{"id":327,"title":"Active Directory'de adminCount=1, AdminSDHolder ve G\u00fcvenli Delegasyon","content":"<h3>Sahne A&ccedil;\u0131l\u0131yor...<\/h3>\r\n<p>Enterprise ortam\u0131nda bir pazartesi sabah\u0131:<\/p>\r\n<ul>\r\n<li><strong>G&uuml;venlik Ekibi<\/strong>: \"Bizim 500+ kullan\u0131c\u0131 <code>adminCount=1<\/code> ile i\u015faretlenmi\u015f!\"<\/li>\r\n<li><strong>Y&ouml;netici<\/strong>: \"Nas\u0131l olur? Sadece 50 ki\u015fi y&ouml;neticiymi\u015f...\"<\/li>\r\n<li><strong>Denet&ccedil;i<\/strong>: \"Bu nedir? Bunu belgelendirmedi\u011finizi g&ouml;r&uuml;yorum.\"<\/li>\r\n<li><strong>CTO<\/strong>: \"Bu risk nas\u0131l bu kadar b&uuml;y&uuml;y&uuml;p kimse fark etmedi?\"<\/li>\r\n<\/ul>\r\n<p><iframe style=\"width: 740px; height: 415px;\" src=\"https:\/\/www.youtube.com\/embed\/XxZRRaPs8QY?si=BnnDFqv4a695MbDe\" width=\"740\" height=\"415\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\r\n<h3>Ger&ccedil;ek Sorun<\/h3>\r\n<p>Active Directory (AD) ile ilgili en yayg\u0131n hatalardan biri, <strong>y&ouml;netim delegasyonunun g&uuml;vensiz ve kaotik yap\u0131lmas\u0131<\/strong>, bunun sonucunda:<\/p>\r\n<ol>\r\n<li><strong>Shadow Admin Sorunu<\/strong>: Resmi olmayan y&ouml;netim yetkilerine sahip hesaplar ortaya &ccedil;\u0131k\u0131yor<\/li>\r\n<li><strong>adminCount Patolojisi<\/strong>: Sistem taraf\u0131ndan otomatik olarak kald\u0131r\u0131lmas\u0131 gereken flag'ler cihaz &uuml;zerinde kal\u0131yor<\/li>\r\n<li><strong>AdminSDHolder &Ccedil;eli\u015fkisi<\/strong>: Y&ouml;neticiler, koruma mekanizmas\u0131n\u0131 anlayamad\u0131klar\u0131 i&ccedil;in k\u0131r\u0131yor<\/li>\r\n<li><strong>Denetim \u0130zleri<\/strong>: \"Kim ne zaman neyi de\u011fi\u015ftirdi?\" sorusuna cevap verilemiyor<\/li>\r\n<\/ol>\r\n<h3>Bu Yaz\u0131 Kimler \u0130&ccedil;in?<\/h3>\r\n<ul>\r\n<li><strong>Active Directory Y&ouml;neticileri<\/strong>: Delegasyon stratejisi planlayan<\/li>\r\n<li><strong>G&uuml;venlik Mimarlar\u0131<\/strong>: Least Privilege ilkesini uygulamak isteyenler<\/li>\r\n<li><strong>Sistem Y&ouml;neticileri<\/strong>: Eski hatalar\u0131 d&uuml;zeltmek isteyen<\/li>\r\n<li><strong>Denetim Ekipleri<\/strong>: Uyum ve izleme raporu isteyenler<\/li>\r\n<\/ul>\r\n<hr>\r\n<h2>adminCount = 1 Nedir? Teknik A&ccedil;\u0131klama<\/h2>\r\n<h3>Tan\u0131m: AdminCount Attribute'u<\/h3>\r\n<p><code>adminCount<\/code>, Active Directory'de bir hesab\u0131n veya bilgisayar\u0131n <strong>Protected Groups<\/strong> (Korunan Gruplar) i&ccedil;inde bulunup bulunmad\u0131\u011f\u0131n\u0131 g&ouml;steren bir boolean flag'idir.<\/p>\r\n<pre><code>adminCount = 1  \u279c  Bu nesne korumal\u0131 grup &uuml;yesi (veya olmu\u015f) demektir\r\nadminCount = 0  \u279c  Bu nesne korumal\u0131 grup &uuml;yesi de\u011fil\r\n<\/code><\/pre>\r\n<h3>Korunan Gruplar Nelerdir?<\/h3>\r\n<p>Active Directory, a\u015fa\u011f\u0131daki gruplar\u0131 <strong>otomatik olarak korur<\/strong>:<\/p>\r\n<table style=\"border-collapse: collapse;\" border=\"1\"><caption>Caption<\/caption>\r\n<thead>\r\n<tr>\r\n<th>Grup<\/th>\r\n<th>RID<\/th>\r\n<th>A&ccedil;\u0131klama<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>Domain Admins<\/strong><\/td>\r\n<td>512<\/td>\r\n<td>Etki alan\u0131 y&ouml;neticileri (&ccedil;o\u011fu zaman k&ouml;t&uuml; ama&ccedil;l\u0131 hedef)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Enterprise Admins<\/strong><\/td>\r\n<td>519<\/td>\r\n<td>Orman y&ouml;neticileri (Tier 0 eri\u015fim)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Schema Admins<\/strong><\/td>\r\n<td>518<\/td>\r\n<td>\u015eema de\u011fi\u015fikli\u011fi yetkisi (&ccedil;ok tehlikeli)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Account Operators<\/strong><\/td>\r\n<td>548<\/td>\r\n<td>Kullan\u0131c\u0131\/grup y&ouml;netimi (yerel gruplara eri\u015febilir)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Backup Operators<\/strong><\/td>\r\n<td>551<\/td>\r\n<td>Yedekleme ve geri y&uuml;kleme yetkisi<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Print Operators<\/strong><\/td>\r\n<td>550<\/td>\r\n<td>Yaz\u0131c\u0131 y&ouml;netimi<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Server Operators<\/strong><\/td>\r\n<td>549<\/td>\r\n<td>Sunucu y&ouml;netimi (yerel)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Replicator<\/strong><\/td>\r\n<td>552<\/td>\r\n<td>Replikasyon (nadiren kullan\u0131l\u0131r)<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h3>SDProp (Security Descriptor Propagator) Mekanizmas\u0131<\/h3>\r\n<p>Active Directory, <strong>SDProp<\/strong> adl\u0131 bir arka plan i\u015flemi &ccedil;al\u0131\u015ft\u0131r\u0131r:<code>\r\n<\/code><\/p>\r\n<pre class=\"language-markup\"><code>   SDProp D&ouml;ng&uuml;s&uuml; (Her 3600 sn)      \r\n\r\n 1. Korunan gruplar\u0131 tarar           \r\n 2. &Uuml;yeleri tespit eder              \r\n 3. adminCount=1 atan\u0131r              \r\n 4. AdminSDHolder ACL'ini kopyalar   \r\n 5. &Uuml;yelerin Permission'\u0131n\u0131 g&uuml;nceller<\/code><\/pre>\r\n<h3>adminCount'un Ya\u015fam D&ouml;ng&uuml;s&uuml;<code>\r\n<\/code><\/h3>\r\n<pre class=\"language-markup\"><code>SENARYO 1: Grup &Uuml;yesi Ekleme (Do\u011fru Davran\u0131\u015f)\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\nUser1 \u279c (Domain Admins'e eklenir) \u279c adminCount=1 otomatik atan\u0131r\r\nUser1 \u279c (Domain Admins'den &ccedil;\u0131kar\u0131l\u0131r) \u279c adminCount AYNEN KALIR \r\n\r\nSENARYO 2: Grup &Uuml;yesi &Ccedil;\u0131karma (S\u0130Z\u0130N \u0130\u015e\u0130N\u0130Z!)\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\nUser1'in adminCount=1 kald\u0131r\u0131lmas\u0131 i&ccedil;in \u279c El ile `Set-ADObject -Clear adminCount` &ccedil;al\u0131\u015ft\u0131rman\u0131z gerekir!\r\n\r\nSENARYO 3: Korunan Gruba Do\u011frudan &Uuml;ye Ekleme (Hata!)\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\nGrup1 \u279c (Domain Admins'in nesne &uuml;yesi olmu\u015f) \u279c adminCount=1 + ACL korumas\u0131 \u279c O grupta herkes korunuyor!<\/code><\/pre>\r\n<h3>Praktik &Ouml;rnek: Bir Kullan\u0131c\u0131n\u0131n adminCount'u Kontrol Etme<\/h3>\r\n<pre><code class=\"language-powershell\"># T&uuml;m adminCount=1 olan kullan\u0131c\u0131lar\u0131 listele\r\nGet-ADUser -LDAPFilter \"(adminCount=1)\" -Properties adminCount, MemberOf | \r\n    Select-Object Name, adminCount, @{\r\n        L='Gruplar'; \r\n        E={($_.MemberOf | ForEach-Object {$_ -replace '^CN=|,.