[{"id":407,"title":"Windows Server 24H2 G\u00fcvenlik Alarm\u0131 ? KB5066835 Yamas\u0131","content":"<div id=\"model-response-message-contentr_23aa18ca0c31b55d\" class=\"markdown markdown-main-panel enable-luminous-fast-follows enable-updated-hr-color stronger\" dir=\"ltr\" aria-busy=\"false\" aria-live=\"polite\">\n<p data-path-to-node=\"3\">Siber g&uuml;venlik d&uuml;nyas\u0131nda zafiyetlerin \"ya\u015f\u0131\" her zaman riskin bitti\u011fi anlam\u0131na gelmez. Bunun en g&uuml;ncel &ouml;rne\u011fini, Microsoft&rsquo;un modern i\u015fletim sistemleri i&ccedil;in yay\u0131nlad\u0131\u011f\u0131 son toplu g&uuml;ncelle\u015ftirmelerde a&ccedil;\u0131k&ccedil;a g&ouml;r&uuml;yoruz. K&ouml;keni 2016 y\u0131l\u0131na dayanan bir a&ccedil;\u0131k kaynak k&uuml;t&uuml;phanesi zafiyeti, bug&uuml;n en g&uuml;ncel&nbsp;<strong data-path-to-node=\"3\" data-index-in-node=\"299\">Windows Server 24H2<\/strong> sistemlerimizi do\u011frudan etkileyebiliyor.<\/p>\n<p data-path-to-node=\"4\">Bu yaz\u0131m\u0131zda, sistem y&ouml;neticilerinin radar\u0131nda olmas\u0131 gereken <strong data-path-to-node=\"4\" data-index-in-node=\"62\">CVE-2016-9535<\/strong> zafiyetini ve &ccedil;&ouml;z&uuml;m ad\u0131mlar\u0131n\u0131 ele al\u0131yoruz.<\/p>\n<h3 data-path-to-node=\"6\">Tehlike Nedir? (CVE-2016-9535 ve LibTIFF)<\/h3>\n<p data-path-to-node=\"7\">Zafiyetin merkezinde, g&ouml;rsel i\u015fleme s&uuml;re&ccedil;lerinde yayg\u0131n olarak kullan\u0131lan a&ccedil;\u0131k kaynakl\u0131 bir k&uuml;t&uuml;phane olan <strong data-path-to-node=\"7\" data-index-in-node=\"107\">LibTIFF<\/strong> yer al\u0131yor. Bu k&uuml;t&uuml;phanenin eski s&uuml;r&uuml;mlerinde (<code data-path-to-node=\"7\" data-index-in-node=\"162\">tif_predict.c<\/code> kaynakl\u0131), k&ouml;t&uuml; ama&ccedil;l\u0131 yap\u0131land\u0131r\u0131lm\u0131\u015f bir TIFF g&ouml;rseli i\u015flenirken bellek boyutu yanl\u0131\u015f hesaplan\u0131yor.<\/p>\n<p data-path-to-node=\"8\">Sonu&ccedil;? <strong data-path-to-node=\"8\" data-index-in-node=\"7\">Kritik (CVSS: 9.8) seviyede bir Y\u0131\u011f\u0131n Tabanl\u0131 Arabellek Ta\u015fmas\u0131 (Heap-based Buffer Overflow).<\/strong><\/p>\n<p data-path-to-node=\"9\">Sald\u0131rganlar, bu a&ccedil;\u0131\u011f\u0131 manip&uuml;le ederek sistem &uuml;zerinde <strong data-path-to-node=\"9\" data-index-in-node=\"55\">Uzaktan Kod &Ccedil;al\u0131\u015ft\u0131rma (RCE)<\/strong> ger&ccedil;ekle\u015ftirebilir veya sistem servislerini tamamen &ccedil;&ouml;kerterek hizmet d\u0131\u015f\u0131 (DoS) b\u0131rakabilir.<\/p>\n<h3 data-path-to-node=\"10\">En G&uuml;ncel Sistemler Neden Etkileniyor?<\/h3>\n<p data-path-to-node=\"11\">Peki, 2016'n\u0131n a&ccedil;\u0131\u011f\u0131 neden 24H2 mimarisinde kar\u015f\u0131m\u0131za &ccedil;\u0131k\u0131yor?<\/p>\n<p data-path-to-node=\"12\">Bunun nedeni <strong data-path-to-node=\"12\" data-index-in-node=\"13\">yaz\u0131l\u0131m tedarik zinciri (Supply Chain)<\/strong> ba\u011f\u0131ml\u0131l\u0131klar\u0131d\u0131r. \u0130\u015fletim sistemlerinin alt katmanlar\u0131nda yer alan faks, yazd\u0131rma alt yap\u0131lar\u0131 veya dahili imaj g&ouml;r&uuml;nt&uuml;leme bile\u015fenleri, arka planda h&acirc;l&acirc; bu k&ouml;kl&uuml; k&uuml;t&uuml;phanelerin kod par&ccedil;ac\u0131klar\u0131n\u0131 bar\u0131nd\u0131rabiliyor. Microsoft, modern i\u015fletim sistemlerini tamamen g&uuml;venli hale getirmek ad\u0131na bu eski kal\u0131nt\u0131lar\u0131 da geriye d&ouml;n&uuml;k olarak temizlemektedir.<\/p>\n<h3 data-path-to-node=\"14\">&Ccedil;&ouml;z&uuml;m: KB5066835 G&uuml;ncelle\u015ftirmesi<\/h3>\n<p data-path-to-node=\"15\">Microsoft, x64 tabanl\u0131 Windows Server 24H2 ve Windows 11 sistemler i&ccedil;in bu a&ccedil;\u0131\u011f\u0131 kapatan <strong data-path-to-node=\"15\" data-index-in-node=\"89\">KB5066835<\/strong> toplu g&uuml;ncelle\u015ftirme paketini devreye ald\u0131.<\/p>\n<p data-path-to-node=\"16\">Bu yama, alt bile\u015fenlerdeki bellek tahsis aritmeti\u011fini ve s\u0131n\u0131r kontrollerini d&uuml;zelterek g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131 tamamen ortadan kald\u0131r\u0131yor. G&uuml;ncelleme ba\u015far\u0131yla uyguland\u0131\u011f\u0131nda, i\u015fletim sistemi derleme numaran\u0131z <strong data-path-to-node=\"16\" data-index-in-node=\"205\">26100.6899<\/strong> (veya &uuml;zeri) seviyesine y&uuml;kselmektedir.<\/p>\n<h3 data-path-to-node=\"18\">Sistem Y&ouml;neticileri \u0130&ccedil;in 3 Ad\u0131ml\u0131 Aksiyon Plan\u0131<\/h3>\n<p data-path-to-node=\"19\">E\u011fer altyap\u0131n\u0131zda Windows Server 24H2 veya Windows 11 24H2 &ccedil;al\u0131\u015ft\u0131ran sunucu ve istemciler varsa, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 h\u0131zla uygulaman\u0131z\u0131 &ouml;neririz:<\/p>\n<ol start=\"1\" data-path-to-node=\"20\">\n<li>\n<p data-path-to-node=\"20,0,0\"><strong data-path-to-node=\"20,0,0\" data-index-in-node=\"0\">Envanter Kontrol&uuml;:<\/strong> WSUS, SCCM veya Microsoft Defender for Endpoint &uuml;zerinden sistemlerinizin derleme (build) numaralar\u0131n\u0131 filtreleyin.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"20,1,0\"><strong data-path-to-node=\"20,1,0\" data-index-in-node=\"0\">Yama Da\u011f\u0131t\u0131m\u0131:<\/strong> Test ortamlar\u0131nda do\u011frulamas\u0131 yap\u0131lan <strong data-path-to-node=\"20,1,0\" data-index-in-node=\"53\">KB5066835<\/strong> g&uuml;ncellemesini &uuml;retim (production) ortam\u0131ndaki sunucular\u0131n\u0131za planl\u0131 bir kesinti pencerelerinde da\u011f\u0131t\u0131n.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"20,2,0\"><strong data-path-to-node=\"20,2,0\" data-index-in-node=\"0\">Do\u011frulama:<\/strong> G&uuml;ncelleme sonras\u0131nda sunucularda PowerShell &uuml;zerinden a\u015fa\u011f\u0131daki komutu &ccedil;al\u0131\u015ft\u0131rarak g&uuml;venli derleme s&uuml;r&uuml;m&uuml;ne ula\u015ft\u0131\u011f\u0131n\u0131z\u0131 teyit edin:<\/p>\n<!----><!----><!----><!----><!----><!----><!----><!---->\n<div class=\"code-block ng-tns-c2643669177-22 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation\" data-hveid=\"0\" data-ved=\"0CAAQhtANahgKEwj1lp7dwMKVAxUAAAAAHQAAAAAQrwE\"><!---->\n<div class=\"formatted-code-block-internal-container ng-tns-c2643669177-22\">\n<div class=\"animated-opacity ng-tns-c2643669177-22\">\n<div class=\"code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c2643669177-22 ng-star-inserted\"><span class=\"ng-tns-c2643669177-22\">PowerShell<\/span><!----><!----><button class=\"mdc-icon-button mat-mdc-icon-button mat-mdc-button-base mat-badge mat-unthemed _mat-animation-noopable mat-badge-overlap mat-badge-above mat-badge-after mat-badge-small mat-badge-hidden ng-star-inserted\" aria-label=\"Kodu indir\"><!----><!----><!----><!----><\/button><!----><!----><!----><!----><!----><!----><!----><!----><!----><button class=\"mdc-icon-button mat-mdc-icon-button mat-mdc-button-base mat-badge mat-unthemed _mat-animation-noopable mat-badge-overlap mat-badge-above mat-badge-after mat-badge-small mat-badge-hidden ng-star-inserted\" aria-label=\"Kodu kopyala\"><!----><!----><!----><!----><\/button><!----><!----><!----><!----><!----><!----><!----><!----><\/div>\n<div class=\"code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c2643669177-22 ng-star-inserted\"><code class=\"code-container formatted ng-tns-c2643669177-22\" role=\"text\" data-test-id=\"code-content\">(<span class=\"hljs-built_in\">Get-ItemProperty<\/span> <span class=\"hljs-string\">\"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"<\/span>).UBR\n<\/code><\/div>\n<!----><!----><\/div>\n<\/div>\n<\/div>\n<!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><\/li>\n<\/ol>\n<p data-path-to-node=\"21\">Unutmay\u0131n; siber sald\u0131rganlar sistem s\u0131zmalar\u0131 i&ccedil;in her zaman en karma\u015f\u0131k s\u0131f\u0131r\u0131nc\u0131 g&uuml;n (Zero-Day) a&ccedil;\u0131klar\u0131n\u0131 aramazlar, &ccedil;o\u011fu zaman g&ouml;zden ka&ccedil;an eski ve yamalanmam\u0131\u015f k&uuml;t&uuml;phaneleri kullan\u0131rlar. Sistemlerinizi g&uuml;ncel tutun, altyap\u0131n\u0131z\u0131 g&uuml;vende b\u0131rak\u0131n!!!