Windows sistemlerindeki Built-in Administrator Account (Yerle\u015fik Yönetici Hesab\u0131)<\/strong>, organizasyonlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik güvenlik risklerinden biridir<\/strong>. Bu hesab\u0131n devre d\u0131\u015f\u0131 b\u0131rak\u0131lmamas\u0131, sald\u0131rganlar için alt\u0131n de\u011ferinde bir hedef<\/strong> olu\u015fturur.<\/p>\n SID-500 ile tan\u0131mlanan bu hesap, hesap kilitleme politikalar\u0131ndan muaf<\/strong> oldu\u011fu için brute force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 son derece savunmas\u0131zd\u0131r. Bu yaz\u0131da, bu kritik güvenlik aç\u0131\u011f\u0131n\u0131 ve etkili çözüm yöntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n Built-in Administrator Account, Windows i\u015fletim sisteminin kurulumu s\u0131ras\u0131nda otomatik olarak olu\u015fturulan<\/strong> varsay\u0131lan yönetici hesab\u0131d\u0131r. Bu hesap, sistemin en yüksek yetkilerine<\/strong> sahiptir ve özel güvenlik özellikleriyle birlikte gelir.<\/p>\n SID (Security Identifier):<\/strong> Her zaman RID (Relative Identifier):<\/strong> Varsay\u0131lan Ad:<\/strong> Hesap Türü:<\/strong> Local Administrator \/ Domain Administrator<\/p>\n<\/li>\n<\/ul>\n Domain Admin yetkileri<\/p>\n<\/li>\n Forest-wide eri\u015fim<\/p>\n<\/li>\n Cross-domain etki<\/p>\n<\/li>\n Domain Controller’lara replike edilir<\/p>\n<\/li>\n<\/ul>\n Sadece yerel makinede geçerlidir<\/p>\n<\/li>\n Workgroup sistemler<\/p>\n<\/li>\n Standalone server’lar<\/p>\n<\/li>\n<\/ul>\n Built-in Administrator hesab\u0131n\u0131n en büyük zafiyeti<\/strong>, hesap kilitleme politikalar\u0131ndan muaf olmas\u0131d\u0131r<\/strong>.<\/p>\n Brute Force Timeline:<\/strong><\/p>\n Hour 1–24: 1.000.000 deneme<\/p>\n<\/li>\n Hour 25–48: Devam<\/p>\n<\/li>\n Hour 49–72: Devam<\/p>\n<\/li>\n Ba\u015far\u0131l\u0131 olana kadar s\u0131n\u0131rs\u0131z deneme<\/strong><\/p>\n<\/li>\n<\/ul>\n Predictable Existence<\/strong><\/p>\n Her Windows sisteminde bulunur<\/p>\n<\/li>\n SID-500 her zaman mevcuttur<\/p>\n<\/li>\n Tahmin edilebilir isimler<\/p>\n<\/li>\n<\/ul>\n Common Attack Vectors<\/strong><\/p>\n Sonuç:<\/strong> Built-in Administrator hesab\u0131:<\/p>\n Me\u015fru görünür<\/p>\n<\/li>\n Log’larda fark edilmeyebilir<\/p>\n<\/li>\n SOC ekipleri taraf\u0131ndan atlanabilir<\/p>\n<\/li>\n<\/ul>\n Persistence Teknikleri<\/strong><\/p>\n Yol:<\/strong><\/p>\n Kritik Ayarlar<\/strong><\/p>\n Accounts: Administrator account status = Disabled<\/p>\n<\/li>\n Accounts: Rename administrator account<\/p>\n<\/li>\n<\/ul>\n Just-In-Time (JIT) eri\u015fim<\/p>\n<\/li>\n Süreli admin hesaplar\u0131<\/p>\n<\/li>\n Otomatik silme<\/p>\n<\/li>\n Audit logging<\/p>\n<\/li>\n<\/ul>\n Built-in Administrator kullan\u0131m\u0131 her zaman alarm sebebidir<\/strong>.