*$'}) -join ', '}\r\n    }\r\n\r\n# &Ccedil;\u0131kt\u0131 &Ouml;rne\u011fi:\r\n# Name          adminCount    Gruplar\r\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n# Admin1        1             Domain Admins, Enterprise Admins\r\n# User2         1             (bo\u015f - ORFANlanm\u0131\u015f!)\r\n# ServiceAcc1   1             (bo\u015f - ORFANlanm\u0131\u015f!)\r\n<\/code><\/pre>\r\n<h3>Sorun: adminCount Zamanla Orfa Kal\u0131r<\/h3>\r\n<pre><code class=\"language-powershell\"># SORULU ZAMAN &Ccedil;\u0130ZELGES\u0130\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\nT=0     : User \u279c Domain Admins'e eklenir \u279c adminCount=1 atan\u0131r\r\nT=1 g&uuml;n : User \u279c Domain Admins'den &ccedil;\u0131kar\u0131l\u0131r \u279c adminCount AYNEN 1 kal\u0131r!\r\nT=30 g&uuml;n: Denet&ccedil;i raporunda User h&acirc;l&acirc; \"admin\" olarak g&ouml;r&uuml;n&uuml;yor\r\nT=60 g&uuml;n: Hi&ccedil; kimse bunun fark etmedi\u011fine g&uuml;veniyor\r\nT=&infin;     : Yeni denet&ccedil;i raporunda \"500+ gizli y&ouml;netici var!\" yaz\u0131yor\r\n<\/code><\/pre>\r\n<hr>\r\n<h2>AdminSDHolder Riski: Neden ACL'yi De\u011fi\u015ftirmiyorsunuz?<\/h2>\r\n<h3>AdminSDHolder Nedir?<\/h3>\r\n<p><code>AdminSDHolder<\/code>, Active Directory'de <strong>CN=AdminSDHolder,CN=System<\/strong> konumunda bulunan <strong>orman d&uuml;zeyinde bir container<\/strong>'d\u0131r. Bu nesnenin ACL'i (Access Control List), t&uuml;m korunan grup &uuml;yelerine otomatik olarak uygulan\u0131r.<\/p>\r\n<h3>Mimari G&ouml;rselle\u015ftirme<\/h3>\r\n<p><br>&nbsp; &nbsp; AdminSDHolder Container &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<br>&nbsp; &nbsp; (CN=System,DC=contoso,DC=com) &nbsp; &nbsp;<\/p>\r\n<p>&nbsp; ACL (Eri\u015fim Kontrol Listesi): &nbsp; &nbsp; &nbsp;<br>&nbsp; \u251c\u2500 SYSTEM: FullControl &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br>&nbsp; \u251c\u2500 CREATOR OWNER: FullControl &nbsp; &nbsp;&nbsp;<br>&nbsp; \u251c\u2500 Domain Admins: FullControl &nbsp; &nbsp;&nbsp;<br>&nbsp; \u2514\u2500 Enterprise Admins: FullControl&nbsp;<\/p>\r\n<p>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\u2b07 (Her 3600 sn kopyalan\u0131r)<\/p>\r\n<p>&nbsp; &nbsp; Domain Admins Group &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<br>&nbsp; &nbsp; (&Uuml;ye: Admin1, Admin2, ...) &nbsp; &nbsp; &nbsp; &nbsp;<code>\r\n<\/code><\/p>\r\n<h3>AdminSDHolder ACL'i Ne \u0130&ccedil;erir?<\/h3>\r\n<pre><code class=\"language-powershell\"># AdminSDHolder'\u0131n ACL'ini g&ouml;r&uuml;nt&uuml;le\r\n$AdminSD = Get-ADObject -Identity \"CN=AdminSDHolder,CN=System,DC=contoso,DC=com\" -Properties ntSecurityDescriptor\r\n$AdminSD.ntSecurityDescriptor.Access | Format-Table IdentityReference, ActiveDirectoryRights, AccessControlType -AutoSize\r\n\r\n# &Ccedil;\u0131kt\u0131 &Ouml;rne\u011fi:\r\n# IdentityReference              ActiveDirectoryRights                    AccessControlType\r\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n# NT AUTHORITY\\SYSTEM            FullControl                              Allow\r\n# BUILTIN\\Administrators         FullControl                              Allow\r\n# CONTOSO\\Domain Admins          FullControl                              Allow\r\n# CONTOSO\\Enterprise Admins      FullControl                              Allow\r\n<\/code><\/pre>\r\n<h3>&Ccedil;OK YAYGIN HATA: AdminSDHolder ACL'ini De\u011fi\u015ftirmek<\/h3>\r\n<h4>Hata Senaryosu<\/h4>\r\n<p>Bir y&ouml;netici \u015f&ouml;yle d&uuml;\u015f&uuml;n&uuml;yor:<\/p>\r\n<blockquote>\r\n<p>\"Domain Admins grubu bize &ccedil;ok fazla yetki veriyor. Sadece belirli nesneleri y&ouml;netebilmeleri i&ccedil;in ACL'ini d&uuml;zelteyim.\"<\/p>\r\n<\/blockquote>\r\n<pre><code class=\"language-powershell\"># \u274c YANLI\u015e YAP! \u274c\r\n$AdminSDPath = \"CN=AdminSDHolder,CN=System,DC=contoso,DC=com\"\r\n$AdminSDObj = Get-ADObject -Identity $AdminSDPath\r\n$ACL = Get-Acl \"AD:\\$AdminSDPath\"\r\n# ... ACL'den permission'lar\u0131 kald\u0131r\u0131r ...\r\nSet-Acl -Path \"AD:\\$AdminSDPath\" -AclObject $ACL\r\n<\/code><\/pre>\r\n<h3>Sonu&ccedil;lar: Kontrol&uuml; Kaybetme<\/h3>\r\n<pre><code>T=0     : ACL de\u011fi\u015ftirilir\r\nT=5 min : SDProp &ccedil;al\u0131\u015f\u0131r, de\u011fi\u015fikli\u011fi geri yazmaya &ccedil;al\u0131\u015f\u0131r\r\nT=10 min: Hatal\u0131 davran\u0131\u015f ortaya &ccedil;\u0131k\u0131yor:\r\n          \u251c\u2500 Domain Admins'lar birbirini y&ouml;netememaya ba\u015flar\r\n          \u251c\u2500 Policy uygulanmamaya ba\u015flar\r\n          \u251c\u2500 Yetkilendirme kontrolleri bozulur\r\n          \u2514\u2500 Denetim izleri tutars\u0131z hale gelir\r\nT=&infin;     : Etki alan\u0131 d&uuml;zeyinde uyum problemi\r\n<\/code><\/pre>\r\n<h3>Do\u011fru Yakla\u015f\u0131m: ACL'yi Asla De\u011fi\u015ftirmeyin<\/h3>\r\n<p><strong>Kurallar:<\/strong><\/p>\r\n<ol>\r\n<li><strong>AdminSDHolder'\u0131 sadece okuyun<\/strong> - \u0130ncelemek i&ccedil;in <code>Get-Acl<\/code> kullanabilirsiniz<\/li>\r\n<li><strong>Delegasyon istiyorsan\u0131z OrgUnit (OU) kullan\u0131n<\/strong> - A\u015fa\u011f\u0131da g&ouml;sterece\u011fiz<\/li>\r\n<li><strong>K\u0131s\u0131tlamak istiyorsan\u0131z &ouml;zel gruplar olu\u015fturun<\/strong> - Korunan gruplar\u0131 de\u011fi\u015ftirmeyin<\/li>\r\n<li><strong>SDProp d&ouml;ng&uuml;s&uuml;n&uuml; kesmeyin<\/strong> - Varsay\u0131lan 3600 saniye kals\u0131n<\/li>\r\n<\/ol>\r\n<h3>Sa\u011fl\u0131kl\u0131 Delegasyon: AdminSDHolder Yerine OU Delegasyonu<\/h3>\r\n<pre><code class=\"language-powershell\"># AdminSDHolder'\u0131 OKUMAK (izin verilen)\r\nGet-ADObject -Identity \"CN=AdminSDHolder,CN=System,DC=contoso,DC=com\" `\r\n    -Properties ntSecurityDescriptor | \r\n    Select-Object -ExpandProperty ntSecurityDescriptor | \r\n    Select-Object -ExpandProperty Access\r\n\r\n# E\u011fer k\u0131s\u0131tlama istiyorsan\u0131z, bu \u015fekilde yap\u0131n:\r\n# \u2705 OU Delegasyonu ile \"Tier 2 Y&ouml;neticiler\" grubu olu\u015ftur\r\n# \u2705 Bu gruba sadece belirli OU'daki nesneleri de\u011fi\u015ftir yetkisi ver\r\n# \u2705 AdminSDHolder'\u0131 AYNEN BIRAK\r\n<\/code><\/pre>\r\n<hr>\r\n<h2>Tier Modeline G&ouml;re Delegasyon: Tier 0\/1\/2 Planlamas\u0131<\/h2>\r\n<h3>Microsoft Tier Model Nedir?