{"id":395,"title":"Active Directory ortamlar\u0131nda g\u00fcvenlik","content":"<p><img src=\"..\/..\/..\/uploads\/images\/2026\/02\/698e2c1acb259_1770925082.png\" alt=\"\" width=\"1287\" height=\"701\">Active Directory ortamlar\u0131nda g&uuml;venli\u011fi sa\u011flamak, sadece g&uuml;&ccedil;l&uuml; parolalar belirlemekten ibaret de\u011fildir; ayn\u0131 zamanda kimin neyi, nereye ekleyebilece\u011fini de kontrol etmektir. Varsay\u0131lan ayarlarda, herhangi bir kullan\u0131c\u0131 etki alan\u0131na 10 adet makine dahil edebilir. Bu durum, sald\u0131rganlar i&ccedil;in a&ccedil;\u0131k bir davetiyedir.<\/p>\n<p>\u0130\u015fte bu riskleri minimize etmek i&ccedil;in haz\u0131rlad\u0131\u011f\u0131m\u0131z, Domain Join (Etki Alan\u0131na Kat\u0131lma) i\u015flemlerini g&uuml;venli hale getirme rehberi:<\/p>\n<p><iframe style=\"width: 683px; height: 384px;\" src=\"https:\/\/www.youtube.com\/embed\/w7UxAaZMoSQ\" width=\"683\" height=\"384\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h2>&nbsp;1. &Ouml;zel Bir Servis Hesab\u0131 Olu\u015fturun<\/h2>\n<p>\u0130lk ad\u0131m, bu i\u015f i&ccedil;in &ouml;zel olarak atanm\u0131\u015f bir servis hesab\u0131 olu\u015fturmakt\u0131r. Bu hesap, g&uuml;nl&uuml;k i\u015flerde kullan\u0131lan bir kullan\u0131c\u0131 hesab\u0131 olmamal\u0131d\u0131r.<\/p>\n<p>&nbsp;<br>\u0130simlendirme: &Ouml;rne\u011fin `djoinacc` gibi a&ccedil;\u0131klay\u0131c\u0131 bir isim kullan\u0131n.<\/p>\n<p><br>&nbsp;<br>Parola G&uuml;venli\u011fi: En az 17 karakterden olu\u015fan, g&uuml;&ccedil;l&uuml; bir parola veya hat\u0131rlanmas\u0131 kolay bir \"passphrase\" (parola c&uuml;mlesi) tercih edin.<\/p>\n<p><br>&nbsp;<br>Y&ouml;ntem: `dsa.msc` &uuml;zerinden ilgili Organizasyon Birimi (OU) alt\u0131nda yeni bir kullan\u0131c\u0131 olu\u015fturun.<\/p>\n<p>&nbsp;<\/p>\n<h2>&nbsp;2. Yetkileri (Delegasyon) Tan\u0131mlay\u0131n<\/h2>\n<p>Servis hesab\u0131n\u0131 olu\u015fturduktan sonra, ona sadece hedef OU (&ouml;rne\u011fin \"Computers\") &uuml;zerinde gerekli olan minimum yetkileri tan\u0131mlay\u0131n.<\/p>\n<p><img src=\"..\/..\/uploads\/images\/2026\/02\/6983a30cf1493_1770234636.png\"><\/p>\n<p>Tan\u0131mlanmas\u0131 gereken izinler \u015funlard\u0131r:<\/p>\n<p>&nbsp;<br>Create &amp; Delete Computer Objects: Bu nesne ve t&uuml;m alt nesneler i&ccedil;in izin verin.<\/p>\n<p><br>&nbsp;Alt Bilgisayar Nesneleri \u0130&ccedil;in:<br>&nbsp;T&uuml;m &ouml;zelliklerini okuma ve yazma (Read &amp; Write All Properties).<\/p>\n<p><br>&nbsp;\u0130zinleri okuma ve yazma (Read &amp; Write Permissions).<\/p>\n<p><br>&nbsp;Parola de\u011fi\u015ftirme ve s\u0131f\u0131rlama (Change &amp; Reset Password).<\/p>\n<p><br>&nbsp;DNS ana bilgisayar adlar\u0131na ve servis as\u0131l adlar\u0131na (SPN) do\u011frulanm\u0131\u015f yazma yetkisi.<\/p>\n<p><img src=\"..\/..