<\/p>\n<\/div>","excerpt":"Siber g\u00fcvenlik d\u00fcnyas\u0131nda zafiyetlerin \"ya\u015f\u0131\" her zaman riskin bitti\u011fi anlam\u0131na gelmez. Bunun en g\u00fcncel \u00f6rne\u011fini, Microsoft\u2019un modern i\u015fletim sistemleri i\u00e7in yay\u0131nlad\u0131\u011f\u0131 son toplu g\u00fcncelle\u015ftirmelerde a\u00e7\u0131k\u00e7a g\u00f6r\u00fcyoruz. K\u00f6keni 2016 y\u0131l\u0131na dayanan bir a\u00e7\u0131k kaynak k\u00fct\u00fcphanesi zafiyeti, bug\u00fcn en g\u00fcncel\u00a0Windows Server 24H2 sistemlerimizi do\u011frudan etkileyebiliyor.","created_at":"2026-07-08 10:11:25","updated_at":"2026-09-23 15:45:14","category_id":12,"view_count":254,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-07-08 07:11:25","featured_image":"\/uploads\/images\/2026\/07\/6a4df819b9d6e_1783494681.jpg","slug":"windows-server-24h2-guvenlik-alarmi-kb5066835-yamasi","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":381,"title":"\u00a0File Server Performance Test Tool v2.0","content":"<p>&nbsp;File Server Performance Test Tool v2.0 - Advanced Edition<\/p>\n<p>&nbsp;Yeni &Ouml;zellikler<\/p>\n<p>&nbsp;\u2699\ufe0f Ayarlar Sayfas\u0131<br>- Test parametrelerini kaydetme (Sunucu IP, Share Path)<br>- Ayarlar JSON dosyas\u0131nda saklan\u0131r: `C:\\PerformanceTests\\config.json`<\/p>\n<p>&nbsp;\ud83d\udce7 Email G&ouml;nderimi<br>- Test sonu&ccedil;lar\u0131n\u0131 otomatik email ile g&ouml;nderme<br>- SMTP ayarlar\u0131:<br>&nbsp; - SMTP Server ve Port<br>&nbsp; - Kullan\u0131c\u0131 ad\u0131 ve \u015fifre<br>&nbsp; - G&ouml;nderen ve al\u0131c\u0131 email adresleri<br>&nbsp; - SSL deste\u011fi<\/p>\n<p>&nbsp;\u23f0 Otomatik G&ouml;rev Zamanlay\u0131c\u0131<br>- Testleri belirli aral\u0131klarla otomatik &ccedil;al\u0131\u015ft\u0131rma<br>- Windows Task Scheduler entegrasyonu<br>- 5-1440 dakika aras\u0131 ayarlanabilir interval<br>- Otomatik &ccedil;al\u0131\u015fan testler email ile raporlan\u0131r<\/p>\n<p>&nbsp;\ud83d\udcca Geli\u015fmi\u015f Log Sistemi<br>- Her test i&ccedil;in ayr\u0131 log dosyas\u0131<br>- UTF-8 BOM encoding (T&uuml;rk&ccedil;e karakter deste\u011fi)<br>- Dosya ad\u0131 format\u0131: `YYYYMMDD_HHMMSS_TestAdi.txt`<\/p>\n<p>&nbsp;Kullan\u0131m<\/p>\n<p>&nbsp;Manuel &Ccedil;al\u0131\u015ft\u0131rma<br>```powershell<br>&nbsp;PowerShell'i Administrator olarak a&ccedil;\u0131n<br>.\\FileServerTest-GUI-Advanced.ps1<br>```<\/p>\n<p>&nbsp;Otomatik &Ccedil;al\u0131\u015ft\u0131rma (Zamanlay\u0131c\u0131 i&ccedil;in)<br>```powershell<br>.\\FileServerTest-GUI-Advanced.ps1 -AutoRun<br>```<\/p>\n<p>&nbsp;Ayarlar<\/p>\n<p>&nbsp;Test Parametreleri<br>- **Sunucu IP**: Ping testi i&ccedil;in hedef IP veya hostname<br>- **Share Path**: SMB, Bandwidth ve IOPS testleri i&ccedil;in UNC path (&ouml;rn: `\\\\192.168.1.100\\share`)<\/p>\n<p>&nbsp;Email Ayarlar\u0131<br>- **Email G&ouml;nderimi Aktif**: Email g&ouml;nderimini etkinle\u015ftir\/devre d\u0131\u015f\u0131 b\u0131rak<br>- **SMTP Server**: SMTP sunucu adresi (&ouml;rn: `smtp.gmail.com`)<br>- **Port**: SMTP port (genellikle 587 veya 465)<br>- **Kullan\u0131c\u0131 Ad\u0131**: SMTP kimlik do\u011frulama kullan\u0131c\u0131 ad\u0131<br>- **\u015eifre**: SMTP kimlik do\u011frulama \u015fifresi<br>- **G&ouml;nderen Email**: G&ouml;nderen email adresi<br>- **Al\u0131c\u0131 Email**: Al\u0131c\u0131 email adresi (virg&uuml;lle ay\u0131rarak birden fazla eklenebilir)<br>- **SSL Kullan**: SSL\/TLS \u015fifreleme kullan<\/p>\n<p>&nbsp;Gmail i&ccedil;in &Ouml;rnek Ayarlar<br>```<br>SMTP Server: smtp.gmail.com<br>Port: 587<br>SSL: Aktif<br>Kullan\u0131c\u0131 Ad\u0131: your-email@gmail.com<br>\u015eifre: uygulama-sifresi (2FA aktifse App Password kullan\u0131n)<br>```<\/p>\n<p>&nbsp;Office 365 i&ccedil;in &Ouml;rnek Ayarlar<br>```<br>SMTP Server: smtp.office365.com<br>Port: 587<br>SSL: Aktif<br>Kullan\u0131c\u0131 Ad\u0131: your-email@company.com<br>\u015eifre: hesap-sifresi<br>```<\/p>\n<p>&nbsp;Otomatik G&ouml;rev Zamanlay\u0131c\u0131<br>- **Otomatik Test Aktif**: Zamanlay\u0131c\u0131y\u0131 etkinle\u015ftir\/devre d\u0131\u015f\u0131 b\u0131rak<br>- **Test Aral\u0131\u011f\u0131**: Testlerin &ccedil;al\u0131\u015fma s\u0131kl\u0131\u011f\u0131 (dakika cinsinden)<br>&nbsp; - Minimum: 5 dakika<br>&nbsp; - Maksimum: 1440 dakika (24 saat)<br>&nbsp; - &Ouml;nerilen: 60 dakika<\/p>\n<p>&nbsp;&Ouml;zellikler<\/p>\n<p>&nbsp;Testler<br>1. **A\u011f Gecikme Testi**: 100 ping paketi ile latency &ouml;l&ccedil;&uuml;m&uuml;<br>2. **Bant Geni\u015fli\u011fi Testi**: 100MB dosya kopyalama ile throughput &ouml;l&ccedil;&uuml;m&uuml;<br>3. **SMB H\u0131z Testi**: K&uuml;&ccedil;&uuml;k, orta ve b&uuml;y&uuml;k dosyalarla SMB performans testi<br>4. **IOPS Testi**: Random read\/write IOPS &ouml;l&ccedil;&uuml;m&uuml;<br>5. **Sistem Bilgileri**: CPU, RAM, Disk ve Network bilgileri<\/p>\n<p>&nbsp;Raporlama<br>- Her test i&ccedil;in ayr\u0131 log dosyas\u0131<br>- Renkli konsol &ccedil;\u0131kt\u0131s\u0131<br>- UTF-8 encoding ile T&uuml;rk&ccedil;e karakter deste\u011fi<br>- Otomatik email g&ouml;nderimi<br>- Notepad ile rapor g&ouml;r&uuml;nt&uuml;leme<\/p>\n<p>&nbsp;Dosya Yap\u0131s\u0131<\/p>\n<p>```<br>C:\\PerformanceTests\\<br>\u251c\u2500\u2500 config.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ayarlar dosyas\u0131<br>\u251c\u2500\u2500 20260113_120530_AgGecikme.txt &nbsp; &nbsp; &nbsp; &nbsp;A\u011f gecikme test raporu<br>\u251c\u2500\u2500 20260113_120645_BantGenisligi.txt &nbsp; &nbsp;Bant geni\u015fli\u011fi test raporu<br>\u251c\u2500\u2500 20260113_120820_SMBTest.txt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;SMB test raporu<br>\u251c\u2500\u2500 20260113_121015_IOPSTest.txt &nbsp; &nbsp; &nbsp; &nbsp; IOPS test raporu<br>\u251c\u2500\u2500 20260113_121200_SistemBilgileri.txt &nbsp;Sistem bilgileri raporu<br>\u2514\u2500\u2500 20260113_121500_TumTestler.txt &nbsp; &nbsp; &nbsp; T&uuml;m testler raporu<br>```<\/p>\n<p>&nbsp;Gereksinimler<\/p>\n<p>- Windows Server 2019 veya &uuml;zeri<br>- PowerShell 5.1 veya &uuml;zeri<br>- Administrator yetkileri<br>- .NET Framework 4.5 veya &uuml;zeri<\/p>\n<p>&nbsp;Sorun Giderme<\/p>\n<p>&nbsp;Email G&ouml;nderilmiyor<br>- SMTP ayarlar\u0131n\u0131 kontrol edin<br>- Firewall'da SMTP portunu a&ccedil;\u0131n<br>- Gmail kullan\u0131yorsan\u0131z \"Daha az g&uuml;venli uygulamalara izin ver\" veya App Password kullan\u0131n<br>- Office 365 kullan\u0131yorsan\u0131z SMTP Auth'un etkin oldu\u011fundan emin olun<\/p>\n<p>&nbsp;Zamanlay\u0131c\u0131 &Ccedil;al\u0131\u015fm\u0131yor<br>- Script'i Administrator olarak &ccedil;al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun<br>- Task Scheduler'da \"FileServerPerformanceTest\" g&ouml;revini kontrol edin<br>- G&ouml;rev &ouml;zelliklerinde \"Run with highest privileges\" se&ccedil;ene\u011finin aktif oldu\u011fundan emin olun<\/p>\n<p>&nbsp;T&uuml;rk&ccedil;e Karakterler Bozuk<br>- Log dosyalar\u0131n\u0131 UTF-8 destekleyen bir edit&ouml;rle a&ccedil;\u0131n (Notepad++, VS Code)<br>- Windows Notepad kullan\u0131yorsan\u0131z \"Encoding\" men&uuml;s&uuml;nden \"UTF-8\" se&ccedil;in<\/p>\n<p>&nbsp;Lisans<\/p>\n<p>Bu ara&ccedil; &Ouml;nder Ak&ouml;z taraf\u0131ndan Windows Server 2016\/2019\/2022 i&ccedil;in geli\u015ftirilmi\u015ftir.<\/p>\n<p>&nbsp;Versiyon Ge&ccedil;mi\u015fi<\/p>\n<p>&nbsp;v2.0 (2026-01-13)<br>- Ayarlar sayfas\u0131 eklendi<br>- Email g&ouml;nderimi eklendi<br>- Otomatik g&ouml;rev zamanlay\u0131c\u0131 eklendi<br>- JSON tabanl\u0131 konfig&uuml;rasyon sistemi<br>- Her test i&ccedil;in ayr\u0131 log dosyas\u0131<\/p>\n<p>&nbsp;v1.0 (2026-01-13)<br>- \u0130lk s&uuml;r&uuml;m<br>- Temel test fonksiyonlar\u0131<br>- GUI aray&uuml;z&uuml;<\/p>\n<pre class=\"language-markup\"><code># File Server Performance Test Tool - Advanced GUI Version\n# Windows Server 2019 compatible\n# Run as Administrator\n\n# Check for AutoRun parameter\nparam([switch]$AutoRun)\n\nAdd-Type -AssemblyName System.Windows.Forms\nAdd-Type -AssemblyName System.Drawing\n\n# Global variables\n$script:OutputPath = \"C:\\PerformanceTests\"\n$script:ConfigFile = Join-Path $script:OutputPath \"config.json\"\n$script:reportFile = \"\"\n$script:isRunning = $false\n$script:config = $null\n\n# Create output folder\nif (-not (Test-Path $script:OutputPath)) {\n    New-Item -ItemType Directory -Path $script:OutputPath -Force | Out-Null\n}\n\n#region Configuration Management\nfunction Load-Config {\n    if (Test-Path $script:ConfigFile) {\n        try {\n            $json = Get-Content -Path $script:ConfigFile -Raw -Encoding UTF8\n            $script:config = $json | ConvertFrom-Json\n        } catch {\n            $script:config = Get-DefaultConfig\n        }\n    } else {\n        $script:config = Get-DefaultConfig\n    }\n}\n\nfunction Get-DefaultConfig {\n    return [PSCustomObject]@{\n        ServerIP = \"\"\n        SharePath = \"\"\n        OutputPath = \"C:\\PerformanceTests\"\n        EmailEnabled = $false\n        SMTPServer = \"\"\n        SMTPPort = 587\n        SMTPUsername = \"\"\n        SMTPPassword = \"\"\n        SMTPFrom = \"\"\n        SMTPTo = \"\"\n        SMTPUseSSL = $true\n        ScheduleEnabled = $false\n        ScheduleInterval = 60\n        ScheduleTests = @(\"Network\", \"Bandwidth\", \"SMB\", \"IOPS\")\n    }\n}\n\nfunction Save-Config {\n    try {\n        $utf8BOM = New-Object System.Text.UTF8Encoding $true\n        $json = $script:config | ConvertTo-Json -Depth 10\n        [System.IO.File]::WriteAllText($script:ConfigFile, $json, $utf8BOM)\n        return $true\n    } catch {\n        [System.Windows.Forms.MessageBox]::Show(\"Ayarlar kaydedilemedi: $($_.Exception.Message)\", \"Hata\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)\n        return $false\n    }\n}\n#endregion\n\n#region Email Functions\nfunction Send-EmailReport {\n    param([string]$ReportFile)\n    \n    if (-not $script:config.EmailEnabled) {\n        return\n    }\n    \n    if ([string]::IsNullOrEmpty($script:config.SMTPServer) -or [string]::IsNullOrEmpty($script:config.SMTPTo)) {\n        Write-Log \"[WARN] Email ayarlar\u0131 eksik, email g&ouml;nderilemedi!