<\/p>\n Splunk detection rules<\/p>\n<\/li>\n ELK Stack query’leri<\/p>\n<\/li>\n<\/ul>\n Hesab\u0131 an\u0131nda disable et<\/p>\n<\/li>\n Source IP blokla<\/p>\n<\/li>\n Admin parolalar\u0131n\u0131 resetle<\/p>\n<\/li>\n Incident report olu\u015ftur<\/p>\n<\/li>\n<\/ul>\n CIS Control 4.3<\/strong><\/p>\n<\/li>\n CIS Control 4.8<\/strong><\/p>\n<\/li>\n NIST PR.AC-1 \/ PR.AC-4<\/strong><\/p>\n<\/li>\n<\/ul>\n Phase 1:<\/strong> Assessment Built-in Administrator Account’un devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, Windows güvenli\u011finin en kritik gereksinimlerinden biridir<\/strong>. Hesap kilitleme muafiyeti, sald\u0131rganlara s\u0131n\u0131rs\u0131z brute force imkan\u0131<\/strong> sa\u011flar ve organizasyonlar\u0131 ciddi riske sokar.<\/p>\n \u2705 Built-in Administrator durumunu analiz edin \u2705 Built-in Administrator disabled m\u0131? \u274c Built-in Administrator’\u0131 asla<\/strong> aktif b\u0131rakmay\u0131n Just-In-Time Administration<\/p>\n<\/li>\n Privileged Access Management (PAM)<\/p>\n<\/li>\n MFA zorunlulu\u011fu<\/p>\n<\/li>\n Zero Trust Architecture<\/p>\n<\/li>\n Düzenli security assessment<\/p>\n<\/li>\n<\/ul>\n Bu yap\u0131land\u0131rmay\u0131 uygulayarak, Built-in Administrator Account kaynakl\u0131 en kritik güvenlik risklerinden birini tamamen ortadan kald\u0131rabilir<\/strong> ve modern güvenlik standartlar\u0131na uygun, güçlü bir privileged access management<\/strong> altyap\u0131s\u0131 olu\u015fturabilirsiniz.<\/p>\n Not:<\/strong> Built-in Administrator hesab\u0131 = sald\u0131rgan\u0131n rüyas\u0131d\u0131r. <\/p>\n <\/p>","excerpt":"Built-in Administrator Account G\u00fcvenlik A\u00e7\u0131\u011f\u0131: En Kritik G\u00fcvenlik Riski Windows sistemlerindeki Built-in Administrator Account (Yerle\u015fik...","created_at":"2025-07-17 00:03:45","updated_at":"2026-09-07 11:24:59","category_id":12,"view_count":742,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:03:45","featured_image":"\/uploads\/images\/2025\/12\/6947c2bb847bf_1766310587.png","slug":"built-in-administrator-account-guvenligi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration"}
\nBuilt-in Administrator Account Nedir?<\/h2>\n
\nTeknik Özellikler<\/h2>\n
Hesap Tan\u0131mlay\u0131c\u0131lar\u0131<\/h3>\n
\n
S-1-5-21-domain-500<\/code> ile biter<\/p>\n<\/li>\n500<\/code> (de\u011fi\u015ftirilemez)<\/p>\n<\/li>\nAdministrator<\/code> (de\u011fi\u015ftirilebilir)<\/p>\n<\/li>\n
\nÖzel Güvenlik Özellikleri<\/h3>\n
# Built-in Administrator hesab\u0131n\u0131n özel özellikleri\n$builtinAdmin = Get-LocalUser | Where-Object {$_.SID -like \"*-500\"}\n\n$specialProperties = @{\n \"Account Lockout Immunity\" = $true\n \"Password Never Expires\" = $false\n \"Cannot Be Deleted\" = $true\n \"Cannot Be Disabled Locally\" = $false\n \"UAC Bypass Capability\" = $true\n \"Network Logon Rights\" = $true\n}\n<\/code><\/pre>\n
\nDomain vs Local Built-in Administrator<\/h2>\n
Domain Environment<\/h3>\n
\n
Local Environment<\/h3>\n
\n
\nGüvenlik Riskleri ve Sald\u0131r\u0131 Vektörleri<\/h2>\n
1. Brute Force Attack Immunity<\/h3>\n
# Normal kullan\u0131c\u0131 hesab\u0131\n# 5 yanl\u0131\u015f parola → Hesap kilitlenir\n\n# Built-in Administrator\n# S\u0131n\u0131rs\u0131z yanl\u0131\u015f parola → H\u0130ÇB\u0130R ZAMAN K\u0130TLENMEZ\n<\/code><\/pre>\n\n
\n2. Well-Known Target<\/h3>\n
