icon-deception.svg
Deception

Running the Decoy Deployment Script on an Active Directory

To create decoy user accounts and computers in an Active Directory (AD), you must download the decoy deployment script from the Zscaler Deception Admin Portal and run it on the AD. You must run the deployment script to create user accounts in both the credential and credential-less modes.

Prerequisites

Make sure that the following prerequisites are met:

  • Have admin access to the primary domain controller to run the script.
  • Have Powershell version 3.0 or later on your system.
  • Install PSReadLine on the AD server to read user inputs.

Running the Decoy Deployment Script on an AD

Follow these steps to run a deployment script on an AD:

    1. Press the Windows key+R on your system.

    2. In the Run window, enter gpmc.msc to open the Group Policy Management console.

    3. Configure the security audit policy:

      1. Right-click Default Domain Controllers Policy and select Edit from the drop-down menu.

      2. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff.

      3. In the Logon/Logoff pane, double-click Audit Logon.
      4. In the Audit Logon Properties window, select the Configure the following events, Success, and Failure checkboxes.

      5. Click OK.

    4. Enable Kerberos detection:
      1. Go to Advanced Audit Policy Configuration > Audit Policies > Account Logon.
      2. In the Account Logon pane, double-click Audit Kerberos Authentication Service.
      3. In the Audit Kerberos Authentication Service Properties window, select the Configure the following events, Success, and Failure checkboxes.

      4. Click OK.

      5. In the Account Logon pane, double-click Audit Kerberos Service Ticket Operations.
      6. In the Audit Kerberos Service Ticket Operations Properties window, select the Configure the following events, Success, and Failure checkboxes.

      7. Click OK.

    5. Enable AD enumeration:
      1. Go to Advanced Audit Policy Configuration > Audit Policies > DS Access.
      2. In the DS Access pane, double-click Audit Directory Service Access.
      3. In the Audit Directory Service Access Properties window, select the Configure the following events, Success, and Failure checkboxes.

      4. Click OK.

    Enabling the logs increases the volume of logs generated by the AD.

    Close
    1. In the Deception Admin Portal, go to Deceive > Active Directory Decoys > Decoy Users.

    2. Select an AD decoy user and click Download Deployment Script.

    Close
    1. Copy the deployment script (Start-Deployment.ps1)to the primary domain controller.
    2. Open PowerShell on the primary domain controller with administrative privileges.
    3. Go to the path where the deployment script is saved.

    4. Run the script on the primary domain controller using the following commands:

      • Unblock-File .\Start-Deployment.ps1
      • Import-Module .\Start-Deployment.ps1
      • Start-Deployment

      The deployment script tests the configured audit policies for all the primary domain controllers and displays the results in green text.

    5. Enter 1 to create a decoy user.

    6. After the decoy user is created, enter 7 to verify the decoy deployment.

    7. Enter 8 to generate the deployment JSON file.

      The script tries to upload the JSON file directly to the Deception Admin Portal.

      If the script fails to upload the JSON file to the Deception Admin Portal, then the script writes the JSON file to your local computer (to the same folder where the deployment script is located). In this case, you must upload the JSON file to the Deception Admin Portal.

      To upload the deployment JSON file to the Deception Admin Portal:

      1. Log in to the Deception Admin Portal.
      2. Go to Deceive > Active Directory Decoys > Decoy Users.

      3. Click Actions > Upload Enumeration Detection JSON.

      4. Browse to upload the JSON file.

      5. In the confirmation window, click OK.

        The deployment JSON is uploaded.

    Close
Related Articles
About Active Directory DecoysAdding an Active Directory DomainCreating an Active Directory Decoy UserViewing Active Directory Decoy ComputersConfiguring and Downloading a Trigger ScriptConfiguring Windows Task Scheduler to Enable AlertingConfiguring Microsoft Azure Sentinel to Forward Active Directory Event LogsConfiguring IBM QRadar to Forward Active Directory Event LogsConfiguring LogRhythm to Forward Active Directory Event LogsConfiguring Splunk to Forward Active Directory Event LogsExporting a Root CA Certificate from an Active Directory Certificate ServiceRunning the Decoy Deployment Script on an Active Directory