\" \"Yellow\"\n        return\n    }\n    \n    try {\n        Write-Log \"Email g&ouml;nderiliyor...\" \"Yellow\"\n        \n        $reportContent = Get-Content -Path $ReportFile -Raw -Encoding UTF8\n        \n        $mailParams = @{\n            SmtpServer = $script:config.SMTPServer\n            Port = $script:config.SMTPPort\n            From = $script:config.SMTPFrom\n            To = $script:config.SMTPTo\n            Subject = \"File Server Test Raporu - $(Get-Date -Format 'dd.MM.yyyy HH:mm')\"\n            Body = $reportContent\n            Encoding = [System.Text.Encoding]::UTF8\n            UseSsl = $script:config.SMTPUseSSL\n        }\n        \n        if (-not [string]::IsNullOrEmpty($script:config.SMTPUsername)) {\n            $securePassword = ConvertTo-SecureString $script:config.SMTPPassword -AsPlainText -Force\n            $credential = New-Object System.Management.Automation.PSCredential($script:config.SMTPUsername, $securePassword)\n            $mailParams.Credential = $credential\n        }\n        \n        Send-MailMessage @mailParams\n        Write-Log \"[OK] Email ba\u015far\u0131yla g&ouml;nderildi!\" \"Green\"\n        \n    } catch {\n        Write-Log \"[ERROR] Email g&ouml;nderilemedi: $($_.Exception.Message)\" \"Red\"\n    }\n}\n#endregion\n\n#region Scheduler Functions\nfunction Register-ScheduledTask {\n    param([int]$IntervalMinutes)\n    \n    try {\n        $taskName = \"FileServerPerformanceTest\"\n        $scriptPath = $PSCommandPath\n        \n        # Mevcut g&ouml;revi sil\n        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue\n        \n        # Yeni g&ouml;rev olu\u015ftur\n        $action = New-ScheduledTaskAction -Execute \"PowerShell.exe\" -Argument \"-NoProfile -ExecutionPolicy Bypass -File `\"$scriptPath`\" -AutoRun\"\n        $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) -RepetitionDuration ([TimeSpan]::MaxValue)\n        $principal = New-ScheduledTaskPrincipal -UserId \"$env:USERDOMAIN\\$env:USERNAME\" -LogonType Interactive -RunLevel Highest\n        $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable\n        \n        Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null\n        \n        Write-Log \"[OK] Zamanlanm\u0131\u015f g&ouml;rev olu\u015fturuldu (Her $IntervalMinutes dakikada)\" \"Green\"\n        return $true\n        \n    } catch {\n        Write-Log \"[ERROR] Zamanlanm\u0131\u015f g&ouml;rev olu\u015fturulamad\u0131: $($_.Exception.Message)\" \"Red\"\n        return $false\n    }\n}\n\nfunction Unregister-ScheduledTask {\n    try {\n        $taskName = \"FileServerPerformanceTest\"\n        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue\n        Write-Log \"[OK] Zamanlanm\u0131\u015f g&ouml;rev kald\u0131r\u0131ld\u0131\" \"Green\"\n        return $true\n    } catch {\n        Write-Log \"[ERROR] Zamanlanm\u0131\u015f g&ouml;rev kald\u0131r\u0131lamad\u0131: $($_.Exception.Message)\" \"Red\"\n        return $false\n    }\n}\n#endregion\n\n#region Helper Functions\nfunction Write-Log {\n    param([string]$Message, [string]$Color = \"Black\", [string]$TestName = \"\")\n    \n    # GUI kontrol&uuml; - e\u011fer form yoksa sadece console'a yaz\n    if ($null -eq $textBox) {\n        Write-Host $Message\n        return\n    }\n    \n    $textBox.SelectionStart = $textBox.TextLength\n    $textBox.SelectionLength = 0\n    \n    switch ($Color) {\n        \"Green\" { $textBox.SelectionColor = [System.Drawing.Color]::Green }\n        \"Red\" { $textBox.SelectionColor = [System.Drawing.Color]::Red }\n        \"Yellow\" { $textBox.SelectionColor = [System.Drawing.Color]::DarkOrange }\n        \"Cyan\" { $textBox.SelectionColor = [System.Drawing.Color]::DarkCyan }\n        default { $textBox.SelectionColor = [System.Drawing.Color]::Black }\n    }\n    \n    $textBox.AppendText(\"$Message`r`n\")\n    $textBox.ScrollToCaret()\n    $form.Refresh()\n    \n    # Her test i&ccedil;in ayr\u0131 dosya olu\u015ftur\n    if (-not [string]::IsNullOrEmpty($TestName)) {\n        $timestamp = Get-Date -Format \"yyyyMMdd_HHmmss\"\n        $script:reportFile = Join-Path $script:OutputPath \"${timestamp}_${TestName}.txt\"\n        \n        # UTF-8 BOM ile dosya olu\u015ftur\n        $utf8BOM = New-Object System.Text.UTF8Encoding $true\n        $header = \"Test: $TestName`r`nTarih: $(Get-Date)`r`nSunucu: $env:COMPUTERNAME`r`n================================================================`r`n`r`n\"\n        [System.IO.File]::WriteAllText($script:reportFile, $header, $utf8BOM)\n    }\n    \n    if ($script:reportFile -and (Test-Path $script:reportFile)) {\n        # UTF-8 BOM ile append\n        $utf8BOM = New-Object System.Text.UTF8Encoding $true\n        $currentContent = [System.IO.File]::ReadAllText($script:reportFile, $utf8BOM)\n        $newContent = $currentContent + $Message + \"`r`n\"\n        [System.IO.File]::WriteAllText($script:reportFile, $newContent, $utf8BOM)\n    }\n}\n\nfunction Enable-Controls {\n    $btnNetworkTest.Enabled = $true\n    $btnBandwidthTest.Enabled = $true\n    $btnSMBTest.Enabled = $true\n    $btnIOPSTest.Enabled = $true\n    $btnFullTest.Enabled = $true\n    $btnSystemInfo.Enabled = $true\n    $btnClearLog.Enabled = $true\n    $btnSaveReport.Enabled = $true\n    $btnSettings.Enabled = $true\n    $script:isRunning = $false\n}\n\nfunction Disable-Controls {\n    $btnNetworkTest.Enabled = $false\n    $btnBandwidthTest.Enabled = $false\n    $btnSMBTest.Enabled = $false\n    $btnIOPSTest.Enabled = $false\n    $btnFullTest.Enabled = $false\n    $btnSystemInfo.Enabled = $false\n    $btnClearLog.Enabled = $false\n    $btnSaveReport.Enabled = $false\n    $btnSettings.Enabled = $false\n    $script:isRunning = $true\n}\n#endregion\n\n#region Test Functions\nfunction Test-NetworkLatency {\n    $target = if ([string]::IsNullOrEmpty($txtServerIP.Text)) { $script:config.ServerIP } else { $txtServerIP.Text.Trim() }\n    \n    if ([string]::IsNullOrEmpty($target)) {\n        [System.Windows.Forms.MessageBox]::Show(\"L&uuml;tfen Sunucu IP adresi giriniz!\", \"Uyar\u0131\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)\n        return\n    }\n    \n    # IP adresi veya hostname validasyonu\n    $ipPattern = \"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$\"\n    $hostnamePattern = \"^[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*$\"\n    \n    if (-not ($target -match $ipPattern -or $target -match $hostnamePattern)) {\n        [System.Windows.Forms.MessageBox]::Show(\"Ge&ccedil;ersiz IP adresi veya hostname!`n`n&Ouml;rnekler:`n- 192.168.1.1`n- server.domain.com`n- fileserver\", \"Hata\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)\n        return\n    }\n    \n    Write-Log \"\" \"\" \"AgGecikme\"\n    Write-Log \"`n================================================================\" \"Cyan\"\n    Write-Log \"1. A\u011e GEC\u0130KME TEST\u0130 (Network Latency)\" \"Cyan\"\n    Write-Log \"================================================================\" \"Cyan\"\n    Write-Log \"Ping testi yap\u0131l\u0131yor ($target)...