<\/h3>\r\n<p>Microsoft, AD ortamlar\u0131nda g&uuml;venlik katmanlar\u0131n\u0131 s\u0131n\u0131fland\u0131rm\u0131\u015ft\u0131r:<\/p>\r\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n\u2502                       TIER MODEL                                 \u2502\r\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\r\n\u2502                                                                  \u2502\r\n\u2502  TIER 0 (En Kritik - &Ccedil;ok Az Ki\u015fi)                              \u2502\r\n\u2502  \u251c\u2500 Enterprise Admins                                           \u2502\r\n\u2502  \u251c\u2500 Schema Admins                                               \u2502\r\n\u2502  \u251c\u2500 Domain Admins (k\u0131s\u0131tl\u0131)                                     \u2502\r\n\u2502  \u2514\u2500 Kriti orman kurtarma hesaplar\u0131                              \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  \u2195 (Tek y&ouml;nl&uuml; g&uuml;ven - Tier 0 hi&ccedil;bir \u015feye g&uuml;venmesin)           \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  TIER 1 (Etki Alan\u0131 Y&ouml;netimi)                                   \u2502\r\n\u2502  \u251c\u2500 OU Y&ouml;neticileri                                             \u2502\r\n\u2502  \u251c\u2500 Grup Politikas\u0131 Y&ouml;neticileri                                \u2502\r\n\u2502  \u2514\u2500 Sunucu Y&ouml;neticileri (s\u0131n\u0131rl\u0131)                               \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  \u2195 (G&uuml;ven y&ouml;netilmeli)                                          \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  TIER 2 (\u0130\u015f Birimi Y&ouml;netimi)                                    \u2502\r\n\u2502  \u251c\u2500 Yerel Y&ouml;neticiler                                           \u2502\r\n\u2502  \u251c\u2500 Uygulama Y&ouml;neticileri                                       \u2502\r\n\u2502  \u2514\u2500 Destek Personeli (s\u0131n\u0131rl\u0131)                                  \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  \u2195 (Geni\u015f eri\u015fim, ancak y&ouml;netilmeli)                            \u2502\r\n\u2502                                                                  \u2502\r\n\u2502  TIER 3 (Son Kullan\u0131c\u0131lar)                                      \u2502\r\n\u2502  \u251c\u2500 Standart Kullan\u0131c\u0131lar                                       \u2502\r\n\u2502  \u2514\u2500 Konuk Hesaplar\u0131                                             \u2502\r\n\u2502                                                                  \u2502\r\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n<\/code><\/pre>\r\n<h3>Delegasyon Stratejisi: Her Tier \u0130&ccedil;in<\/h3>\r\n<h4>TIER 0: Orman Y&ouml;netimi (Maximum G&uuml;venlik)<\/h4>\r\n<p><strong>Ama&ccedil;<\/strong>: \u015eema, orman yap\u0131s\u0131, kritik yap\u0131land\u0131rma<\/p>\r\n<p><strong>Ki\u015fi Say\u0131s\u0131<\/strong>: 2-3 (hatta 2 de az de\u011fildir!)<\/p>\r\n<p><strong>Gruplar:<\/strong><\/p>\r\n<ul>\r\n<li>Enterprise Admins<\/li>\r\n<li>Schema Admins<\/li>\r\n<\/ul>\r\n<p><strong>Delegasyon Modeli:<\/strong><\/p>\r\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n\u2502  TIER 0 Delegasyon Ak\u0131\u015f\u0131             \u2502\r\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\r\n\u2502 1. De\u011fi\u015fiklik Talep Formu            \u2502\r\n\u2502 2. &Uuml;st Y&ouml;netim Onay\u0131                 \u2502\r\n\u2502 3. 2 Ki\u015fi Ayn\u0131 Anda Haz\u0131r (4 G&ouml;z)   \u2502\r\n\u2502 4. De\u011fi\u015fiklik + Denetim Kayd\u0131        \u2502\r\n\u2502 5. Test Ortam\u0131nda &Ouml;ncesi Sim&uuml;lasyon  \u2502\r\n\u2502 6. Raporlama (Zorunlu)               \u2502\r\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n<\/code><\/pre>\r\n<p><strong>PowerShell Kontrol:<\/strong><\/p>\r\n<pre><code class=\"language-powershell\"># TIER 0 &uuml;yelerini listele\r\n$Tier0Groups = @('Administrators', 'Domain Admins', 'Enterprise Admins', 'Schema Admins')\r\nforeach ($Group in $Tier0Groups) {\r\n    Get-ADGroupMember -Identity $Group -Recursive | \r\n        Where-Object { $_.objectClass -eq 'user' } |\r\n        Select-Object Name, samAccountName, @{L='Grup'; E={$Group}}\r\n}\r\n\r\n# Ayl\u0131k rapor: TIER 0 de\u011fi\u015fiklikleri\r\nGet-ADUser -LDAPFilter \"(adminCount=1)\" -Properties WhenChanged, LastLogonDate |\r\n    Where-Object { $_.WhenChanged -gt (Get-Date).AddDays(-30) } |\r\n    Select-Object Name, WhenChanged, LastLogonDate\r\n<\/code><\/pre>\r\n<h4>TIER 1: Etki Alan\u0131 Y&ouml;netimi (Orta G&uuml;venlik)<\/h4>\r\n<p><strong>Ama&ccedil;<\/strong>: GPO, OU, Kullan\u0131c\u0131\/Bilgisayar y&ouml;netimi<\/p>\r\n<p><strong>Ki\u015fi Say\u0131s\u0131<\/strong>: 5-10<\/p>\r\n<p><strong>Gruplar:<\/strong><\/p>\r\n<ul>\r\n<li>Domain Admins (OU Delegasyonu ile s\u0131n\u0131rland\u0131r\u0131lm\u0131\u015f)<\/li>\r\n<li>GPO Edit&ouml;rleri<\/li>\r\n<li>OU Y&ouml;neticileri<\/li>\r\n<\/ul>\r\n<p><strong>Delegasyon Modeli:<\/strong><\/p>\r\n<pre><code class=\"language-powershell\"># TIER 1: OU Delegasyonu &Ouml;rne\u011fi\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n\r\nOU=Tier1_Servers,DC=contoso,DC=com\r\n\u251c\u2500 Server1\r\n\u251c\u2500 Server2\r\n\u2514\u2500 Server3\r\n\r\n# \"Tier1_ServerAdmins\" grubu sadece bu OU'da i\u015flem yapabilir\r\n# Delegasyon ad\u0131mlar\u0131:\r\n\r\n1. Grup olu\u015ftur\r\n   New-ADGroup -Name \"Tier1_ServerAdmins\" -GroupScope Global\r\n\r\n2. OU'ya eri\u015fim ver (d\u0131\u015far\u0131dan de\u011fil!)\r\n   # GUI: Delegation of Control Wizard\r\n   # veya\r\n   dsacls.exe \"OU=Tier1_Servers,DC=contoso,DC=com\" `\r\n       \/G \"CONTOSO\\Tier1_ServerAdmins:CCCCDC\"\r\n\r\n3. PowerShell ile kontrol\r\n   Get-ADUser -LDAPFilter \"(memberOf=CN=Tier1_ServerAdmins,CN=Users,DC=contoso,DC=com)\" `\r\n       -Properties MemberOf | Select Name, MemberOf\r\n<\/code><\/pre>\r\n<h4>TIER 2: \u0130\u015f Birimi Y&ouml;netimi (Esnek)<\/h4>\r\n<p><strong>Ama&ccedil;<\/strong>: Yerel uygulama, grup y&ouml;netimi, hizmet hesaplar\u0131<\/p>\r\n<p><strong>Ki\u015fi Say\u0131s\u0131<\/strong>: 20+<\/p>\r\n<p><strong>Gruplar:<\/strong><\/p>\r\n<ul>\r\n<li>Yerel Y&ouml;netici Gruplar\u0131<\/li>\r\n<li>Uygulama Grup Y&ouml;neticileri<\/li>\r\n<li>Help Desk Operators<\/li>\r\n<\/ul>\r\n<p><strong>Delegasyon Modeli:<\/strong><\/p>\r\n<pre><code class=\"language-powershell\"># TIER 2: Grup ve Hizmet Hesab\u0131 Y&ouml;netimi\r\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n\r\n# \"Tier2_AppAdmins\" grubu\r\n# \u251c\u2500 SharePoint_Admins grubunu y&ouml;netebilir\r\n# \u251c\u2500 App_ServiceAccounts OU'sunda hesap olu\u015fturabilir\r\n# \u2514\u2500 Kendi gruplar\u0131n\u0131 y&ouml;netebilir (recursively y&ouml;netemesin!)