Microsoft bir yandan bulut yatırımlarına tam gaz devam ederken bir yandan da hibrit bulut altyapısını güçlendirecek adımlar atmaya devam ediyor. Azure Stack HCI gibi hibrit işletim sistemleri sayesinde onprem sistemler artık bulut teknolojilerini daha esnek bir şekilde yine müşterilerin kendi veri merkezlerinde kullanabiliyorlar. Bunun yanında yakın zamanda duyurulacak olan Windows Server 2025 için ise güvenliğin en önemli başlık olduğunu görebiliyoruz. Aslında ilk Windows Server 2022 için yazdığım yazılar hala aklımda. Secured Core Server :) Merak edenler için buraya bırakıyorum
Windows Server 2022 Yenilikleri – Hakan Uzuner
Windows Server 2022 Yenilikleri – Hakan Uzuner
Yani aslında 2022 sürümü ile başlayan güvenlik önceliği Windows Server 2025 için daha üst seviyeye çıkmış durumda, hızlıca neler yeni bir bakalım?
Windows Server 2025 İle Kartlar Yeniden Dağıtılacak!
Windows Server 2025 ile her şey kökten değişiyor. Özellikle Active Directory tarafında gelen yeni güvenlik özellikleri heyecan verici, bazıları aşağıdaki gibi:
- Improved algorithms for Name/Sid Lookups – Local Security Authority (LSA) Name and Sid lookup forwarding between machine accounts no longer uses the legacy Netlogon secure channel. Kerberos authentication and DC Locator algorithm are used instead. To maintain compatibility with legacy operating systems, it’s still possible to use the Netlogon secure channel as a fallback option.
- Improved security for confidential attributes – DCs and AD LDS instances only allow LDAP add, search, and modify operations involving confidential attributes when the connection is encrypted.
- Improved security for default machine account passwords – AD now uses random generated default computer account passwords. Windows 2025 DCs block setting computer account passwords to the default password of the computer account name.This behavior can be controlled by enabling the GPO setting Domain controller: Refuse setting default machine account password located in: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security OptionsUtilities like Active Directory Administrative Center (ADAC), Active Directory Users and Computers (ADUC),
net computer, anddsmodalso honors this new behavior. Both ADAC and ADUC no longer allow creating a pre-2k Windows account. - Kerberos AES SHA256 and SHA384 – The Kerberos protocol implementation is updated to support stronger encryption and signing mechanisms with support for RFC 8009 by adding SHA-256 and SHA-384. RC4 is deprecated and moved to the do-not-use cipher list.
- Kerberos PKINIT support for cryptographic agility – The Kerberos Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) protocol implementation is updated to allow for cryptographic agility by supporting more algorithms and removing hardcoded algorithms.
- LAN Manager GPO setting – The GPO setting Network security: Don’t store LAN Manager hash value on next password change is no longer present nor applicable to new versions of Windows.
- LDAP encryption by default – All LDAP client communication after a Simple Authentication and Security Layer (SASL) bind utilizes LDAP sealing by default. To learn more about SASL, see SASL Authentication.
- LDAP support for TLS 1.3 – LDAP uses the latest SCHANNEL implementation and supports TLS 1.3 for LDAP over TLS connections. Using TLS 1.3 eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the handshake as possible. To learn more, see Protocols in TLS/SSL (Schannel SSP) and TLS Cipher Suites in Windows Server 2022.
- Legacy SAM RPC password change behavior – Secure protocols such as Kerberos are the preferred way to change domain user passwords. On DCs, the latest SAM RPC password change method SamrUnicodeChangePasswordUser4 using AES is accepted by default when called remotely. The following legacy SAM RPC methods are blocked by default when called remotely:
Kaynak
Microsoft Güvenliği Öncelikli Hale Getirdi: Rakiplerle Makas Açılıyor! – ÇözümPark (cozumpark.com)