\" \"Yellow\"\n    \n    $pingResults = Test-Connection -ComputerName $target -Count 100 -ErrorAction SilentlyContinue\n    \n    if ($pingResults) {\n        $avgLatency = ($pingResults | Measure-Object -Property ResponseTime -Average).Average\n        $minLatency = ($pingResults | Measure-Object -Property ResponseTime -Minimum).Minimum\n        $maxLatency = ($pingResults | Measure-Object -Property ResponseTime -Maximum).Maximum\n        $successCount = ($pingResults | Where-Object {$_.StatusCode -eq 0}).Count\n        $lossPercent = ((100 - $successCount) \/ 100) * 100\n        \n        Write-Log \"`nPING SONU&Ccedil;LARI:\"\n        Write-Log \"--------------\"\n        Write-Log \"Hedef: $target\"\n        Write-Log \"Paket G&ouml;nderilen: 100\"\n        Write-Log \"Ba\u015far\u0131l\u0131: $successCount\"\n        Write-Log \"Kay\u0131p: $lossPercent%\"\n        Write-Log \"Ortalama Gecikme: $([math]::Round($avgLatency, 2)) ms\"\n        Write-Log \"Minimum Gecikme: $minLatency ms\"\n        Write-Log \"Maksimum Gecikme: $maxLatency ms\"\n        Write-Log \"`nDE\u011eERLEND\u0130RME:\"\n        \n        if ($avgLatency -lt 20) {\n            Write-Log \"[OK] M&Uuml;KEMMEL: Gecikme &ccedil;ok d&uuml;\u015f&uuml;k (&lt;20ms)\" \"Green\"\n        } elseif ($avgLatency -lt 50) {\n            Write-Log \"[OK] \u0130Y\u0130: Gecikme kabul edilebilir seviyede (&lt;50ms)\" \"Green\"\n        } elseif ($avgLatency -lt 100) {\n            Write-Log \"[WARN] ORTA: Gecikme biraz y&uuml;ksek (50-100ms)\" \"Yellow\"\n        } else {\n            Write-Log \"[ERROR] K&Ouml;T&Uuml;: Y&uuml;ksek gecikme tespit edildi (&gt;100ms)\" \"Red\"\n        }\n        \n        if ($lossPercent -gt 1) {\n            Write-Log \"[ERROR] UYARI: Paket kayb\u0131 tespit edildi! (%$lossPercent)\" \"Red\"\n        }\n        \n    } else {\n        Write-Log \"[ERROR] Ping testi ba\u015far\u0131s\u0131z! Hedef sunucuya eri\u015filemiyor.\" \"Red\"\n    }\n}\n\nfunction Test-Bandwidth {\n    $target = if ([string]::IsNullOrEmpty($txtSharePath.Text)) { $script:config.SharePath } else { $txtSharePath.Text.Trim() }\n    \n    if ([string]::IsNullOrEmpty($target)) {\n        [System.Windows.Forms.MessageBox]::Show(\"L&uuml;tfen Share Path giriniz!`n`n&Ouml;rnek: \\\\192.168.1.100\\share\", \"Uyar\u0131\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)\n        return\n    }\n    \n    if (-not $target.StartsWith(\"\\\\\")) {\n        [System.Windows.Forms.MessageBox]::Show(\"Share Path UNC format\u0131nda olmal\u0131d\u0131r!`n`n&Ouml;rnek: \\\\192.168.1.100\\share\", \"Hata\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)\n        return\n    }\n    \n    Write-Log \"\" \"\" \"BantGenisligi\"\n    Write-Log \"`n================================================================\" \"Cyan\"\n    Write-Log \"2. BANT GEN\u0130\u015eL\u0130\u011e\u0130 TEST\u0130 (Bandwidth)\" \"Cyan\"\n    Write-Log \"================================================================\" \"Cyan\"\n    \n    $testFile = Join-Path $script:OutputPath \"bandwidth_test_100MB.tmp\"\n    $testSize = 100MB\n    \n    Write-Log \"Test dosyas\u0131 olu\u015fturuluyor (100MB)...\" \"Yellow\"\n    $random = New-Object byte[] $testSize\n    (New-Object Random).NextBytes($random)\n    [System.IO.File]::WriteAllBytes($testFile, $random)\n    \n    Write-Log \"Dosya kopyalama testi ba\u015flat\u0131l\u0131yor...\" \"Yellow\"\n    \n    $startTime = Get-Date\n    try {\n        $destFile = Join-Path $target \"bandwidth_test_100MB.tmp\"\n        Copy-Item -Path $testFile -Destination $destFile -Force\n        $endTime = Get-Date\n        $duration = ($endTime - $startTime).TotalSeconds\n        $speedMBps = ($testSize \/ 1MB) \/ $duration\n        $speedMbps = $speedMBps * 8\n        \n        Write-Log \"`nBANT GEN\u0130\u015eL\u0130\u011e\u0130 TEST SONU&Ccedil;LARI:\"\n        Write-Log \"-----------------------------\"\n        Write-Log \"Test Dosya Boyutu: 100 MB\"\n        Write-Log \"S&uuml;re: $([math]::Round($duration, 2)) saniye\"\n        Write-Log \"Ortalama H\u0131z: $([math]::Round($speedMBps, 2)) MB\/s ($([math]::Round($speedMbps, 2)) Mbps)\"\n        Write-Log \"`nDE\u011eERLEND\u0130RME:\"\n        \n        if ($speedMbps -gt 800) {\n            Write-Log \"[OK] M&Uuml;KEMMEL: Gigabit h\u0131za yak\u0131n performans\" \"Green\"\n        } elseif ($speedMbps -gt 400) {\n            Write-Log \"[OK] \u0130Y\u0130: MPLS 500Mbps hatt\u0131 verimli kullan\u0131l\u0131yor\" \"Green\"\n        } elseif ($speedMbps -gt 80) {\n            Write-Log \"[WARN] ORTA: MPLS 100Mbps hatt\u0131 kullan\u0131l\u0131yor\" \"Yellow\"\n        } else {\n            Write-Log \"[ERROR] D&Uuml;\u015e&Uuml;K: Bant geni\u015fli\u011fi beklenenin alt\u0131nda\" \"Red\"\n        }\n        \n        Remove-Item -Path $destFile -Force -ErrorAction SilentlyContinue\n        \n    } catch {\n        Write-Log \"[ERROR] Kopyalama hatas\u0131: $($_.Exception.Message)\" \"Red\"\n    }\n    \n    Remove-Item -Path $testFile -Force -ErrorAction SilentlyContinue\n}\n\nfunction Test-SMBPerformance {\n    $sharePath = if ([string]::IsNullOrEmpty($txtSharePath.Text)) { $script:config.SharePath } else { $txtSharePath.Text.Trim() }\n    \n    if ([string]::IsNullOrEmpty($sharePath)) {\n        [System.Windows.Forms.MessageBox]::Show(\"L&uuml;tfen Share Path giriniz!\", \"Uyar\u0131\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)\n        return\n    }\n    \n    Write-Log \"\" \"\" \"SMBTest\"\n    Write-Log \"`n================================================================\" \"Cyan\"\n    Write-Log \"3. SMB BA\u011eLANTI HIZ TEST\u0130\" \"Cyan\"\n    Write-Log \"================================================================\" \"Cyan\"\n    \n    $testFolder = Join-Path $script:OutputPath \"SMBTest\"\n    if (-not (Test-Path $testFolder)) {\n        New-Item -ItemType Directory -Path $testFolder -Force | Out-Null\n    }\n    \n    $testSizes = @{\n        \"Small\" = 1MB\n        \"Medium\" = 10MB\n        \"Large\" = 50MB\n    }\n    \n    $results = @{}\n    \n    foreach ($sizeType in $testSizes.Keys) {\n        $size = $testSizes[$sizeType]\n        $count = if ($sizeType -eq \"Small\") { 100 } elseif ($sizeType -eq \"Medium\") { 10 } else { 5 }\n        \n        Write-Log \"`n$sizeType dosyalar test ediliyor ($count adet x $($size\/1MB)MB)...\" \"Yellow\"\n        \n        $files = @()\n        for ($i = 1; $i -le $count; $i++) {\n            $fileName = \"test_${sizeType}_$i.tmp\"\n            $filePath = Join-Path $testFolder $fileName\n            $random = New-Object byte[] $size\n            (New-Object Random).NextBytes($random)\n            [System.IO.File]::WriteAllBytes($filePath, $random)\n            $files += $filePath\n        }\n        \n        $startTime = Get-Date\n        try {\n            foreach ($file in $files) {\n                Copy-Item -Path $file -Destination $sharePath -Force\n            }\n            $endTime = Get-Date\n            $duration = ($endTime - $startTime).TotalSeconds\n            $totalSizeMB = ($size * $count) \/ 1MB\n            $speedMBps = $totalSizeMB \/ $duration\n            \n            $results[$sizeType] = @{\n                Count = $count\n                TotalSize = $totalSizeMB\n                Duration = $duration\n                Speed = $speedMBps\n            }\n            \n            Write-Log \"  [OK] Tamamland\u0131: $([math]::Round($speedMBps, 2)) MB\/s\" \"Green\"\n            \n            foreach ($file in $files) {\n                $fileName = Split-Path $file -Leaf\n                Remove-Item -Path \"$sharePath\\$fileName\" -Force -ErrorAction SilentlyContinue\n            }\n            \n        } catch {\n            Write-Log \"  [ERROR] Hata: $($_.Exception.Message)\" \"Red\"\n        }\n        \n        foreach ($file in $files) {\n            Remove-Item -Path $file -Force -ErrorAction SilentlyContinue\n        }\n    }\n    \n    Write-Log \"`n`nSMB PERFORMANS TEST SONU&Ccedil;LARI:\"\n    Write-Log \"-----------------------------\"\n    Write-Log \"Share Path: $sharePath`n\"\n    \n    foreach ($sizeType in $results.Keys) {\n        $r = $results[$sizeType]\n        Write-Log \"$sizeType Dosyalar:\"\n        Write-Log \"  Dosya Say\u0131s\u0131: $($r.Count) adet\"\n        Write-Log \"  Toplam Boyut: $([math]::Round($r.TotalSize, 2)) MB\"\n        Write-Log \"  S&uuml;re: $([math]::Round($r.Duration, 2)) saniye\"\n        Write-Log \"  Ortalama H\u0131z: $([math]::Round($r.Speed, 2)) MB\/s`n\"\n    }\n    \n    if ($results.Count -gt 0) {\n        Write-Log \"DE\u011eERLEND\u0130RME:\"\n        \n        # Speed de\u011ferlerini topla\n        $speedValues = @()\n        foreach ($key in $results.Keys) {\n            if ($results[$key].Speed) {\n                $speedValues += $results[$key].Speed\n            }\n        }\n        \n        if ($speedValues.Count -gt 0) {\n            $avgSpeed = ($speedValues | Measure-Object -Average).Average\n            if ($avgSpeed -gt 50) {\n                Write-Log \"[OK] M&Uuml;KEMMEL: SMB performans\u0131 &ccedil;ok iyi\" \"Green\"\n            } elseif ($avgSpeed -gt 20) {\n                Write-Log \"[OK] \u0130Y\u0130: SMB performans\u0131 kabul edilebilir\" \"Green\"\n            } else {\n                Write-Log \"[ERROR] D&Uuml;\u015e&Uuml;K: SMB performans\u0131 optimize edilmeli\" \"Red\"\n            }\n        } else {\n            Write-Log \"[ERROR] Test tamamlanamad\u0131 - Speed de\u011ferleri al\u0131namad\u0131!