\r\n\r\n# OU Delegasyonu: Tier 2 i&ccedil;in daha geni\u015f izinler\r\n$OU = \"OU=Tier2_Applications,DC=contoso,DC=com\"\r\n$Group = \"Tier2_AppAdmins\"\r\n\r\n# Delegasyon GUI arac\u0131\r\n# Delegated Tasks: User Accounts Creation, Modification\r\n#                  Reset Password\r\n#                  Group Management\r\n\r\n# PowerShell ile do\u011frula\r\ndsacls.exe $OU \/G \"CONTOSO\\$Group:CCCCDA\"\r\n<\/code><\/pre>\r\n<h3>Yayg\u0131n Hatalar: Tier Delegasyonunda<\/h3>\r\n<h4>Hata 1: Account Operators Kullanmak<\/h4>\r\n<pre><code class=\"language-powershell\"># \u274c YANLI\u015e\r\nGet-ADGroup -Identity \"Account Operators\" -Properties members |\r\n    Select-Object -ExpandProperty members\r\n\r\n# Sorun: Account Operators eski, standartla\u015ft\u0131r\u0131lmam\u0131\u015f ve k&ouml;t&uuml; ama&ccedil;l\u0131 hedef\r\n# \u2705 DO\u011eRU: &Ouml;zel OU delegasyonu grup olu\u015ftur\r\nNew-ADGroup -Name \"Tier1_UserAdmins\" -GroupScope DomainLocal\r\n<\/code><\/pre>\r\n<h4>Hata 2: Tier'lar Aras\u0131 G&uuml;ven Eksikli\u011fi<\/h4>\r\n<pre><code class=\"language-powershell\"># \u274c YANLI\u015e\r\n# TIER 2 admin'i do\u011frudan Domain Admins grubuna eklenir\r\nAdd-ADGroupMember -Identity \"Domain Admins\" -Members \"CONTOSO\\Tier2_Admin\"\r\n\r\n# \u2705 DO\u011eRU\r\n# TIER 2 admin'i, Tier 2 OU'sunda s\u0131n\u0131rl\u0131 yetkiye sahiptir\r\n# TIER 1'de yard\u0131m isterse, bir ticket olu\u015fturur ve TIER 1 admin taraf\u0131ndan yap\u0131l\u0131r\r\n<\/code><\/pre>\r\n<h4>Hata 3: Delegasyonun Belgelenmemesi<\/h4>\r\n<pre><code class=\"language-powershell\"># \u2705 DO\u011eRU Y&Ouml;NET\u0130M\r\n\r\n# Delegasyon logu tut\r\n$DelegationLog = @{\r\n    Date = Get-Date\r\n    Admin = $env:USERNAME\r\n    Action = \"Tier1_UserAdmins grubuna User5 eklendi\"\r\n    Reason = \"Ticket #12345 - Yeni OU Y&ouml;neticisi\"\r\n    Approved = \"Manager (email)\"\r\n}\r\n\r\n# JSON olarak kaydet\r\n$DelegationLog | ConvertTo-Json | Out-File -Path \"C:\\Logs\\delegations_$(Get-Date -Format yyyyMM).json\" -Append\r\n<\/code><\/pre>\r\n<hr>\r\n<h2>Best Practice Checklist: Uygulanabilir Ad\u0131mlar<\/h2>\r\n<h3>A. Envanter Olu\u015fturma (Haftada 1 kez)<\/h3>\r\n<pre><code class=\"language-powershell\"># Script: AD_AdminCount_Report.ps1\r\n\r\n$ReportPath = \"C:\\Reports\\AD_AdminCount_$(Get-Date -Format yyyyMMdd).csv\"\r\n$Results = @()\r\n\r\n# T&uuml;m adminCount=1 nesneleri bul\r\n$AdminUsers = Get-ADUser -LDAPFilter \"(adminCount=1)\" `\r\n    -Properties adminCount, MemberOf, WhenChanged, LastLogonDate\r\n\r\nforeach ($User in $AdminUsers) {\r\n    $Groups = ($User.MemberOf | ForEach-Object {\r\n        ($_ -split ',')[0] -replace 'CN='\r\n    }) -join '; '\r\n    \r\n    $Results += [PSCustomObject]@{\r\n        Name = $User.Name\r\n        SamAccountName = $User.samAccountName\r\n        adminCount = $User.adminCount\r\n        Grup_Uyeligikleri = $Groups\r\n        Son_Degistirilme = $User.WhenChanged\r\n        Son_Giris = $User.LastLogonDate\r\n        Aktif_Mi = if ($User.LastLogonDate -gt (Get-Date).AddDays(-30)) { \"Evet\" } else { \"Hayir\" }\r\n    }\r\n}\r\n\r\n$Results | Export-Csv -Path $ReportPath -Encoding UTF8 -NoTypeInformation\r\nWrite-Host \"Rapor: $ReportPath\"\r\n<\/code><\/pre>\r\n<p><strong>Kontrol Listesi:<\/strong><\/p>\r\n<ul>\r\n<li>[ ] T&uuml;m adminCount=1 kullan\u0131c\u0131lar listelenmi\u015f<\/li>\r\n<li>[ ] Her kullan\u0131c\u0131 i&ccedil;in grup &uuml;yelikleri kontrol edilmi\u015f<\/li>\r\n<li>[ ] Orfa kalan (bo\u015f grup) kullan\u0131c\u0131lar tespit edilmi\u015f<\/li>\r\n<li>[ ] Ayl\u0131k rapor trend analizi yap\u0131lm\u0131\u015f<\/li>\r\n<\/ul>\r\n<hr>\r\n<h3>B. adminCount Temizli\u011fi (Ayl\u0131k)<\/h3>\r\n<pre><code class=\"language-powershell\"># Script: Cleanup_adminCount.ps1\r\n\r\n# &Ouml;NEML\u0130: Bu script'i &ccedil;al\u0131\u015ft\u0131rmadan &Ouml;NCE\r\n# 1. Backup al\r\n# 2. Test ortam\u0131nda dene\r\n# 3. \u0130\u015f saati d\u0131\u015f\u0131nda &ccedil;al\u0131\u015ft\u0131r\r\n\r\nfunction Remove-OrphanedAdminCount {\r\n    param(\r\n        [switch]$WhatIf\r\n    )\r\n    \r\n    $AdminUsers = Get-ADUser -LDAPFilter \"(adminCount=1)\" `\r\n        -Properties adminCount, MemberOf\r\n    \r\n    $ProtectedGroups = @(\r\n        'Domain Admins',\r\n        'Enterprise Admins',\r\n        'Schema Admins',\r\n        'Account Operators',\r\n        'Backup Operators',\r\n        'Print Operators',\r\n        'Server Operators',\r\n        'Replicator'\r\n    )\r\n    \r\n    $Cleaned = 0\r\n    \r\n    foreach ($User in $AdminUsers) {\r\n        # Kullan\u0131c\u0131n\u0131n korunan grup &uuml;yeli\u011fini kontrol et\r\n        $InProtectedGroup = $false\r\n        \r\n        foreach ($Group in $ProtectedGroups) {\r\n            try {\r\n                $GroupMembers = Get-ADGroupMember -Identity $Group -Recursive -ErrorAction Stop\r\n                if ($GroupMembers | Where-Object { $_.objectGUID -eq $User.objectGUID }) {\r\n                    $InProtectedGroup = $true\r\n                    break\r\n                }\r\n            } catch {\r\n                # Grup bulunamad\u0131, devam et\r\n            }\r\n        }\r\n        \r\n        # E\u011fer korunan grupta de\u011filse, adminCount'u kald\u0131r\r\n        if (-not $InProtectedGroup) {\r\n            Write-Host \"Temizleniyor: $($User.Name) (adminCount kald\u0131r\u0131lacak)\"\r\n            \r\n            if ($WhatIf) {\r\n                Write-Host \"  [PREVIEW] Set-ADObject -Identity $($User.DistinguishedName) -Clear adminCount\"\r\n            } else {\r\n                Set-ADObject -Identity $User.DistinguishedName -Clear adminCount -Confirm:$false\r\n                $Cleaned++\r\n            }\r\n        }\r\n    }\r\n    \r\n    Write-Host \"Toplam temizlenen: $Cleaned\"\r\n}\r\n\r\n# Kullan\u0131m:\r\n# 1. &Ouml;nce WhatIf ile g&ouml;z at\r\nRemove-OrphanedAdminCount -WhatIf\r\n\r\n# 2. Sonra ger&ccedil;ekten &ccedil;al\u0131\u015ft\u0131r\r\nRemove-OrphanedAdminCount\r\n<\/code><\/pre>\r\n<p><strong>Kontrol Listesi:<\/strong><\/p>\r\n<ul>\r\n<li>[ ] Backup al\u0131nd\u0131 (AD snapshot\/export)<\/li>\r\n<li>[ ] Test ortam\u0131nda &ccedil;al\u0131\u015ft\u0131r\u0131ld\u0131<\/li>\r\n<li>[ ] WhatIf parametresi ile &ouml;nizleme yap\u0131ld\u0131<\/li>\r\n<li>[ ] Log dosyas\u0131 kaydedildi<\/li>\r\n<li>[ ] Denetim izleri kontrol edildi<\/li>\r\n<\/ul>\r\n<hr>\r\n<h3>C. AdminSDHolder Kontrol (Ayl\u0131k Denetim)<\/h3>\r\n<pre><code class=\"language-powershell\"># Script: Audit_AdminSDHolder.ps1\r\n\r\nfunction Audit-AdminSDHolder {\r\n    $AdminSDPath = \"CN=AdminSDHolder,CN=System,DC=$(($env:USERDNSDOMAIN -split '\\.' | ForEach-Object { \"DC=$_\" }) -join ',')\"\r\n    \r\n    Write-Host \"AdminSDHolder Denetimi: $AdminSDPath\" -ForegroundColor Green\r\n    \r\n    # 1. AdminSDHolder'\u0131n ACL'ini oku\r\n    $AdminSDObj = Get-ADObject -Identity $AdminSDPath -Properties nTSecurityDescriptor\r\n    $ACL = $AdminSDObj.nTSecurityDescriptor\r\n    \r\n    Write-Host \"`n=== ACL \u0130&ccedil;eri\u011fi ===\" -ForegroundColor Cyan\r\n    $ACL.Access | Format-Table @{\r\n        L='Kimlik'; E={$_.IdentityReference}\r\n    }, @{\r\n        L='Haklar'; E={$_.ActiveDirectoryRights}\r\n    }, @{\r\n        L='T&uuml;r'; E={$_.AccessControlType}\r\n    } -AutoSize\r\n    \r\n    # 2. ACL'in varsay\u0131lan olup olmad\u0131\u011f\u0131n\u0131 kontrol et\r\n    $DefaultACEs = @(\r\n        'NT AUTHORITY\\SYSTEM',\r\n        'BUILTIN\\Administrators',\r\n        'OWNER RIGHTS'\r\n    )\r\n    \r\n    $UnexpectedACEs = $ACL.Access | Where-Object {\r\n        -not ($_.IdentityReference.Value -match ($DefaultACEs -join '|'))\r\n    }\r\n    \r\n    if ($UnexpectedACEs) {\r\n        Write-Host \"`n UYARI: Beklenmeyen ACL'ler bulundu!\" -ForegroundColor Red\r\n        $UnexpectedACEs | Format-Table IdentityReference, ActiveDirectoryRights\r\n    } else {\r\n        Write-Host \"`n ACL normal g&ouml;r&uuml;n&uuml;yor\" -ForegroundColor Green\r\n    }\r\n    \r\n    # 3. SDProp &ccedil;al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131n\u0131 kontrol et\r\n    $SDPropTime = (Get-ADDomainController | Get-ADReplicationPartnerMetadata -Target (Get-ADDomain).DNSRoot).ReplicationSchedule\r\n    Write-Host \"`nSDProp Periyodu: Varsay\u0131lan 3600 saniye (1 saat)\" -ForegroundColor Cyan\r\n    \r\n    # 4. Korunan grup &uuml;yelerinin ACL'ini kontrol et\r\n    Write-Host \"`n=== Korunan Grup &Uuml;yelerinin ACL Kontrol&uuml; ===\" -ForegroundColor Cyan\r\n    \r\n    $DomainAdmins = Get-ADGroup -Identity \"Domain Admins\"\r\n    $DomainAdminsACL = Get-ADObject -Identity $DomainAdmins.DistinguishedName -Properties nTSecurityDescriptor\r\n    \r\n    $ACLsSame = $null -eq (Compare-Object -ReferenceObject $AdminSDObj.nTSecurityDescriptor.Access `\r\n                                          -DifferenceObject $DomainAdminsACL.nTSecurityDescriptor.Access)\r\n    \r\n    if ($ACLsSame) {\r\n        Write-Host \"\u2705 Domain Admins ACL'i, AdminSDHolder ile e\u015fle\u015fiyor (normal)\" -ForegroundColor Green\r\n    } else {\r\n        Write-Host \"\u26a0\ufe0f UYARI: Domain Admins ACL'i farkl\u0131! SDProp'u yeniden &ccedil;al\u0131\u015ft\u0131rmay\u0131 deneyin.\" -ForegroundColor Red\r\n    }\r\n}\r\n\r\n# Kullan\u0131m\r\nAudit-AdminSDHolder\r\n<\/code><\/pre>\r\n<p><strong>Kontrol Listesi:<\/strong><\/p>\r\n<ul>\r\n<li>[ ] AdminSDHolder ACL'i varsay\u0131lan durumda<\/li>\r\n<li>[ ] Korunan gruplar ACL'i AdminSDHolder ile e\u015fle\u015fiyor<\/li>\r\n<li>[ ] SDProp periyodu 3600 saniye (varsay\u0131lan)<\/li>\r\n<li>[ ] Denetim raporu olu\u015fturuldu<\/li>\r\n<\/ul>\r\n<hr>\r\n<h3>D. OU Delegasyonu Olu\u015fturma (Kurulum A\u015famas\u0131)<\/h3>\r\n<pre><code class=\"language-powershell\"># Script: Setup_OU_Delegation.ps1\r\n\r\nfunction New-OUWithDelegation {\r\n    param(\r\n        [Parameter(Mandatory)][string]$OUName,\r\n        [Parameter(Mandatory)][string]$ParentOU,\r\n        [Parameter(Mandatory)][string]$DelegateGroupName,\r\n        [string[]]$Permissions = @('User Accounts', 'Reset Password')\r\n    )\r\n    \r\n    # 1. OU olu\u015ftur\r\n    $OUPath = \"OU=$OUName,$ParentOU\"\r\n    try {\r\n        New-ADOrganizationalUnit -Name $OUName -Path $ParentOU -ProtectedFromAccidentalDeletion $true\r\n        Write-Host \"\u2705 OU olu\u015fturuldu: $OUPath\"\r\n    } catch {\r\n        Write-Host \" OU olu\u015fturma hatas\u0131: $_\"\r\n        return\r\n    }\r\n    \r\n    # 2. Delegasyon Grubu olu\u015ftur\r\n    try {\r\n        New-ADGroup -Name $DelegateGroupName -GroupScope DomainLocal -GroupCategory Security -Path $ParentOU\r\n        Write-Host \" Delegasyon Grubu olu\u015fturuldu: $DelegateGroupName\"\r\n    } catch {\r\n        Write-Host \" Grup olu\u015fturma hatas\u0131: $_\"\r\n        return\r\n    }\r\n    \r\n    # 3. Delegasyon Yap (GUI ile veya dsacls ile)\r\n    Write-Host \"`n Delegasyon Ad\u0131mlar\u0131:\"\r\n    Write-Host \"   1. Active Directory Users and Computers'\u0131 a&ccedil;\"\r\n    Write-Host \"   2. $OUPath - Sa\u011f T\u0131kla - 'Delegate Control'\"\r\n    Write-Host \"   3. $DelegateGroupName'i se&ccedil;\"\r\n    Write-Host \"   4. A\u015fa\u011f\u0131daki izinleri se&ccedil;:\"\r\n    foreach ($Perm in $Permissions) {\r\n        Write-Host \"      - $Perm\"\r\n    }\r\n    \r\n    # Alternatif: dsacls ile (ileri kullan\u0131c\u0131lar i&ccedil;in)\r\n    # dsacls.exe \"$OUPath\" \/G \"CONTOSO\\$DelegateGroupName:CCCCDA\"\r\n}\r\n\r\n# &Ouml;rnek Kullan\u0131m:\r\n# Tier 1 Sunucu OU'su\r\nNew-OUWithDelegation `\r\n    -OUName \"Servers\" `\r\n    -ParentOU \"OU=Tier1,DC=contoso,DC=com\" `\r\n    -DelegateGroupName \"Tier1_ServerAdmins\" `\r\n    -Permissions @('User Accounts', 'Reset Password', 'Manage Group Membership')\r\n\r\n# Tier 2 Aplikasyon OU'su\r\nNew-OUWithDelegation `\r\n    -OUName \"Applications\" `\r\n    -ParentOU \"OU=Tier2,DC=contoso,DC=com\" `\r\n    -DelegateGroupName \"Tier2_AppAdmins\" `\r\n    -Permissions @('User Accounts', 'Reset Password')\r\n<\/code><\/pre>\r\n<p><strong>Kontrol Listesi:<\/strong><\/p>\r\n<ul>\r\n<li>[ ] OU yap\u0131s\u0131 Tier modeline uygun planland\u0131<\/li>\r\n<li>[ ] Delegasyon Gruplar\u0131 olu\u015fturuldu<\/li>\r\n<li>[ ] \u0130zinler minimuma indirildi (Least Privilege)<\/li>\r\n<li>[ ] Belgeler olu\u015fturuldu (Kim, Ne, Ne Zaman)<\/li>\r\n<\/ul>\r\n<hr>\r\n<h3>E. Ayl\u0131k Raporlama (Zorunlu!)