Building Secure PowerShell Solutions with Jake Hildreth
Feb 10, 2025
auto_awesome
Jake Hildreth, a security-focused PowerShell expert and creator of Locksmith and PowerPUG, dives into the evolution of Locksmith v2, highlighting automation and user-friendly security enhancements. He also discusses the importance of the Protected Users group in Active Directory for eliminating outdated authentication vulnerabilities. The conversation touches on learning Crescendo with certutil.exe and improving PowerShell workflows through scripting and community resources. Jake shares his journey of continuous learning, emphasizing the value of documentation and collaboration in the tech space.
The evolution of Locksmith to version 2 focuses on enhancing user accessibility through a GUI and improved automated reporting mechanisms.
PowerPug simplifies the process of incorporating users into the Protected Users Group, mitigating authentication vulnerabilities within Active Directory environments.
Deep dives
Introduction of Locksmith 2
The continuous development of Locksmith has led to the introduction of Locksmith 2, which aims to enhance user experience and functionality compared to its predecessor. The new version will address previous challenges associated with adding detections and features by establishing a more structured architecture. By implementing a graphical user interface (GUI), Locksmith 2 will provide better reporting options and make complex operations more accessible to users unfamiliar with command-line interactions. Additionally, the update will prioritize automation and enable outputting objects to the PowerShell pipeline, a significant improvement for users seeking streamlined operations.
Understanding the Protected Users Group
The Protected Users Group plays a crucial role in enhancing security within Active Directory environments by restricting weak authentication methods, which could be exploited by malicious actors. Users added to this group cannot use NTLM and are barred from employing insecure Kerberos encryption methods, thereby improving overall domain protection. Many organizations struggle to incorporate users into this group due to connectivity issues or misunderstandings about privileges, indicating a need for better education on proper administrative account separation. Tools like PowerPug are designed to simplify this process by assessing current configurations and suggesting straightforward solutions for adding users to the Protected Users Group.
Challenges in Learning PowerShell
PowerShell users often face challenges as they navigate various concepts, such as classes, enums, and pipelining, especially when they come from different programming backgrounds. The discussion highlighted the importance of starting projects with existing knowledge and continuously improving through community feedback and personal exploration. As seen in the speaker's journey, embracing AI tools like GitHub Copilot can significantly accelerate the learning process and enhance productivity when writing code. Moreover, the importance of building projects in public helps to foster community support and encourages developers to overcome the fear of not knowing everything before starting.
Creating Community-Driven Solutions
The podcast emphasizes the necessity of community involvement in developing effective tools for PowerShell users, such as Locksmith and PowerPug. By sharing knowledge, resources, and tools openly, developers can streamline their work processes and contribute to the collective growth of the PowerShell community. Engaging in educational efforts through documentation, workshops, and public discussions helps demystify security practices and empowers users to implement effective solutions in their environments. Ultimately, this collaborative approach fosters a culture of continuous improvement, where each member can learn from the other while addressing security challenges together.
In this episode of the PowerShell Podcast, we welcome back security-focused PowerShell expert Jake Hildreth for an insightful conversation about PowerShell, security tools, and his continued journey in the PowerShell community. Jake shares updates on Locksmith v2, his work with PowerPUG, and his experience learning new PowerShell techniques to refine and improve his tools.
Bio: I'm a husband, a dad, and a recovering sysadmin. I've worked in technology since the year 2000, when I got my first tech job as Tier 1 support for cable modem companies. After that, I transitioned into systems & network administration, always with a security focus. In the last three years, I pivoted into security, focusing on Active Directory. When I'm not working, I enjoy cooking, drinking whiskey, lifting weights, traveling, reading... and writing code. Coding is like creating and solving little puzzles for yourself! So soothing.
Key topics in this episode include:
The evolution of Locksmith and the road to v2, including improvements in automation, PowerShell best practices, and making security more accessible.
PowerPug and the protected users group, a tool that helps sysadmins secure their environments by eliminating outdated authentication vulnerabilities.
Learning Crescendo, explore how Jake wrapped certutil.exe.
Improving PowerShell workflows, including scripting automation, optimizing profiles, and using community resources for best practices.
The importance of documentation, automation, and making security easier for sysadmins.
Jake also shares insights from his time working with the PowerShell community, including PowerShell Wednesdays, learning from peers, and the power of building in public.
Join the conversation:
Follow Jake at JakeHildreth.com for links to all his projects and socials.
Catch PowerShell Wednesdays every Wednesday at 2 PM EST in the PDQ Discord community (discord.gg/pdq) for live discussions and demos.