\" \"Red\"\n        }\n    } else {\n        Write-Log \"[ERROR] Test tamamlanamad\u0131!\" \"Red\"\n    }\n    \n    Remove-Item -Path $testFolder -Recurse -Force -ErrorAction SilentlyContinue\n}\n\nfunction Test-IOPS {\n    $testPath = if ([string]::IsNullOrEmpty($txtSharePath.Text)) { $script:config.SharePath } else { $txtSharePath.Text.Trim() }\n    \n    if ([string]::IsNullOrEmpty($testPath)) {\n        [System.Windows.Forms.MessageBox]::Show(\"L&uuml;tfen Test Path giriniz!\", \"Uyar\u0131\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)\n        return\n    }\n    \n    Write-Log \"\" \"\" \"IOPSTest\"\n    Write-Log \"`n================================================================\" \"Cyan\"\n    Write-Log \"4. IOPS (Disk Performans) TEST\u0130\" \"Cyan\"\n    Write-Log \"================================================================\" \"Cyan\"\n    Write-Log \"IOPS testi yap\u0131l\u0131yor... Bu test birka&ccedil; dakika s&uuml;rebilir...\" \"Yellow\"\n    \n    $testFolder = Join-Path $testPath \"IOPSTest\"\n    if (-not (Test-Path $testFolder)) {\n        New-Item -ItemType Directory -Path $testFolder -Force | Out-Null\n    }\n    \n    $testFile = Join-Path $testFolder \"iops_test.tmp\"\n    $fileSize = 100MB\n    $blockSize = 4KB\n    \n    Write-Log \"Test dosyas\u0131 olu\u015fturuluyor...\" \"Yellow\"\n    $random = New-Object byte[] $fileSize\n    (New-Object Random).NextBytes($random)\n    [System.IO.File]::WriteAllBytes($testFile, $random)\n    \n    Write-Log \"Random Read testi...\" \"Yellow\"\n    $readOps = 0\n    $startTime = Get-Date\n    $duration = 10\n    $fileStream = [System.IO.File]::OpenRead($testFile)\n    $buffer = New-Object byte[] $blockSize\n    \n    while (((Get-Date) - $startTime).TotalSeconds -lt $duration) {\n        $pos = Get-Random -Minimum 0 -Maximum ($fileSize - $blockSize)\n        $fileStream.Seek($pos, [System.IO.SeekOrigin]::Begin) | Out-Null\n        $fileStream.Read($buffer, 0, $blockSize) | Out-Null\n        $readOps++\n    }\n    \n    $fileStream.Close()\n    $readIOPS = [math]::Round($readOps \/ $duration, 0)\n    \n    Write-Log \"Random Write testi...\" \"Yellow\"\n    $writeOps = 0\n    $startTime = Get-Date\n    $fileStream = [System.IO.File]::OpenWrite($testFile)\n    $buffer = New-Object byte[] $blockSize\n    \n    while (((Get-Date) - $startTime).TotalSeconds -lt $duration) {\n        $pos = Get-Random -Minimum 0 -Maximum ($fileSize - $blockSize)\n        $fileStream.Seek($pos, [System.IO.SeekOrigin]::Begin) | Out-Null\n        (New-Object Random).NextBytes($buffer)\n        $fileStream.Write($buffer, 0, $blockSize)\n        $writeOps++\n    }\n    \n    $fileStream.Close()\n    $writeIOPS = [math]::Round($writeOps \/ $duration, 0)\n    \n    Write-Log \"`nIOPS TEST SONU&Ccedil;LARI:\"\n    Write-Log \"-------------------\"\n    Write-Log \"Test Path: $testPath\"\n    Write-Log \"Block Size: 4KB\"\n    Write-Log \"Test S&uuml;resi: $duration saniye\"\n    Write-Log \"Random Read IOPS: $readIOPS\"\n    Write-Log \"Random Write IOPS: $writeIOPS\"\n    Write-Log \"`nDE\u011eERLEND\u0130RME:\"\n    \n    if ($readIOPS -gt 10000) {\n        Write-Log \"[OK] M&Uuml;KEMMEL: NVMe SSD performans\u0131\" \"Green\"\n    } elseif ($readIOPS -gt 3000) {\n        Write-Log \"[OK] \u0130Y\u0130: SSD performans\u0131\" \"Green\"\n    } elseif ($readIOPS -gt 500) {\n        Write-Log \"[WARN] ORTA: SATA SSD veya y&uuml;ksek performansl\u0131 HDD\" \"Yellow\"\n    } else {\n        Write-Log \"[ERROR] D&Uuml;\u015e&Uuml;K: Geleneksel HDD performans\u0131 - SSD'ye ge&ccedil;i\u015f &ouml;nerilir\" \"Red\"\n    }\n    \n    if ($writeIOPS -lt 100 -and $testPath.StartsWith(\"\\\\\")) {\n        Write-Log \"[WARN] UYARI: Network storage &uuml;zerinde d&uuml;\u015f&uuml;k write IOPS\" \"Yellow\"\n    }\n    \n    Remove-Item -Path $testFolder -Recurse -Force -ErrorAction SilentlyContinue\n}\n\nfunction Get-SystemInfo {\n    Write-Log \"\" \"\" \"SistemBilgileri\"\n    Write-Log \"`n================================================================\" \"Cyan\"\n    Write-Log \"S\u0130STEM B\u0130LG\u0130LER\u0130\" \"Cyan\"\n    Write-Log \"================================================================\" \"Cyan\"\n    \n    $cpu = Get-WmiObject Win32_Processor | Select-Object -First 1\n    $ram = Get-WmiObject Win32_ComputerSystem\n    $disk = Get-WmiObject Win32_LogicalDisk -Filter \"DeviceID='C:'\"\n    $network = Get-NetAdapter | Where-Object {$_.Status -eq \"Up\"}\n    \n    Write-Log \"`nSunucu: $env:COMPUTERNAME\" \"Cyan\"\n    Write-Log \"\u0130\u015fletim Sistemi: $((Get-WmiObject Win32_OperatingSystem).Caption)\" \"Cyan\"\n    Write-Log \"Processor: $($cpu.Name)\" \"Cyan\"\n    Write-Log \"CPU &Ccedil;ekirdek: $($cpu.NumberOfCores)\" \"Cyan\"\n    Write-Log \"RAM: $([math]::Round($ram.TotalPhysicalMemory\/1GB, 2)) GB\" \"Cyan\"\n    Write-Log \"C: Disk Bo\u015f Alan: $([math]::Round($disk.FreeSpace\/1GB, 2)) GB \/ $([math]::Round($disk.Size\/1GB, 2)) GB\" \"Cyan\"\n    Write-Log \"`nAktif Network Adapt&ouml;rleri:\" \"Cyan\"\n    \n    foreach ($adapter in $network) {\n        Write-Log \"  - $($adapter.Name): $($adapter.LinkSpeed)\" \"Cyan\"\n    }\n}\n#endregion\n\n#region Settings Form\nfunction Show-SettingsForm {\n    $settingsForm = New-Object System.Windows.Forms.Form\n    $settingsForm.Text = \"Ayarlar\"\n    $settingsForm.Size = New-Object System.Drawing.Size(600, 650)\n    $settingsForm.StartPosition = \"CenterParent\"\n    $settingsForm.FormBorderStyle = \"FixedDialog\"\n    $settingsForm.MaximizeBox = $false\n    $settingsForm.MinimizeBox = $false\n    \n    $yPos = 20\n    \n    # Test Parametreleri\n    $grpTest = New-Object System.Windows.Forms.GroupBox\n    $grpTest.Location = New-Object System.Drawing.Point(10, $yPos)\n    $grpTest.Size = New-Object System.Drawing.Size(560, 100)\n    $grpTest.Text = \"Test Parametreleri\"\n    $settingsForm.Controls.Add($grpTest)\n    \n    $lblServerIP = New-Object System.Windows.Forms.Label\n    $lblServerIP.Location = New-Object System.Drawing.Point(10, 25)\n    $lblServerIP.Size = New-Object System.Drawing.Size(120, 20)\n    $lblServerIP.Text = \"Sunucu IP:\"\n    $grpTest.Controls.Add($lblServerIP)\n    \n    $txtSettingsServerIP = New-Object System.Windows.Forms.TextBox\n    $txtSettingsServerIP.Location = New-Object System.Drawing.Point(140, 23)\n    $txtSettingsServerIP.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSettingsServerIP.Text = $script:config.ServerIP\n    $grpTest.Controls.Add($txtSettingsServerIP)\n    \n    $lblSharePath = New-Object System.Windows.Forms.Label\n    $lblSharePath.Location = New-Object System.Drawing.Point(10, 55)\n    $lblSharePath.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSharePath.Text = \"Share Path:\"\n    $grpTest.Controls.Add($lblSharePath)\n    \n    $txtSettingsSharePath = New-Object System.Windows.Forms.TextBox\n    $txtSettingsSharePath.Location = New-Object System.Drawing.Point(140, 53)\n    $txtSettingsSharePath.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSettingsSharePath.Text = $script:config.SharePath\n    $grpTest.Controls.Add($txtSettingsSharePath)\n    \n    $yPos += 120\n    \n    # Email Ayarlar\u0131\n    $grpEmail = New-Object System.Windows.Forms.GroupBox\n    $grpEmail.Location = New-Object System.Drawing.Point(10, $yPos)\n    $grpEmail.Size = New-Object System.Drawing.Size(560, 240)\n    $grpEmail.Text = \"Email Ayarlar\u0131\"\n    $settingsForm.Controls.Add($grpEmail)\n    \n    $chkEmailEnabled = New-Object System.Windows.Forms.CheckBox\n    $chkEmailEnabled.Location = New-Object System.Drawing.Point(10, 25)\n    $chkEmailEnabled.Size = New-Object System.Drawing.Size(200, 20)\n    $chkEmailEnabled.Text = \"Email G&ouml;nderimi Aktif\"\n    $chkEmailEnabled.Checked = $script:config.EmailEnabled\n    $grpEmail.Controls.Add($chkEmailEnabled)\n    \n    $lblSMTPServer = New-Object System.Windows.Forms.Label\n    $lblSMTPServer.Location = New-Object System.Drawing.Point(10, 55)\n    $lblSMTPServer.