<\/h3>\r\n<pre class=\"language-python\"><code># Script: Generate_Monthly_Report.ps1\r\n\r\nfunction Get-ADMonthlyReport {\r\n    param(\r\n        [int]$Days = 30\r\n    )\r\n    \r\n    $StartDate = (Get-Date).AddDays(-$Days)\r\n    $ReportPath = \"C:\\Reports\\AD_Monthly_Report_$(Get-Date -Format yyyyMM).html\"\r\n    \r\n    # 1. adminCount Raporu\r\n    $AdminCountUsers = Get-ADUser -LDAPFilter \"(adminCount=1)\" `\r\n        -Properties adminCount, MemberOf, WhenChanged, LastLogonDate\r\n    \r\n    # 2. Yeni Eklenmi\u015f Admins\r\n    $NewAdmins = $AdminCountUsers | Where-Object { $_.WhenChanged -gt $StartDate }\r\n    \r\n    # 3. Orfa Kalan Admins\r\n    $OrphanedAdmins = $AdminCountUsers | Where-Object {\r\n        ($_.MemberOf -join '').Length -eq 0\r\n    }\r\n    \r\n    # 4. Etkinlik Olmayan Admins (30+ g&uuml;n)\r\n    $InactiveAdmins = $AdminCountUsers | Where-Object {\r\n        $_.LastLogonDate -lt $StartDate\r\n    }\r\n    \r\n    # HTML Rapor\r\n    $HTML = @\"\r\n    \r\n    \r\n    \r\n        \r\n        \r\n    \r\n    \r\n        <\/code><\/pre>\r\n<h1>Active Directory Ayl\u0131k Rapor<\/h1>\r\n<pre class=\"language-python\"><code>\r\n        <\/code><\/pre>\r\n<p><strong>Raporlama Tarihi:<\/strong> $(Get-Date -Format 'dd.MM.yyyy')<\/p>\r\n<pre class=\"language-python\"><code>\r\n        <\/code><\/pre>\r\n<p><strong>D&ouml;nem:<\/strong> Son $Days G&uuml;n<\/p>\r\n<pre class=\"language-python\"><code>\r\n        \r\n        <\/code><\/pre>\r\n<h2>&Ouml;zet \u0130statistikler<\/h2>\r\n<pre class=\"language-python\"><code>\r\n        <\/code><\/pre>\r\n<ul>\r\n<li>&nbsp;<\/li>\r\n<li>Toplam Admin: $($AdminCountUsers.Count)<\/li>\r\n<li>&nbsp;<\/li>\r\n<li>Yeni Eklenenler: $($NewAdmins.Count)<\/li>\r\n<li>&nbsp;<\/li>\r\n<li>Orfa Kalanlar: $($OrphanedAdmins.Count)<\/li>\r\n<li>&nbsp;<\/li>\r\n<li>Etkinlik Olmayan (30+ g&uuml;n): $($InactiveAdmins.Count)<\/li>\r\n<li>&nbsp;<\/li>\r\n<\/ul>\r\n<pre class=\"language-python\"><code>\r\n        \r\n        <\/code><\/pre>\r\n<h2>Orfa Kalan Adminler (ACTION REQUIRED!)<\/h2>\r\n<pre class=\"language-python\"><code>\r\n        \r\n            $(\r\n                $OrphanedAdmins | ForEach-Object {\r\n                    \"\"\r\n                }\r\n            )\r\n        <\/code><\/pre>\r\n<table>\r\n<tbody>\r\n<tr>\r\n<th>\u0130sim<\/th>\r\n<th>Hesap<\/th>\r\n<th>Son De\u011fi\u015fiklik<\/th>\r\n<\/tr>\r\n<tr class=\"danger\">\r\n<td>$($_.Name)<\/td>\r\n<td>$($_.samAccountName)<\/td>\r\n<td>$($_.WhenChanged)<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<pre class=\"language-python\"><code>\r\n        \r\n        <\/code><\/pre>\r\n<h2>Yeni Eklenenler<\/h2>\r\n<pre class=\"language-python\"><code>\r\n        \r\n            $(\r\n                $NewAdmins | ForEach-Object {\r\n                    $Groups = ($_.MemberOf | ForEach-Object { ($_ -split ',')[0] -replace 'CN=' }) -join '; '\r\n                    \"\"\r\n                }\r\n            )\r\n        <\/code><\/pre>\r\n<table>\r\n<tbody>\r\n<tr>\r\n<th>\u0130sim<\/th>\r\n<th>Grup<\/th>\r\n<th>Eklenme Tarihi<\/th>\r\n<\/tr>\r\n<tr>\r\n<td>$($_.Name)<\/td>\r\n<td>$Groups<\/td>\r\n<td>$($_.WhenChanged)<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<pre class=\"language-python\"><code>\r\n        \r\n        <\/code><\/pre>\r\n<h2>Etkinlik Olmayan Adminler (30+ g&uuml;n)<\/h2>\r\n<pre class=\"language-python\"><code>\r\n        \r\n            $(\r\n                $InactiveAdmins | ForEach-Object {\r\n                    $DaysInactive = ((Get-Date) - $_.LastLogonDate).Days\r\n                    \"\"\r\n                }\r\n            )\r\n        <\/code><\/pre>\r\n<table>\r\n<tbody>\r\n<tr>\r\n<th>\u0130sim<\/th>\r\n<th>Son Giri\u015f<\/th>\r\n<th>G&uuml;n Say\u0131s\u0131<\/th>\r\n<\/tr>\r\n<tr class=\"warning\">\r\n<td>$($_.Name)<\/td>\r\n<td>$($_.LastLogonDate)<\/td>\r\n<td>$DaysInactive<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<pre class=\"language-python\"><code>\r\n        \r\n        <\/code><\/pre>\r\n<hr>\r\n<pre class=\"language-python\"><code>\r\n        <\/code><\/pre>\r\n<p><em>Rapor otomatik olarak olu\u015fturulmu\u015ftur. Kontrol ve onay gereklidir.<\/em><\/p>\r\n<pre class=\"language-python\"><code>\r\n    \r\n    \r\n\"@\r\n    \r\n    $HTML | Out-File -Path $ReportPath -Encoding UTF8\r\n    Write-Host \"Rapor olu\u015fturuldu: $ReportPath\"\r\n    \r\n    # Email ile g&ouml;nder (iste\u011fe ba\u011fl\u0131)\r\n    # Send-MailMessage -From 'ad-reports@contoso.com' -To 'admins@contoso.com' ...\r\n}\r\n\r\n# Kullan\u0131m\r\nGet-ADMonthlyReport -Days 30<\/code><\/pre>\r\n<p>&nbsp;<\/p>\r\n<h6><span style=\"color: rgb(0, 0, 0);\">Kontrol Listesi:<\/span><\/h6>\r\n<ul>\r\n<li>[ ] Rapor otomatik olarak olu\u015fturuluyor (Task Scheduler)<\/li>\r\n<li>[ ] \u0130\u015fe yaramayan adminler vurgul\u0131 \u015fekilde g&ouml;steriliyor<\/li>\r\n<li>[ ] Rapor y&ouml;neticilere g&ouml;nderiliyor<\/li>\r\n<li>[ ] Denetim izleri tutana\u011f\u0131na kaydediliyor<\/li>\r\n<\/ul>\r\n<hr>\r\n<h2>Shadow Admin Av\u0131: BloodHound + PingCastle<\/h2>\r\n<h3>Shadow Admin Nedir?<\/h3>\r\n<p><strong>Shadow Admin<\/strong>, resmi olmayan y&ouml;netim yetkilerine sahip hesapt\u0131r:<\/p>\r\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n\u2502    SHADOW ADMIN &Ouml;RNEKLERI                  \u2502\r\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\r\n\u2502 \u274c User1 - Domain Admins'de g&ouml;z&uuml;km&uuml;yor    \u2502\r\n\u2502    \u2713 Ama OrgUnit'te \"Yazma\" yetkisine     \u2502\r\n\u2502      sahip (Delegasyon arac\u0131l\u0131\u011f\u0131yla)      \u2502\r\n\u2502                                             \u2502\r\n\u2502 \u274c ServiceAccount - Resmi admin de\u011fil      \u2502\r\n\u2502    \u2713 Ama GenericAll hakk\u0131 nedeniyle       \u2502\r\n\u2502      Domain Admins'e ekleyebiliyor         \u2502\r\n\u2502                                             \u2502\r\n\u2502 \u274c Printer Admin - Sadece yaz\u0131c\u0131 y&ouml;netmeli \u2502\r\n\u2502    \u2713 Ama Schema Admins grubunun ACL'ini   \u2502\r\n\u2502      de\u011fi\u015ftirebildi (hata m\u0131?)            \u2502\r\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n<\/code><\/pre>\r\n<h3>BloodHound \u0130le Tarama<\/h3>\r\n<p>BloodHound, AD'de yetki yollar\u0131n\u0131 g&ouml;rselle\u015ftirir. Kurulum:<\/p>\r\n<pre><code class=\"language-bash\"># 1. BloodHound Community Edition'\u0131 indir\r\n# https:\/\/github.com\/BloodHoundAD\/BloodHound\/releases\r\n\r\n# 2. Neo4j Graph Database kur\r\ndocker run --name neo4j -p 7474:7474 -p 7687:7687 \\\r\n    -e NEO4J_AUTH=neo4j\/password \\\r\n    neo4j:5.10\r\n\r\n# 3. SharpHound Collector &ccedil;al\u0131\u015ft\u0131r (AD sunucusunda)\r\n# SharpHound.exe -c All -d contoso.com -OutputDirectory C:\\Temp\r\n\r\n# 4. \u0130ndir ve BloodHound'a y&uuml;kle\r\n<\/code><\/pre>\r\n<p><strong>BloodHound ile Shadow Admin Bulma:<\/strong><\/p>\r\n<pre><code>Analiz Ad\u0131mlar\u0131:\r\n\r\n1. Collector &ccedil;al\u0131\u015ft\u0131r\r\n   SharpHound.exe -c All --outputdirectory C:\\temp\r\n\r\n2. Dosyalar\u0131 BloodHound'a y&uuml;kle\r\n   - JSON dosyalar\u0131n\u0131 se&ccedil;\r\n   - Upload\r\n\r\n3. Queryleri &ccedil;al\u0131\u015ft\u0131r:\r\n   \u251c\u2500 \"Find Dangerous Rights\"\r\n   \u251c\u2500 \"Find AD Abuse Paths to High Value Targets\"\r\n   \u251c\u2500 \"Find Dangerous ACL Permissions\"\r\n   \u251c\u2500 \"Domain Dominance\" (ileri)\r\n   \u2514\u2500 \"Find all Nodes - One Way Trust Relationships\"\r\n\r\n4. Sonu&ccedil;: Grafikte k\u0131rm\u0131z\u0131 yollar = Riski yol (kimler admin olabilir?)\r\n<\/code><\/pre>\r\n<h3>PingCastle \u0130le Rapor<\/h3>\r\n<p>PingCastle, AD sa\u011fl\u0131\u011f\u0131n\u0131 denetler:<\/p>\r\n<pre><code class=\"language-powershell\"># 1. PingCastle.exe'yi indir\r\n# https:\/\/www.pingcastle.com\/\r\n\r\n# 2. Admin olarak &ccedil;al\u0131\u015ft\u0131r\r\n.\\PingCastle.exe -healthcheck -domain contoso.com\r\n\r\n# 3. HTML rapor olu\u015fur: PingCastleReport_contoso.html\r\n\r\n# Kritik Kontroller:\r\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n# \u251c\u2500 \"Detect unregistered users\"              (Orfa admin yok mu?)\r\n# \u251c\u2500 \"Dangerous ACLs\"                         (Tehlikeli izinler)\r\n# \u251c\u2500 \"Delegated Admins\"                       (Yetki verilen adminler)\r\n# \u251c\u2500 \"Service Accounts Not Delegated\"         (Hizmet hesaplar\u0131 kontrol)\r\n# \u2514\u2500 \"Protected Groups Have Weak Accounts\"    (Korunan gruplar g&uuml;vensiz mi?)\r\n<\/code><\/pre>\r\n<h3>Otomatik Shadow Admin Taramas\u0131<\/h3>\r\n<pre><code class=\"language-powershell\"># Script: Find_Shadow_Admins.ps1\r\n\r\nfunction Find-ShadowAdmins {\r\n    Write-Host \"Shadow Admin Taramas\u0131 Ba\u015flad\u0131...\" -ForegroundColor Cyan\r\n    \r\n    # 1. Korunan grup &uuml;yelerini getir\r\n    $ProtectedGroups = @('Domain Admins', 'Enterprise Admins', 'Schema Admins', 'Account Operators')\r\n    $AdminUsers = @()\r\n    \r\n    foreach ($Group in $ProtectedGroups) {\r\n        Get-ADGroupMember -Identity $Group -Recursive | \r\n            Where-Object { $_.objectClass -eq 'user' } | \r\n            ForEach-Object { $AdminUsers += $_ }\r\n    }\r\n    \r\n    Write-Host \" Resmi admin say\u0131s\u0131: $($AdminUsers.Count)\"\r\n    \r\n    # 2. Tehlikeli ACL'leri bul\r\n    Write-Host \"`n Tehlikeli ACL'ler taran\u0131yor...\"\r\n    \r\n    $SuspiciousACEs = @()\r\n    \r\n    # OU'lar\u0131 tara\r\n    $OUs = Get-ADOrganizationalUnit -Filter * | Select-Object -First 50\r\n    \r\n    foreach ($OU in $OUs) {\r\n        try {\r\n            $ACL = Get-Acl \"AD:\\$($OU.DistinguishedName)\"\r\n            \r\n            # GenericAll, GenericWrite, WriteDacl gibi tehlikeli izinleri bul\r\n            $DangerousACEs = $ACL.Access | Where-Object {\r\n                ($_.ActiveDirectoryRights -like '*GenericAll*') -or\r\n                ($_.ActiveDirectoryRights -like '*GenericWrite*') -or\r\n                ($_.ActiveDirectoryRights -like '*WriteDacl*') -or\r\n                ($_.ActiveDirectoryRights -like '*WriteProperty*')\r\n            }\r\n            \r\n            foreach ($ACE in $DangerousACEs) {\r\n                # E\u011fer resmi admin de\u011filse, shadow admin olabilir\r\n                if ($AdminUsers | Where-Object { $_.SID -eq $ACE.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]) }) {\r\n                    # Resmi admin, skip\r\n                } else {\r\n                    $SuspiciousACEs += [PSCustomObject]@{\r\n                        OU = $OU.Name\r\n                        Identity = $ACE.IdentityReference\r\n                        Rights = $ACE.ActiveDirectoryRights\r\n                        AccessType = $ACE.AccessControlType\r\n                        ObjectType = $ACE.ObjectType\r\n                    }\r\n                }\r\n            }\r\n        } catch {\r\n            # OU eri\u015fim hatas\u0131, devam et\r\n        }\r\n    }\r\n    \r\n    if ($SuspiciousACEs.Count -gt 0) {\r\n        Write-Host \"`n UYARI: $($SuspiciousACEs.Count) \u015f&uuml;pheli ACL bulundu!\" -ForegroundColor Red\r\n        $SuspiciousACEs | Format-Table OU, Identity, Rights -AutoSize\r\n    } else {\r\n        Write-Host \"`n \u015e&uuml;pheli ACL bulunamad\u0131\" -ForegroundColor Green\r\n    }\r\n    \r\n    # 3. Delegasyon Grubuna Sahip Kullan\u0131c\u0131lar\u0131 Bul\r\n    Write-Host \"`n &Ouml;zel delegasyon gruplar\u0131 taran\u0131yor...\"\r\n    \r\n    $DelegationGroups = Get-ADGroup -Filter { Name -like '*Admin*' -or Name -like '*Delegate*' } -Properties Members | \r\n        Where-Object { $_.DistinguishedName -like '*OU=*' } # Sadece OU'daki gruplar\r\n    \r\n    foreach ($Group in $DelegationGroups) {\r\n        $Members = Get-ADGroupMember -Identity $Group -Recursive\r\n        Write-Host \"  \u2514\u2500 $($Group.Name): $($Members.Count) &uuml;ye\"\r\n    }\r\n}\r\n\r\n# Kullan\u0131m\r\nFind-ShadowAdmins\r\n<\/code><\/pre>\r\n<hr>\r\n<h2>Kaynaklar &amp; \u0130leri Okuma<\/h2>\r\n<h3>Microsoft Resmi Kaynaklar<\/h3>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>Kaynak<\/th>\r\n<th>URL<\/th>\r\n<th>\u0130&ccedil;erik<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>Tier Model<\/strong><\/td>\r\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/plan\/security-best-practices\/securing-domain-controllers-against-attack\">Microsoft Docs<\/a><\/td>\r\n<td>Tier 0\/1\/2 mimarisi<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>AdminSDHolder<\/strong><\/td>\r\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/plan\/security-best-practices\/appendix-m-document-sensitive-accounts-and-groups\">Microsoft Docs<\/a><\/td>\r\n<td>AdminSDHolder detayl\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Protected Groups<\/strong><\/td>\r\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/plan\/security-best-practices\/appendix-c--protected-accounts-and-groups-in-active-directory\">Microsoft Docs<\/a><\/td>\r\n<td>Korunan gruplar listesi<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Delegation<\/strong><\/td>\r\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/delegate-the-authority-to-administer-default-containers-and-ous\">Microsoft