\/uploads\/images\/2026\/02\/6983a33729ac6_1770234679.png\"><\/p>\n<h2>&nbsp;3. G&uuml;vensiz Varsay\u0131lan Yap\u0131land\u0131rmalar\u0131 Kald\u0131r\u0131n<\/h2>\n<p>AD kurulumuyla gelen baz\u0131 \"kolayl\u0131klar\" asl\u0131nda g&uuml;venlik a&ccedil;\u0131\u011f\u0131d\u0131r. Bunlar\u0131 kapatmak \u015fart.<\/p>\n<p><img src=\"..\/..\/uploads\/images\/2026\/02\/6983a34466d04_1770234692.png\"><\/p>\n<p>&nbsp;Makine Hesab\u0131 Kotas\u0131n\u0131 S\u0131f\u0131rlay\u0131n<\/p>\n<p>Varsay\u0131lan olarak `ms-DS-MachineAccountQuota` de\u011feri 10'dur; bu, her kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131n\u0131n 10 makineyi domain'e dahil edebilece\u011fi anlam\u0131na gelir.<\/p>\n<p>&nbsp;Domain k&ouml;k&uuml;ne sa\u011f t\u0131klay\u0131n &gt; Attribute Editor &gt; `ms-DS-MachineAccountQuota` de\u011ferini 0 yap\u0131n.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;Grup \u0130lkesini (GPO) D&uuml;zenleyin<\/p>\n<p>\"Default Domain Controllers Policy\" &uuml;zerinde d&uuml;zenleme yaparak yetkisiz eri\u015fimi engelleyin.<\/p>\n<p>&nbsp;<br>Yol: `Computer Configuration &gt; Policies &gt; Windows Settings &gt; Security Settings &gt; Local Policies &gt; User Rights Assignment &gt; Add workstations to domain`.<\/p>\n<p><br>&nbsp;Buradaki \"Authenticated Users\" se&ccedil;ene\u011fini kald\u0131r\u0131n ve sadece olu\u015fturdu\u011funuz servis hesab\u0131n\u0131 (`djoinacc`) ve yedek olarak \"Domain Admins\" grubunu ekleyin.<\/p>\n<p>&nbsp;<\/p>\n<h2>&nbsp;4. Sahiplik ve ACL Temizli\u011fi Yap\u0131n<\/h2>\n<p>Bir bilgisayar objesi olu\u015fturuldu\u011funda, onu olu\u015fturan hesap (servis hesab\u0131n\u0131z) otomatik olarak objenin sahibi (owner) olur. Sahiplik, hesap &uuml;zerinde dolayl\u0131 olarak tam kontrol sa\u011flar; bu da RBCD veya LAPS &uuml;zerinden ayr\u0131cal\u0131k y&uuml;kseltme (privilege escalation) riskini do\u011furur.<\/p>\n<p>G&uuml;venlik &ouml;nerileri:<\/p>\n<p>&nbsp;Kat\u0131lan bilgisayarlar\u0131, devral\u0131nan haklar\u0131 kald\u0131rmak i&ccedil;in delegasyon yap\u0131lan OU'nun d\u0131\u015f\u0131na ta\u015f\u0131y\u0131n.<\/p>\n<p><br>&nbsp;Bilgisayar nesnelerinin sahipli\u011fini d&uuml;zenli olarak \"Domain Admins\" gibi korumal\u0131 bir gruba devreden temizlik betikleri &ccedil;al\u0131\u015ft\u0131r\u0131n.<\/p>\n<p><br>&nbsp;Delegasyon hesab\u0131na ait kal\u0131nt\u0131 ACE (Access Control Entry) kay\u0131tlar\u0131n\u0131 temizleyin.<\/p>\n<p><img src=\"..\/..\/uploads\/images\/2026\/02\/6983a34fef7b0_1770234703.png\"><\/p>\n<p>&nbsp;<\/p>\n<p>bu PowerShell beti\u011fi, payla\u015ft\u0131\u011f\u0131n dok&uuml;manda belirtilen g&uuml;venlik ad\u0131mlar\u0131n\u0131 (hesap olu\u015fturma, kota s\u0131f\u0131rlama ve yetki delegasyonu) otomatize etmek i&ccedil;in tasarlanm\u0131\u015ft\u0131r.