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSMTPServer.Text = \"SMTP Server:\"\n    $grpEmail.Controls.Add($lblSMTPServer)\n    \n    $txtSMTPServer = New-Object System.Windows.Forms.TextBox\n    $txtSMTPServer.Location = New-Object System.Drawing.Point(140, 53)\n    $txtSMTPServer.Size = New-Object System.Drawing.Size(300, 20)\n    $txtSMTPServer.Text = $script:config.SMTPServer\n    $grpEmail.Controls.Add($txtSMTPServer)\n    \n    $lblSMTPPort = New-Object System.Windows.Forms.Label\n    $lblSMTPPort.Location = New-Object System.Drawing.Point(450, 55)\n    $lblSMTPPort.Size = New-Object System.Drawing.Size(40, 20)\n    $lblSMTPPort.Text = \"Port:\"\n    $grpEmail.Controls.Add($lblSMTPPort)\n    \n    $txtSMTPPort = New-Object System.Windows.Forms.TextBox\n    $txtSMTPPort.Location = New-Object System.Drawing.Point(490, 53)\n    $txtSMTPPort.Size = New-Object System.Drawing.Size(50, 20)\n    $txtSMTPPort.Text = $script:config.SMTPPort\n    $grpEmail.Controls.Add($txtSMTPPort)\n    \n    $lblSMTPUsername = New-Object System.Windows.Forms.Label\n    $lblSMTPUsername.Location = New-Object System.Drawing.Point(10, 85)\n    $lblSMTPUsername.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSMTPUsername.Text = \"Kullan\u0131c\u0131 Ad\u0131:\"\n    $grpEmail.Controls.Add($lblSMTPUsername)\n    \n    $txtSMTPUsername = New-Object System.Windows.Forms.TextBox\n    $txtSMTPUsername.Location = New-Object System.Drawing.Point(140, 83)\n    $txtSMTPUsername.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSMTPUsername.Text = $script:config.SMTPUsername\n    $grpEmail.Controls.Add($txtSMTPUsername)\n    \n    $lblSMTPPassword = New-Object System.Windows.Forms.Label\n    $lblSMTPPassword.Location = New-Object System.Drawing.Point(10, 115)\n    $lblSMTPPassword.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSMTPPassword.Text = \"\u015eifre:\"\n    $grpEmail.Controls.Add($lblSMTPPassword)\n    \n    $txtSMTPPassword = New-Object System.Windows.Forms.TextBox\n    $txtSMTPPassword.Location = New-Object System.Drawing.Point(140, 113)\n    $txtSMTPPassword.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSMTPPassword.Text = $script:config.SMTPPassword\n    $txtSMTPPassword.PasswordChar = '*'\n    $grpEmail.Controls.Add($txtSMTPPassword)\n    \n    $lblSMTPFrom = New-Object System.Windows.Forms.Label\n    $lblSMTPFrom.Location = New-Object System.Drawing.Point(10, 145)\n    $lblSMTPFrom.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSMTPFrom.Text = \"G&ouml;nderen Email:\"\n    $grpEmail.Controls.Add($lblSMTPFrom)\n    \n    $txtSMTPFrom = New-Object System.Windows.Forms.TextBox\n    $txtSMTPFrom.Location = New-Object System.Drawing.Point(140, 143)\n    $txtSMTPFrom.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSMTPFrom.Text = $script:config.SMTPFrom\n    $grpEmail.Controls.Add($txtSMTPFrom)\n    \n    $lblSMTPTo = New-Object System.Windows.Forms.Label\n    $lblSMTPTo.Location = New-Object System.Drawing.Point(10, 175)\n    $lblSMTPTo.Size = New-Object System.Drawing.Size(120, 20)\n    $lblSMTPTo.Text = \"Al\u0131c\u0131 Email:\"\n    $grpEmail.Controls.Add($lblSMTPTo)\n    \n    $txtSMTPTo = New-Object System.Windows.Forms.TextBox\n    $txtSMTPTo.Location = New-Object System.Drawing.Point(140, 173)\n    $txtSMTPTo.Size = New-Object System.Drawing.Size(400, 20)\n    $txtSMTPTo.Text = $script:config.SMTPTo\n    $grpEmail.Controls.Add($txtSMTPTo)\n    \n    $chkSMTPUseSSL = New-Object System.Windows.Forms.CheckBox\n    $chkSMTPUseSSL.Location = New-Object System.Drawing.Point(10, 205)\n    $chkSMTPUseSSL.Size = New-Object System.Drawing.Size(200, 20)\n    $chkSMTPUseSSL.Text = \"SSL Kullan\"\n    $chkSMTPUseSSL.Checked = $script:config.SMTPUseSSL\n    $grpEmail.Controls.Add($chkSMTPUseSSL)\n    \n    $yPos += 260\n    \n    # Zamanlay\u0131c\u0131 Ayarlar\u0131\n    $grpSchedule = New-Object System.Windows.Forms.GroupBox\n    $grpSchedule.Location = New-Object System.Drawing.Point(10, $yPos)\n    $grpSchedule.Size = New-Object System.Drawing.Size(560, 100)\n    $grpSchedule.Text = \"Otomatik G&ouml;rev Zamanlay\u0131c\u0131\"\n    $settingsForm.Controls.Add($grpSchedule)\n    \n    $chkScheduleEnabled = New-Object System.Windows.Forms.CheckBox\n    $chkScheduleEnabled.Location = New-Object System.Drawing.Point(10, 25)\n    $chkScheduleEnabled.Size = New-Object System.Drawing.Size(200, 20)\n    $chkScheduleEnabled.Text = \"Otomatik Test Aktif\"\n    $chkScheduleEnabled.Checked = $script:config.ScheduleEnabled\n    $grpSchedule.Controls.Add($chkScheduleEnabled)\n    \n    $lblInterval = New-Object System.Windows.Forms.Label\n    $lblInterval.Location = New-Object System.Drawing.Point(10, 55)\n    $lblInterval.Size = New-Object System.Drawing.Size(120, 20)\n    $lblInterval.Text = \"Test Aral\u0131\u011f\u0131 (dk):\"\n    $grpSchedule.Controls.Add($lblInterval)\n    \n    $txtInterval = New-Object System.Windows.Forms.NumericUpDown\n    $txtInterval.Location = New-Object System.Drawing.Point(140, 53)\n    $txtInterval.Size = New-Object System.Drawing.Size(100, 20)\n    $txtInterval.Minimum = 5\n    $txtInterval.Maximum = 1440\n    $txtInterval.Value = $script:config.ScheduleInterval\n    $grpSchedule.Controls.Add($txtInterval)\n    \n    $lblIntervalInfo = New-Object System.Windows.Forms.Label\n    $lblIntervalInfo.Location = New-Object System.Drawing.Point(250, 55)\n    $lblIntervalInfo.Size = New-Object System.Drawing.Size(290, 20)\n    $lblIntervalInfo.Text = \"(5-1440 dakika aras\u0131, &ouml;nerilen: 60)\"\n    $lblIntervalInfo.ForeColor = [System.Drawing.Color]::Gray\n    $grpSchedule.Controls.Add($lblIntervalInfo)\n    \n    $yPos += 120\n    \n    # Butonlar\n    $btnSave = New-Object System.Windows.Forms.Button\n    $btnSave.Location = New-Object System.Drawing.Point(350, $yPos)\n    $btnSave.Size = New-Object System.Drawing.Size(100, 30)\n    $btnSave.Text = \"Kaydet\"\n    $btnSave.BackColor = [System.Drawing.Color]::LightGreen\n    $btnSave.DialogResult = [System.Windows.Forms.DialogResult]::OK\n    $settingsForm.Controls.Add($btnSave)\n    \n    $btnCancel = New-Object System.Windows.Forms.Button\n    $btnCancel.Location = New-Object System.Drawing.Point(460, $yPos)\n    $btnCancel.Size = New-Object System.Drawing.Size(100, 30)\n    $btnCancel.Text = \"\u0130ptal\"\n    $btnCancel.BackColor = [System.Drawing.Color]::LightCoral\n    $btnCancel.DialogResult = [System.Windows.Forms.DialogResult]::Cancel\n    $settingsForm.Controls.Add($btnCancel)\n    \n    $btnSave.Add_Click({\n        # Ayarlar\u0131 kaydet\n        $script:config.ServerIP = $txtSettingsServerIP.Text.Trim()\n        $script:config.SharePath = $txtSettingsSharePath.Text.Trim()\n        $script:config.EmailEnabled = $chkEmailEnabled.Checked\n        $script:config.SMTPServer = $txtSMTPServer.Text.Trim()\n        $script:config.SMTPPort = [int]$txtSMTPPort.Text\n        $script:config.SMTPUsername = $txtSMTPUsername.Text.Trim()\n        $script:config.SMTPPassword = $txtSMTPPassword.Text\n        $script:config.SMTPFrom = $txtSMTPFrom.Text.Trim()\n        $script:config.SMTPTo = $txtSMTPTo.Text.Trim()\n        $script:config.SMTPUseSSL = $chkSMTPUseSSL.Checked\n        \n        $oldScheduleEnabled = $script:config.ScheduleEnabled\n        $script:config.ScheduleEnabled = $chkScheduleEnabled.Checked\n        $script:config.ScheduleInterval = [int]$txtInterval.Value\n        \n        if (Save-Config) {\n            # Zamanlay\u0131c\u0131 ayarlar\u0131n\u0131 uygula\n            if ($script:config.ScheduleEnabled -and -not $oldScheduleEnabled) {\n                Register-ScheduledTask -IntervalMinutes $script:config.ScheduleInterval\n            } elseif (-not $script:config.ScheduleEnabled -and $oldScheduleEnabled) {\n                Unregister-ScheduledTask\n            } elseif ($script:config.ScheduleEnabled) {\n                Register-ScheduledTask -IntervalMinutes $script:config.ScheduleInterval\n            }\n            \n            # Ana formdaki textbox'lar\u0131 g&uuml;ncelle\n            $txtServerIP.Text = $script:config.ServerIP\n            $txtSharePath.Text = $script:config.SharePath\n            \n            [System.Windows.Forms.MessageBox]::Show(\"Ayarlar ba\u015far\u0131yla kaydedildi!\", \"Bilgi\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)\n        }\n    })\n    \n    $settingsForm.AcceptButton = $btnSave\n    $settingsForm.CancelButton = $btnCancel\n    \n    [void]$settingsForm.ShowDialog()\n}\n#endregion\n\n#region Main GUI\n# Load configuration\nLoad-Config\n\nif ($AutoRun) {\n    # Otomatik &ccedil;al\u0131\u015ft\u0131rma modu - GUI olmadan\n    Write-Host \"Otomatik test ba\u015flat\u0131l\u0131yor...