\n
nmap --script smb-enum-users -p 445\nenum4linux -a\nrpcclient -U \"\" -N > lookupsids S-1-5-21-domain-500\n<\/code><\/pre>\n
\n3. Lateral Movement Facilitation<\/h3>\n
Pass-the-Hash Attacks<\/h4>\n
psexec.exe -hashes <hash> \\\\target1 cmd\npsexec.exe -hashes <hash> \\\\target2 cmd\n<\/code><\/pre>\n
Tek bir Built-in Administrator hash’i ile tüm domain ele geçirilebilir<\/strong>.<\/p>\n
\n4. Persistence and Stealth<\/h3>\n
\n
schtasks \/create ...\nsc create ...\nRegister-WmiEvent ...\n<\/code><\/pre>\n
\nÇözüm Yöntemleri<\/h2>\n
1. Built-in Administrator Account Devre D\u0131\u015f\u0131 B\u0131rakma<\/h3>\n
Local System<\/h4>\n
Disable-LocalUser -Name \"Administrator\"\nnet user Administrator \/active:no\n<\/code><\/pre>\nDomain Environment<\/h4>\n
Disable-ADAccount -Identity <SID-500>\n<\/code><\/pre>\n
\n2. Group Policy (GPO) ile Toplu Yönetim<\/h3>\n
Computer Configuration\n→ Windows Settings\n→ Security Settings\n→ Local Policies\n→ Security Options\n<\/code><\/pre>\n\n
Set-GPRegistryValue ...\nNew-GPLink ...\n<\/code><\/pre>\n
\n3. Advanced Configuration Management<\/h3>\n
PowerShell DSC<\/h4>\n
Configuration DisableBuiltinAdmin {\n User DisableAdministrator {\n UserName = 'Administrator'\n Disabled = $true\n }\n}\n<\/code><\/pre>\n
\nGüvenli Alternatif Yönetici Hesaplar\u0131<\/h2>\n
Dedicated Administrative Accounts<\/h3>\n
\n
adm_username<\/code><\/p>\n<\/li>\nsvc_backup<\/code><\/p>\n<\/li>\nadm_emergency<\/code><\/p>\n<\/li>\n<\/ul>\nNew-LocalUser\nAdd-LocalGroupMember\n<\/code><\/pre>\n
\nPrivileged Access Management (PAM)<\/h3>\n
\n
\nMonitoring ve Detection<\/h2>\n
Built-in Administrator Usage Detection<\/h3>\n
Event ID: 4624 \/ 4625\n<\/code><\/pre>\n
\nSIEM Integration<\/h3>\n
\n
\nAutomated Response<\/h3>\n
\n
\nCompliance ve Best Practices<\/h2>\n
Framework Alignment<\/h3>\n
\n
\nMigration Strategy<\/h2>\n
Phased Disable Approach<\/h3>\n
Phase 2:<\/strong> Alternative admin creation
Phase 3:<\/strong> Safe disable<\/p>\n
\nSonuç ve Öneriler<\/h2>\n
\nKritik Uygulama Ad\u0131mlar\u0131<\/h3>\n
\u2705 Alternatif admin hesaplar\u0131 olu\u015fturun
\u2705 Phased approach ile geçi\u015f yap\u0131n
\u2705 Built-in Administrator’\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n
\u2705 Monitoring & alerting kurun
\u2705 Incident response plan\u0131 haz\u0131rlay\u0131n<\/p>\n
\nH\u0131zl\u0131 Kontrol Listesi<\/h3>\n
\u2705 Alternatif admin hesaplar\u0131 var m\u0131?
\u2705 Emergency access tan\u0131ml\u0131 m\u0131?
\u2705 Monitoring aktif mi?
\u2705 PAM de\u011ferlendirildi mi?
\u2705 E\u011fitim tamamland\u0131 m\u0131?<\/p>\n
\nKritik Güvenlik Uyar\u0131lar\u0131<\/h3>\n
\u274c Alternatifsiz disable etmeyin
\u274c Monitoring olmadan üretime geçmeyin<\/p>\n
\nGeli\u015fmi\u015f Güvenlik Önerileri<\/h3>\n
\n
\n\n
Devre d\u0131\u015f\u0131 b\u0131rak\u0131lmad\u0131\u011f\u0131 her saniye risktir.<\/strong><\/p>\n<\/blockquote>\n