0131 ile de uygulanan kurallar\u0131 komut sat\u0131r\u0131 \u00fczerinden g\u00f6r\u00fcnt\u00fcleyebiliriz.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz4.png\"><img loading=\"lazy\" width=\"944\" height=\"746\" src=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz4.png\" alt=\"\" class=\"wp-image-990\" srcset=\"https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz4.png 944w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz4-300x237.png 300w, https:\/\/www.erenali.com\/wp-content\/uploads\/2022\/08\/Adsiz4-768x607.png 768w\" sizes=\"(max-width: 944px) 100vw, 944px\" \/><\/a><figcaption>komut sat\u0131r\u0131ndan mevcut gpo lar\u0131 g\u00f6r\u00fcnt\u00fcleme<\/figcaption><\/figure>\n\n\n\n<p><strong>gpresult \/H C:\\Users\\ali.eren\\Desktop\\gporesult.html<\/strong>\u00a0komutu ile bilgisayar\u0131n ve kullan\u0131c\u0131n\u0131n etkilendi\u011fi gpo lar\u0131 html dosyas\u0131 olarak \u00e7\u0131kartabiliriz.<\/p>\n\n\n\n<p><strong>kaynaklar<\/strong>:\u00a0<\/p>\n\n\n\n<p><a href=\"https:\/\/www.lepide.com\/blog\/top-10-most-important-group-policy-settings-for-preventing-security-breaches\/\">https:\/\/www.lepide.com\/blog\/top-10-most-important-group-policy-settings-for-preventing-security-breaches\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.howtogeek.com\/116184\/how-to-see-which-group-policies-are-applied-to-your-pc-and-user-account\/#:~:text=To%20open%20the%20tool%2C%20hit,for%20applied%20Group%20Policy%20settings.\">https:\/\/www.howtogeek.com\/116184\/how-to-see-which-group-policies-are-applied-to-your-pc-and-user-account\/#:~:text=To%20open%20the%20tool%2C%20hit,for%20applied%20Group%20Policy%20settings.<\/a><\/p>\n<div class=\"38128c0007b0f41e35c6013bb0abf0bf\" data-index=\"2\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-3908223554810378\"\r\n     data-ad-slot=\"5522206140\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\n<\/div>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Active Directory yap\u0131s\u0131 mevcut olan ortamlarda al\u0131nmas\u0131 gereken bir \u00e7ok \u00f6nlem mevcuttur. Kurumun yap\u0131s\u0131na ve tutumuna g\u00f6re bu \u00f6nlemler tabiki de\u011fi\u015fiklik g\u00f6sterecektir. Bu yaz\u0131da herkesin ihtiyac\u0131 olaca\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fcm bir ka\u00e7 g\u00fcvenlik \u00f6nleminin GPO ile nas\u0131l yap\u0131land\u0131r\u0131laca\u011f\u0131ndan bahsedece\u011fim. Hash bilgisinin tutulmamas\u0131 Windows&#8217;un&nbsp;SAM(Security Accounts Manager) veritaban\u0131nda tuttu\u011fu hesaplar\u0131n&nbsp;hash&nbsp;bilgisi zaafiyet olu\u015fturan ve \u00e7ok&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/www.erenali.com\/index.php\/2022\/08\/30\/gpo-ile-domainde-guvenlik-onlemleri\/\">Devam\u0131n\u0131 Oku<span class=\"screen-reader-text\">GPO ile Windows G\u00fcvenlik \u00d6nlemleri<\/span> <i class=\"fas fa-angle-right\"><\/i><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[620,53,622,623,618,619,621,624],"_links":{"self":[{"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/posts\/982"}],"collection":[{"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/comments?post=982"}],"version-history":[{"count":1,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/posts\/982\/revisions"}],"predecessor-version":[{"id":991,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/posts\/982\/revisions\/991"}],"wp:attachment":[{"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/media?parent=982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/categories?post=982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.erenali.com\/index.php\/wp-json\/wp\/v2\/tags?post=982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}