\" -ForegroundColor Green\n    \n    $timestamp = Get-Date -Format \"yyyyMMdd_HHmmss\"\n    $script:reportFile = Join-Path $script:OutputPath \"${timestamp}_OtomatikTest.txt\"\n    \n    $utf8BOM = New-Object System.Text.UTF8Encoding $true\n    $header = \"Test: OTOMAT\u0130K TEST`r`nTarih: $(Get-Date)`r`nSunucu: $env:COMPUTERNAME`r`n================================================================`r`n`r`n\"\n    [System.IO.File]::WriteAllText($script:reportFile, $header, $utf8BOM)\n    \n    # Testleri &ccedil;al\u0131\u015ft\u0131r\n    if ($script:config.ScheduleTests -contains \"Network\") {\n        Write-Host \"A\u011f Gecikme Testi...\" -ForegroundColor Yellow\n        Test-NetworkLatency\n    }\n    \n    if ($script:config.ScheduleTests -contains \"Bandwidth\") {\n        Write-Host \"Bant Geni\u015fli\u011fi Testi...\" -ForegroundColor Yellow\n        Test-Bandwidth\n    }\n    \n    if ($script:config.ScheduleTests -contains \"SMB\") {\n        Write-Host \"SMB Testi...\" -ForegroundColor Yellow\n        Test-SMBPerformance\n    }\n    \n    if ($script:config.ScheduleTests -contains \"IOPS\") {\n        Write-Host \"IOPS Testi...\" -ForegroundColor Yellow\n        Test-IOPS\n    }\n    \n    # Email g&ouml;nder\n    if ($script:config.EmailEnabled) {\n        Send-EmailReport -ReportFile $script:reportFile\n    }\n    \n    Write-Host \"Otomatik test tamamland\u0131!\" -ForegroundColor Green\n    exit 0\n}\n\n# GUI Mode\n$form = New-Object System.Windows.Forms.Form\n$form.Text = \"File Server Performance Test Tool v2.0\"\n$form.Size = New-Object System.Drawing.Size(900, 750)\n$form.StartPosition = \"CenterScreen\"\n$form.FormBorderStyle = \"FixedDialog\"\n$form.MaximizeBox = $false\n\n# Title Label\n$lblTitle = New-Object System.Windows.Forms.Label\n$lblTitle.Location = New-Object System.Drawing.Point(10, 10)\n$lblTitle.Size = New-Object System.Drawing.Size(860, 30)\n$lblTitle.Text = \"FILE SERVER PERFORMANCE TEST TOOL v2.0 - Advanced Edition\"\n$lblTitle.Font = New-Object System.Drawing.Font(\"Arial\", 12, [System.Drawing.FontStyle]::Bold)\n$lblTitle.ForeColor = [System.Drawing.Color]::DarkBlue\n$lblTitle.TextAlign = \"MiddleCenter\"\n$form.Controls.Add($lblTitle)\n\n# Input Group\n$groupInput = New-Object System.Windows.Forms.GroupBox\n$groupInput.Location = New-Object System.Drawing.Point(10, 50)\n$groupInput.Size = New-Object System.Drawing.Size(860, 80)\n$groupInput.Text = \"Test Parametreleri\"\n$form.Controls.Add($groupInput)\n\n# Server IP Label\n$lblServerIP = New-Object System.Windows.Forms.Label\n$lblServerIP.Location = New-Object System.Drawing.Point(10, 25)\n$lblServerIP.Size = New-Object System.Drawing.Size(100, 20)\n$lblServerIP.Text = \"Sunucu IP:\"\n$groupInput.Controls.Add($lblServerIP)\n\n# Server IP TextBox\n$txtServerIP = New-Object System.Windows.Forms.TextBox\n$txtServerIP.Location = New-Object System.Drawing.Point(120, 23)\n$txtServerIP.Size = New-Object System.Drawing.Size(300, 20)\n$txtServerIP.Text = $script:config.ServerIP\n$groupInput.Controls.Add($txtServerIP)\n\n# Share Path Label\n$lblSharePath = New-Object System.Windows.Forms.Label\n$lblSharePath.Location = New-Object System.Drawing.Point(10, 50)\n$lblSharePath.Size = New-Object System.Drawing.Size(100, 20)\n$lblSharePath.Text = \"Share Path:\"\n$groupInput.Controls.Add($lblSharePath)\n\n# Share Path TextBox\n$txtSharePath = New-Object System.Windows.Forms.TextBox\n$txtSharePath.Location = New-Object System.Drawing.Point(120, 48)\n$txtSharePath.Size = New-Object System.Drawing.Size(300, 20)\n$txtSharePath.Text = $script:config.SharePath\n$groupInput.Controls.Add($txtSharePath)\n\n# Settings Button\n$btnSettings = New-Object System.Windows.Forms.Button\n$btnSettings.Location = New-Object System.Drawing.Point(440, 23)\n$btnSettings.Size = New-Object System.Drawing.Size(130, 45)\n$btnSettings.Text = \"\u2699 Ayarlar\"\n$btnSettings.BackColor = [System.Drawing.Color]::LightSteelBlue\n$btnSettings.Font = New-Object System.Drawing.Font(\"Arial\", 10, [System.Drawing.FontStyle]::Bold)\n$groupInput.Controls.Add($btnSettings)\n\n# Status Label\n$lblStatus = New-Object System.Windows.Forms.Label\n$lblStatus.Location = New-Object System.Drawing.Point(590, 25)\n$lblStatus.Size = New-Object System.Drawing.Size(250, 45)\n$lblStatus.Text = \"Email: \" + $(if ($script:config.EmailEnabled) { \"Aktif \u2713\" } else { \"Pasif \u2717\" }) + \"`nZamanlay\u0131c\u0131: \" + $(if ($script:config.ScheduleEnabled) { \"Aktif \u2713\" } else { \"Pasif \u2717\" })\n$lblStatus.ForeColor = [System.Drawing.Color]::DarkGreen\n$groupInput.Controls.Add($lblStatus)\n\n# Test Buttons Group\n$groupTests = New-Object System.Windows.Forms.GroupBox\n$groupTests.Location = New-Object System.Drawing.Point(10, 140)\n$groupTests.Size = New-Object System.Drawing.Size(860, 100)\n$groupTests.Text = \"Test \u0130\u015flemleri\"\n$form.Controls.Add($groupTests)\n\n# Network Test Button\n$btnNetworkTest = New-Object System.Windows.Forms.Button\n$btnNetworkTest.Location = New-Object System.Drawing.Point(10, 25)\n$btnNetworkTest.Size = New-Object System.Drawing.Size(130, 30)\n$btnNetworkTest.Text = \"A\u011f Gecikme Testi\"\n$btnNetworkTest.BackColor = [System.Drawing.Color]::LightBlue\n$groupTests.Controls.Add($btnNetworkTest)\n\n# Bandwidth Test Button\n$btnBandwidthTest = New-Object System.Windows.Forms.Button\n$btnBandwidthTest.Location = New-Object System.Drawing.Point(150, 25)\n$btnBandwidthTest.Size = New-Object System.Drawing.Size(130, 30)\n$btnBandwidthTest.Text = \"Bant Geni\u015fli\u011fi Testi\"\n$btnBandwidthTest.BackColor = [System.Drawing.Color]::LightBlue\n$groupTests.Controls.Add($btnBandwidthTest)\n\n# SMB Test Button\n$btnSMBTest = New-Object System.Windows.Forms.Button\n$btnSMBTest.Location = New-Object System.Drawing.Point(290, 25)\n$btnSMBTest.Size = New-Object System.Drawing.Size(130, 30)\n$btnSMBTest.Text = \"SMB H\u0131z Testi\"\n$btnSMBTest.BackColor = [System.Drawing.Color]::LightBlue\n$groupTests.Controls.Add($btnSMBTest)\n\n# IOPS Test Button\n$btnIOPSTest = New-Object System.Windows.Forms.Button\n$btnIOPSTest.Location = New-Object System.Drawing.Point(430, 25)\n$btnIOPSTest.Size = New-Object System.Drawing.Size(130, 30)\n$btnIOPSTest.Text = \"IOPS Testi\"\n$btnIOPSTest.BackColor = [System.Drawing.Color]::LightBlue\n$groupTests.Controls.Add($btnIOPSTest)\n\n# Full Test Button\n$btnFullTest = New-Object System.Windows.Forms.Button\n$btnFullTest.Location = New-Object System.Drawing.Point(570, 25)\n$btnFullTest.Size = New-Object System.Drawing.Size(130, 30)\n$btnFullTest.Text = \"T&Uuml;M TESTLER\"\n$btnFullTest.BackColor = [System.Drawing.Color]::LightGreen\n$btnFullTest.Font = New-Object System.Drawing.Font(\"Arial\", 9, [System.Drawing.FontStyle]::Bold)\n$groupTests.Controls.Add($btnFullTest)\n\n# System Info Button\n$btnSystemInfo = New-Object System.Windows.Forms.Button\n$btnSystemInfo.Location = New-Object System.Drawing.Point(710, 25)\n$btnSystemInfo.Size = New-Object System.Drawing.Size(130, 30)\n$btnSystemInfo.Text = \"Sistem Bilgileri\"\n$btnSystemInfo.BackColor = [System.Drawing.Color]::LightYellow\n$groupTests.Controls.Add($btnSystemInfo)\n\n# Clear Log Button\n$btnClearLog = New-Object System.Windows.Forms.Button\n$btnClearLog.Location = New-Object System.Drawing.Point(10, 60)\n$btnClearLog.Size = New-Object System.Drawing.Size(130, 30)\n$btnClearLog.Text = \"Logu Temizle\"\n$btnClearLog.BackColor = [System.Drawing.Color]::LightGray\n$groupTests.Controls.Add($btnClearLog)\n\n# Save Report Button\n$btnSaveReport = New-Object System.Windows.Forms.Button\n$btnSaveReport.Location = New-Object System.Drawing.Point(150, 60)\n$btnSaveReport.Size = New-Object System.Drawing.Size(130, 30)\n$btnSaveReport.Text = \"Raporu A&ccedil;\"\n$btnSaveReport.BackColor = [System.Drawing.Color]::LightCoral\n$groupTests.Controls.Add($btnSaveReport)\n\n# Progress Bar\n$progressBar = New-Object System.Windows.Forms.ProgressBar\n$progressBar.Location = New-Object System.Drawing.Point(290, 65)\n$progressBar.Size = New-Object System.Drawing.Size(550, 20)\n$progressBar.Style = \"Marquee\"\n$progressBar.MarqueeAnimationSpeed = 30\n$progressBar.Visible = $false\n$groupTests.Controls.Add($progressBar)\n\n# Output TextBox\n$textBox = New-Object System.Windows.Forms.RichTextBox\n$textBox.Location = New-Object System.Drawing.Point(10, 250)\n$textBox.Size = New-Object System.Drawing.Size(860, 440)\n$textBox.Multiline = $true\n$textBox.ScrollBars = \"Vertical\"\n$textBox.Font = New-Object System.Drawing.Font(\"Consolas\", 9)\n$textBox.ReadOnly = $true\n$textBox.BackColor = [System.Drawing.Color]::White\n$form.Controls.Add($textBox)\n\nWrite-Log \"FILE SERVER PERFORMANCE TEST TOOL v2.0 - Advanced Edition\" \"Green\"\nWrite-Log \"========================================================`n\" \"Green\"\nWrite-Log \"Ho\u015fgeldiniz! L&uuml;tfen test parametrelerini girin ve test butonlar\u0131na t\u0131klay\u0131n.