<\/p>\n<p>A\u015fa\u011f\u0131daki betik, dok&uuml;manda yer alan \"djoinacc\" hesab\u0131n\u0131 olu\u015fturur, etki alan\u0131 kotas\u0131n\u0131 g&uuml;venlik gerek&ccedil;esiyle s\u0131f\u0131rlar ve hedef OU &uuml;zerinde gerekli hassas izinleri tan\u0131mlar.<\/p>\n<pre class=\"language-markup\"><code># --- De\u011fi\u015fkenler ---\n[cite_start]$AccountName = \"djoinacc\" [cite: 18]\n[cite_start]$TargetOUDN = \"OU=Computers,DC=ad,DC=local\" [cite: 48, 116]\n[cite_start]$DomainDN = (Get-ADDomain).DistinguishedName [cite: 148]\n\n# 1. G&uuml;venli Servis Hesab\u0131n\u0131 Olu\u015fturma\n# Dok&uuml;man 17+ karakterli g&uuml;&ccedil;l&uuml; bir parola &ouml;nerir[cite: 15, 16].\n$Password = Read-Host -AsSecureString \"Servis hesab\u0131 i&ccedil;in g&uuml;&ccedil;l&uuml; bir parola girin\"\n[cite_start]New-ADUser -Name $AccountName -SamAccountName $AccountName -AccountPassword $Password -Enabled $true -Path \"OU=Users,$DomainDN\" [cite: 11, 14]\n\n# 2. ms-DS-MachineAccountQuota De\u011ferini S\u0131f\u0131rlama\n# Her kullan\u0131c\u0131n\u0131n 10 makine ekleme hakk\u0131n\u0131 (varsay\u0131lan g&uuml;vensiz ayar) 0'a indirir[cite: 142, 145, 163].\n[cite_start]Set-ADDomain -Identity $DomainDN -Replace @{\"ms-DS-MachineAccountQuota\" = 0} [cite: 164]\n\n# 3. OU &Uuml;zerinde Yetki Delegasyonu\n$SID = (Get-ADUser $AccountName).SID\n$ACL = Get-Acl -Path \"AD:\\$TargetOUDN\"\n\n# A. Bilgisayar Nesnesi Olu\u015fturma\/Silme \u0130zinleri (Bu nesne ve t&uuml;m alt nesneler) [cite: 51, 52, 100]\n$CreateDeleteRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(\n    $SID, \n    \"CreateChild,DeleteChild\", \n    \"Allow\", \n    [Guid]\"bf967a86-0de6-11d0-a285-00aa003049e2\", # Computer Object Class GUID\n    \"All\"\n)\n$ACL.AddAccessRule($CreateDeleteRule)\n\n# B. Alt Bilgisayar Nesneleri \u0130&ccedil;in &Ouml;zellik Yazma ve Parola S\u0131f\u0131rlama \u0130zinleri [cite: 53-59]\n$InheritedRules = @(\n    [cite_start]\"ReadProperty,WriteProperty\", # Read &amp; Write All Properties [cite: 54]\n    [cite_start]\"ExtendedRight\"               # Reset Password &amp; Validated Writes [cite: 57, 58, 59]\n)\n\nforeach ($Rule in $InheritedRules) {\n    $ADRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(\n        $SID, \n        $Rule, \n        \"Allow\", \n        \"Descendant\", \n        [cite_start][Guid]\"bf967a86-0de6-11d0-a285-00aa003049e2\" # Sadece Computer nesnelerine uygulan\u0131r [cite: 53]\n    )\n    $ACL.AddAccessRule($ADRule)\n}\n\nSet-Acl -Path \"AD:\\$TargetOUDN\" -AclObject $ACL\n\n# 4. Sahiplik Temizli\u011fi (Bak\u0131m Plan\u0131)\n# Dok&uuml;man, olu\u015fturulan nesnelerin sahipli\u011finin Domain Admins'e devredilmesini &ouml;nerir[cite: 201].\nWrite-Host \"\u0130\u015flem Tamamland\u0131. L&uuml;tfen GPO &uuml;zerinden 'Add workstations to domain' ayar\u0131n\u0131 g&uuml;ncellemeyi unutmay\u0131n.