Docs<\/a><\/td>\r\n<td>OU delegasyonu rehberi<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h3>A&ccedil;\u0131k Kaynak Ara&ccedil;lar<\/h3>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>Ara&ccedil;<\/th>\r\n<th>Kullan\u0131m<\/th>\r\n<th>Download<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>BloodHound<\/strong><\/td>\r\n<td>Shadow Admin av\u0131, ACL analizi<\/td>\r\n<td>https:\/\/github.com\/BloodHoundAD\/BloodHound<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>PingCastle<\/strong><\/td>\r\n<td>AD sa\u011fl\u0131k raporu, denetim<\/td>\r\n<td>https:\/\/www.pingcastle.com\/<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>ADExplorer<\/strong><\/td>\r\n<td>AD tarama ve ACL denetimi<\/td>\r\n<td>https:\/\/docs.microsoft.com\/en-us\/sysinternals\/<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Get-ADGroupChanges<\/strong><\/td>\r\n<td>Grup de\u011fi\u015fiklikleri izleme<\/td>\r\n<td>GitHub (&ccedil;e\u015fitli)<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h3>G&uuml;venlik Bloglar\u0131<\/h3>\r\n<ul>\r\n<li><strong>https:\/\/specterops.io\/<\/strong> - Yetki y&ouml;netimi uzmanlar\u0131<\/li>\r\n<li><strong>https:\/\/www.harmj0y.net\/blog\/<\/strong> - Active Directory g&uuml;venli\u011fi (ileri)<\/li>\r\n<li><strong>https:\/\/docs.microsoft.com\/en-us\/windows-server\/identity\/<\/strong> - Resmi Microsoft<\/li>\r\n<\/ul>\r\n<h3>Kitaplar<\/h3>\r\n<ul>\r\n<li>\"Active Directory Cookbook\" - Laura E. Hunter (klasik)<\/li>\r\n<li>\"The Hacker Playbook 3\" - Peter Kim (AD sald\u0131r\u0131lar\u0131)<\/li>\r\n<li>\"Securing Active Directory for the Real World\" - Erdal Ozkaya<\/li>\r\n<\/ul>\r\n<hr>\r\n<h2>Son Kontrol Listesi: T&uuml;m Ad\u0131mlar<\/h2>\r\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n\u2502         ACTIVE DIRECTORY G&Uuml;VENL\u0130 DELEGASYON CHECKLIST        \u2502\r\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\r\n\r\n\u2705 HAFTALIK G&Ouml;REVLER\r\n \u25a1 adminCount raporu olu\u015ftur ve g&ouml;zden ge&ccedil;ir\r\n \u25a1 Orfa admin olup olmad\u0131\u011f\u0131n\u0131 kontrol et\r\n \u25a1 Yeni admin eklentisini denetim g&uuml;nl&uuml;\u011f&uuml;ne kaydet\r\n \u25a1 Shadow admin av\u0131 &ccedil;al\u0131\u015ft\u0131r (BloodHound)\r\n\r\n\u2705 AYLIK G&Ouml;REVLER\r\n \u25a1 HTML raporu olu\u015ftur ve y&ouml;neticilere g&ouml;nder\r\n \u25a1 adminCount temizli\u011fini &ccedil;al\u0131\u015ft\u0131r (orfa kalanlar\u0131 kald\u0131r)\r\n \u25a1 AdminSDHolder ACL'ini denetle\r\n \u25a1 PingCastle raporu olu\u015ftur\r\n \u25a1 Delegasyon belgelerini g&uuml;ncelle\r\n\r\n\u2705 &Ccedil;EYREK YIL G&Ouml;REVLER\u0130\r\n \u25a1 Tier model uyumlulu\u011funu g&ouml;zden ge&ccedil;ir\r\n \u25a1 OU delegasyonunun h&acirc;l&acirc; uygun oldu\u011funu kontrol et\r\n \u25a1 Account Operators kullan\u0131m\u0131n\u0131 s\u0131f\u0131rla\r\n \u25a1 Break Glass hesaplar\u0131n\u0131 test et (g&uuml;venli ortamda)\r\n\r\n\u2705 YILLIK G&Ouml;REVLER\r\n \u25a1 T&uuml;m admin hesaplar\u0131n\u0131 denetim yapan d\u0131\u015f ekip taraf\u0131ndan do\u011frula\r\n \u25a1 Security Assessment yapmaz\r\n \u25a1 Tier Model'i g&uuml;ncel hale getir\r\n \u25a1 Disaster Recovery plan\u0131n\u0131 test et\r\n \u25a1 Y&ouml;netici e\u011fitimi d&uuml;zenle\r\n\r\n\u2705 KR\u0130T\u0130K KURALLARI KONTROL ET\r\n \u25a1 AdminSDHolder ACL'i B\u0130R KEZ DAHA DE\u011eI\u015eMEDI\r\n \u25a1 Account Operators grubu KULLANILMIYOR\r\n \u25a1 Delegasyon SADECE OU seviyesinde\r\n \u25a1 TIER 0 hesaplar\u0131 2-3 adet ve MFA'l\u0131\r\n \u25a1 Break Glass hesaplar\u0131 var ve g&uuml;vende (vault)\r\n \u25a1 Ayl\u0131k raporlama ZORUNLU hale getirildi\r\n \u25a1 BloodHound \/ PingCastle raporlar\u0131 d&uuml;zenli al\u0131n\u0131yor\r\n\r\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n<\/code><\/pre>\r\n<hr>\r\n<h2>Ba\u015flamak \u0130&ccedil;in \u0130lk 24 Saat<\/h2>\r\n<h3>Saat 0-2: Envanter<\/h3>\r\n<pre><code class=\"language-powershell\"># Step 1\r\nGet-ADUser -LDAPFilter \"(adminCount=1)\" -Properties MemberOf, WhenChanged | \r\n    Export-Csv -Path \"C:\\Backup\\admincount_baseline.csv\"\r\n<\/code><\/pre>\r\n<h3>Saat 2-4: AdminSDHolder Denetimi<\/h3>\r\n<pre><code class=\"language-powershell\"># Step 2\r\nAudit-AdminSDHolder  # (Yukar\u0131daki script)\r\n<\/code><\/pre>\r\n<h3>Saat 4-8: Temizlik Planlamas\u0131<\/h3>\r\n<pre><code class=\"language-powershell\"># Step 3\r\nRemove-OrphanedAdminCount -WhatIf  # Sadece preview!\r\n<\/code><\/pre>\r\n<h3>Saat 8-24: Dokumentasyon<\/h3>\r\n<ul>\r\n<li>Mevcut durumu belgele<\/li>\r\n<li>Y&ouml;neticileri bilgilendir<\/li>\r\n<li>De\u011fi\u015fim y&ouml;netimi politikas\u0131 olu\u015ftur<\/li>\r\n<\/ul>\r\n<hr>\r\n<p>Active Directory'de admin hakk\u0131 y&ouml;netimi&nbsp;<strong>basit g&ouml;r&uuml;nse de<\/strong>, <strong>ya\u015fad\u0131\u011f\u0131 zaman<\/strong> &ccedil;ok karma\u015f\u0131k hale gelebilir. Bu rehberin temel ilkeleri:<\/p>\r\n<ol>\r\n<li><strong>adminCount'u Anlay\u0131n<\/strong> - Otomatik ama kal\u0131c\u0131 de\u011fildir<\/li>\r\n<li><strong>AdminSDHolder'\u0131 Sak\u0131n<\/strong> - Asla de\u011fi\u015ftirmeyin!<\/li>\r\n<li><strong>OU Delegasyonu Yap\u0131n<\/strong> - Korunan gruplar\u0131 de\u011fil, OU'lar\u0131 delegeyin<\/li>\r\n<li><strong>Tier Model \u0130zleyin<\/strong> - Tier 0, 1, 2 ayr\u0131m\u0131n\u0131 net yap\u0131n<\/li>\r\n<li><strong>Ayl\u0131k Rapor Tutun<\/strong> - Denetim i&ccedil;in zorunlu<\/li>\r\n<li><strong>Otomatize Edin<\/strong> - Script'ler zaman\u0131 kurtar\u0131r<\/li>\r\n<li><strong>Tool Kullan\u0131n<\/strong> - BloodHound ve PingCastle hayat kurtar\u0131r<\/li>\r\n<\/ol>\r\n<p><strong>Ba\u015far\u0131, g&uuml;nl&uuml;k disiplin ve \u015feffafl\u0131k ile &ouml;l&ccedil;&uuml;l&uuml;r. \u015eu anda 500+ gizli admin varsa, korkma. Plan\u0131 uygula, rapor yap, denetleyeni tatmin et. Kolay gelsin...<\/strong><\/p>\r\n<hr>\r\n<p>&nbsp;<\/p>","excerpt":"Active Directory (AD) ile ilgili en yayg\u0131n hatalardan biri, y\u00f6netim delegasyonunun g\u00fcvensiz ve kaotik yap\u0131lmas\u0131","created_at":"2025-10-24 15:41:07","updated_at":"2026-09-07 12:02:37","category_id":6,"view_count":675,"reading_time":20,"status":"published","editor_choice":1,"is_editor_choice":1,"published_at":"2025-10-24 15:41:00","featured_image":"api_pixabay_1762013500_6906313c105ae.jpg","slug":"active-directoryde-admincount1-adminsdholder-ve-guvenli-delegasyon","category_name":"Sistem","category_slug":"sistem"}