\" [cite_start]-ForegroundColor Cyan [cite: 178, 182]<\/code><\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;&Ouml;nemli Notlar ve Bak\u0131m<\/p>\n<p>&nbsp;<br>GPO D&uuml;zenlemesi: Betik AD izinlerini ayarlar ancak Default Domain Controllers Policy i&ccedil;indeki \"Add workstations to domain\" hakk\u0131n\u0131 manuel olarak (veya GPO mod&uuml;l&uuml;yle) sadece bu servis hesab\u0131na k\u0131s\u0131tlaman\u0131z gerekir.<\/p>\n<p><br>&nbsp;<br>Sahiplik (Ownership): Dok&uuml;mana g&ouml;re, djoinacc hesab\u0131 olu\u015fturdu\u011fu nesnelerin sahibi olur. Ayr\u0131cal\u0131k y&uuml;kseltme sald\u0131r\u0131lar\u0131n\u0131 (RBCD gibi) &ouml;nlemek i&ccedil;in bu nesnelerin sahipli\u011fini d&uuml;zenli olarak bir script ile Domain Admins grubuna aktarmal\u0131s\u0131n\u0131z.<\/p>\n<p><br>&nbsp;<br>PowerShell ile Kat\u0131l\u0131m: Bilgisayarlar\u0131 bu hesapla etki alan\u0131na dahil ederken Add-Computer komutunu -OUPath parametresiyle birlikte kullanmal\u0131s\u0131n\u0131z.<\/p>\n<p>&nbsp;<\/p>\n<p>Dok&uuml;manda belirtilen riskleri (sahiplik &uuml;zerinden ayr\u0131cal\u0131k y&uuml;kseltme, RBCD veya LAPS verilerine eri\u015fim) &ouml;nlemek i&ccedil;in bu temizlik i\u015fleminin d&uuml;zenli olarak yap\u0131lmas\u0131 kritiktir.<\/p>\n<p>A\u015fa\u011f\u0131daki betik, delegasyon OU'suna yeni eklenen bilgisayarlar\u0131 tespit eder, sahipli\u011fini de\u011fi\u015ftirir, izin kal\u0131nt\u0131lar\u0131n\u0131 temizler ve onlar\u0131 g&uuml;venli bir &uuml;retim OU'suna ta\u015f\u0131r.<\/p>\n<p>&nbsp;AD Temizlik ve G&uuml;venlik Beti\u011fi (Cleanup Task)<\/p>\n<p>powershell<\/p>\n<pre class=\"language-markup\"><code> --- Ayarlar ---\n[cite_start]$DelegatedOU = \"OU=Computers,OU=T2,DC=ad,DC=local\"  Bilgisayarlar\u0131n ilk kat\u0131ld\u0131\u011f\u0131 yer [cite: 116]\n[cite_start]$ProductionOU = \"OU=Production,DC=ad,DC=local\"     Ta\u015f\u0131nacak g&uuml;venli yer [cite: 200]\n[cite_start]$ServiceAccount = \"ad\\djoinacc\"                    Yetkili servis hesab\u0131 [cite: 48]\n[cite_start]$AdminGroup = \"AD\\Domain Admins\"                   Yeni sahibi olacak grup [cite: 201]\n\n 1. Delegasyon OU'sundaki bilgisayarlar\u0131 bul\n$Computers = Get-ADComputer -Filter  -SearchBase $DelegatedOU\n\nforeach ($PC in $Computers) {\n    Write-Host \"\u0130\u015fleniyor: $($PC.Name)\" -ForegroundColor Yellow\n    $ObjectPath = \"AD:\\$($PC.DistinguishedName)\"\n    \n     [cite_start]2. Sahipli\u011fi De\u011fi\u015ftir (Ownership Transfer) [cite: 201]\n     [cite_start]Sahiplik, hesaba Write All Properties yetkisi olmasa bile tam kontrol sa\u011flar[cite: 197].\n    $ACL = Get-Acl -Path $ObjectPath\n    $AdminSID = (Get-ADGroup $AdminGroup).SID\n    $ACL.SetOwner($AdminSID)\n    Set-Acl -Path $ObjectPath -AclObject $ACL\n    \n     [cite_start]3. Servis Hesab\u0131 ACE Kay\u0131tlar\u0131n\u0131 Temizle [cite: 203]\n     djoinacc hesab\u0131na ait t&uuml;m do\u011frudan izinleri kald\u0131r\u0131r.\n    $ACL = Get-Acl -Path $ObjectPath\n    $RulesToRemove = $ACL.Access | Where-Object { $_.IdentityReference -eq $ServiceAccount }\n    foreach ($Rule in $RulesToRemove) {\n        $ACL.RemoveAccessRule($Rule)\n    }\n    Set-Acl -Path $ObjectPath -AclObject $ACL\n    \n     [cite_start]4. Bilgisayar\u0131 &Uuml;retim OU'suna Ta\u015f\u0131 [cite: 200]\n     Bu i\u015flem, delegasyon OU'sundan gelen miras izinleri keser.\n    Move-ADObject -Identity $PC.DistinguishedName -TargetPath $ProductionOU\n    \n    Write-Host \"$($PC.Name) ba\u015far\u0131yla temizlendi ve ta\u015f\u0131nd\u0131.\" -ForegroundColor Green\n}<\/code><\/pre>\n<p>---<\/p>\n<p>&nbsp;Bu Beti\u011fi \"Scheduled Task\" Olarak Ayarlama<\/p>\n<p>Bu i\u015flemi otomatize etmek i&ccedil;in Windows G&ouml;rev Zamanlay\u0131c\u0131'y\u0131 (Task Scheduler) kullanabilirsiniz:<\/p>\n<p>1. G&ouml;rev Olu\u015ftur: \"AD-Cleanup-DomainJoin\" ad\u0131nda yeni bir g&ouml;rev olu\u015fturun.<br>2. Tetikleyici (Trigger): Her g&uuml;n veya her saat ba\u015f\u0131 &ccedil;al\u0131\u015facak \u015fekilde ayarlay\u0131n.<br>3. Eylem (Action): powershell.exe program\u0131n\u0131 ba\u015flat\u0131n.<br>4. Ba\u011f\u0131ms\u0131z De\u011fi\u015fkenler: -ExecutionPolicy Bypass -File \"C:\\Scripts\\ADCleanup.ps1\" yolunu ekleyin.<br>5. Kullan\u0131c\u0131: G&ouml;revin \"Domain Admin\" yetkisine sahip bir hesapla (veya SYSTEM hesab\u0131, e\u011fer DC &uuml;zerinde &ccedil;al\u0131\u015facaksa) &ccedil;al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun.<\/p>\n<p>&nbsp;Neden Bu Temizlik Gerekli?<\/p>\n<p>&nbsp;<br>Ayr\u0131cal\u0131k Y&uuml;kseltme (Privilege Escalation): Nesne sahibi olan hesap, msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD) gibi kritik &ouml;znitelikleri de\u011fi\u015ftirebilir.<\/p>\n<p><br>&nbsp;<br>Gizli Verilere Eri\u015fim: Sahiplik haklar\u0131, LAPS parolalar\u0131 (ms-Mcs-AdmPwd) gibi hassas bilgilerin okunmas\u0131na yol a&ccedil;abilir.<\/p>\n<p><br>&nbsp;<br>Miras \u0130zinlerin Kesilmesi: Bilgisayar\u0131 farkl\u0131 bir OU'ya ta\u015f\u0131mak, djoinacc hesab\u0131n\u0131n o nesne &uuml;zerindeki devral\u0131nm\u0131\u015f t&uuml;m haklar\u0131n\u0131 etkisiz hale getirir.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"AD g\u00fcvenli\u011fi, bir kez yap\u0131l\u0131p unutulacak bir i\u015f de\u011fil, s\u00fcrekli bir denetim s\u00fcrecidir. Bu ad\u0131mlar\u0131 uygulayarak altyap\u0131n\u0131z\u0131 \u00e7ok daha diren\u00e7li hale getirebilirsiniz.","created_at":"2026-02-04 22:54:49","updated_at":"2026-09-23 13:08:20","category_id":7,"view_count":696,"reading_time":8,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-02-04 19:54:49","featured_image":"\/uploads\/images\/2026\/02\/6983a3f4b2338_1770234868.jpg","slug":"active-directory-ortamlarinda-guvenlik","category_name":"Cyber Security","category_slug":"cyber-security"}