`n\"\nWrite-Log \"Ayarlar butonundan email ve zamanlay\u0131c\u0131 ayarlar\u0131n\u0131 yapabilirsiniz.`n\" \"Yellow\"\nWrite-Log \"Raporlar: $($script:OutputPath)`n\" \"Cyan\"\n\n#region Event Handlers\n$btnSettings.Add_Click({\n    Show-SettingsForm\n    # Status label'\u0131 g&uuml;ncelle\n    $lblStatus.Text = \"Email: \" + $(if ($script:config.EmailEnabled) { \"Aktif \u2713\" } else { \"Pasif \u2717\" }) + \"`nZamanlay\u0131c\u0131: \" + $(if ($script:config.ScheduleEnabled) { \"Aktif \u2713\" } else { \"Pasif \u2717\" })\n})\n\n$btnNetworkTest.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        $progressBar.Visible = $true\n        Test-NetworkLatency\n        if ($script:config.EmailEnabled -and -not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n            Send-EmailReport -ReportFile $script:reportFile\n        }\n        $progressBar.Visible = $false\n        Enable-Controls\n    }\n})\n\n$btnBandwidthTest.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        $progressBar.Visible = $true\n        Test-Bandwidth\n        if ($script:config.EmailEnabled -and -not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n            Send-EmailReport -ReportFile $script:reportFile\n        }\n        $progressBar.Visible = $false\n        Enable-Controls\n    }\n})\n\n$btnSMBTest.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        $progressBar.Visible = $true\n        Test-SMBPerformance\n        if ($script:config.EmailEnabled -and -not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n            Send-EmailReport -ReportFile $script:reportFile\n        }\n        $progressBar.Visible = $false\n        Enable-Controls\n    }\n})\n\n$btnIOPSTest.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        $progressBar.Visible = $true\n        Test-IOPS\n        if ($script:config.EmailEnabled -and -not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n            Send-EmailReport -ReportFile $script:reportFile\n        }\n        $progressBar.Visible = $false\n        Enable-Controls\n    }\n})\n\n$btnFullTest.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        $progressBar.Visible = $true\n        \n        # T&uuml;m testler i&ccedil;in tek bir dosya olu\u015ftur - UTF-8 BOM ile\n        $timestamp = Get-Date -Format \"yyyyMMdd_HHmmss\"\n        $script:reportFile = Join-Path $script:OutputPath \"${timestamp}_TumTestler.txt\"\n        \n        $utf8BOM = New-Object System.Text.UTF8Encoding $true\n        $header = \"Test: T&Uuml;M TESTLER`r`nTarih: $(Get-Date)`r`nSunucu: $env:COMPUTERNAME`r`n================================================================`r`n`r`n\"\n        [System.IO.File]::WriteAllText($script:reportFile, $header, $utf8BOM)\n        \n        Get-SystemInfo\n        Test-NetworkLatency\n        Test-Bandwidth\n        Test-SMBPerformance\n        Test-IOPS\n        Write-Log \"`n[OK] T&uuml;m testler tamamland\u0131!\" \"Green\"\n        Write-Log \"Rapor: $script:reportFile\" \"Cyan\"\n        \n        if ($script:config.EmailEnabled -and -not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n            Send-EmailReport -ReportFile $script:reportFile\n        }\n        \n        $progressBar.Visible = $false\n        Enable-Controls\n    }\n})\n\n$btnSystemInfo.Add_Click({\n    if (-not $script:isRunning) {\n        Disable-Controls\n        Get-SystemInfo\n        Enable-Controls\n    }\n})\n\n$btnClearLog.Add_Click({\n    $textBox.Clear()\n    Write-Log \"Log temizlendi.`n\" \"Yellow\"\n})\n\n$btnSaveReport.Add_Click({\n    if (-not [string]::IsNullOrEmpty($script:reportFile) -and (Test-Path $script:reportFile)) {\n        Start-Process notepad $script:reportFile\n    } else {\n        # Son olu\u015fturulan raporu bul\n        $latestReport = Get-ChildItem -Path $script:OutputPath -Filter \"*.txt\" -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1\n        if ($latestReport) {\n            Start-Process notepad $latestReport.FullName\n        } else {\n            [System.Windows.Forms.MessageBox]::Show(\"Hen&uuml;z bir rapor olu\u015fturulmad\u0131!\", \"Bilgi\", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)\n        }\n    }\n})\n\n$form.Add_FormClosing({\n    $result = [System.Windows.Forms.MessageBox]::Show(\"Programdan &ccedil;\u0131kmak istedi\u011finize emin misiniz?\", \"&Ccedil;\u0131k\u0131\u015f\", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)\n    if ($result -eq [System.Windows.Forms.DialogResult]::No) {\n        $_.Cancel = $true\n    }\n})\n#endregion\n\n# Show Form\n[void]$form.ShowDialog()\n<\/code><\/pre>","excerpt":"\u00a0File Server Performance Test Tool v2.0 ile sunucunuzun performans\u0131n\u0131 test edin","created_at":"2026-01-13 15:46:08","updated_at":"2026-09-07 01:15:46","category_id":9,"view_count":521,"reading_time":27,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-01-14 16:51:41","featured_image":"\/uploads\/images\/2026\/01\/6967c9993826c_1768409497.png","slug":"file-server-performance-test-tool-v2-0","category_name":"Yaz\u0131l\u0131m","category_slug":"yazilim","category_color":"#ef4444"},{"id":377,"title":"Windows Server 2019'da oturum a\u00e7ma\/kapama olaylar\u0131n\u0131 alma","content":"<p><strong>Script ne yapar:<\/strong><\/p>\n<ul>\n<li>\u2705 Ba\u015far\u0131l\u0131\/ba\u015far\u0131s\u0131z giri\u015fleri g&ouml;sterir<\/li>\n<li>\u2705 Oturum kapatma olaylar\u0131n\u0131 izler<\/li>\n<li>\u2705 RDP, konsol, network giri\u015flerini ay\u0131rt eder<\/li>\n<li>\u2705 Kaynak IP adreslerini g&ouml;sterir<\/li>\n<li>\u2705 &Ouml;zet istatistikler sunar<\/li>\n<li>\u2705 CSV'ye aktarma se&ccedil;ene\u011fi<\/li>\n<\/ul>\n<p><strong>Kullan\u0131m &ouml;rnekleri:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Temel kullan\u0131m (son 30 g&uuml;n)\n.\\script.ps1\n\nSon 7 g&uuml;n&uuml; g&ouml;ster\n.\\script.ps1 -GunSayisi 7\n\nBelirli bir kullan\u0131c\u0131 i&ccedil;in\n.\\script.ps1 -KullaniciAdi \"john.doe\"\n\nSon 90 g&uuml;n, belirli kullan\u0131c\u0131\n.\\script.ps1 -GunSayisi 90 -KullaniciAdi \"admin\"\n<\/code><\/pre>\n<p><strong>&Ouml;nemli notlar:<\/strong><\/p>\n<ul>\n<li>PowerShell'i <strong>y&ouml;netici olarak<\/strong> &ccedil;al\u0131\u015ft\u0131rmal\u0131s\u0131n\u0131z<\/li>\n<li>Security event log'lar\u0131na eri\u015fim gereklidir<\/li>\n<li>Sistem hesaplar\u0131 (SYSTEM, NETWORK SERVICE vb.) otomatik filtrelenir<\/li>\n<\/ul>\n<p>Script, t&uuml;m oturum aktivitelerini detayl\u0131 \u015fekilde g&ouml;sterecek ve iste\u011fe ba\u011fl\u0131 olarak CSV format\u0131nda kaydedebilecektir.<\/p>\n<pre class=\"language-markup\"><code>param(\n    [int]$GunSayisi = 365,\n    [string]$KullaniciAdi = \"*\"\n)\n\nWrite-Host \"========================================\" -ForegroundColor Cyan\nWrite-Host \"Windows Server Oturum Aktivite Raporu\" -ForegroundColor Cyan\nWrite-Host \"========================================\" -ForegroundColor Cyan\nWrite-Host \"\"\n\n$BaslangicTarihi = (Get-Date).AddDays(-$GunSayisi)\n\nWrite-Host \"Tarih Aral\u0131\u011f\u0131: $($BaslangicTarihi.ToString('dd.MM.yyyy HH:mm')) - $(Get-Date -Format 'dd.MM.yyyy HH:mm')\" -ForegroundColor Yellow\nWrite-Host \"Loglar taran\u0131yor, l&uuml;tfen bekleyin...\" -ForegroundColor Yellow\nWrite-Host \"\"\n\n# Event ID'ler:\n# 4624 - Ba\u015far\u0131l\u0131 oturum a&ccedil;ma\n# 4625 - Ba\u015far\u0131s\u0131z oturum a&ccedil;ma\n# 4634 - Oturum kapatma\n# 4647 - Kullan\u0131c\u0131 taraf\u0131ndan oturum kapatma\n# 4648 - Farkl\u0131 kimlik bilgileriyle oturum a&ccedil;ma\n\n$EventIDs = @(4624, 4625, 4634, 4647, 4648)\n\ntry {\n    $Olaylar = Get-WinEvent -FilterHashtable @{\n        LogName = 'Security'\n        ID = $EventIDs\n        StartTime = $BaslangicTarihi\n    } -ErrorAction SilentlyContinue | ForEach-Object {\n        $Olay = $_\n        $KullaniciAdiBilgi = \"\"\n        $OturumTipi = \"\"\n        $Durum = \"\"\n        \n        switch ($Olay.Id) {\n            4624 { \n                $Durum = \"Ba\u015far\u0131l\u0131 Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = switch ($Olay.Properties[8].Value) {\n                    2 { \"Interaktif (Konsol)\" }\n                    3 { \"Network\" }\n                    4 { \"Batch\" }\n                    5 { \"Service\" }\n                    7 { \"Unlock\" }\n                    8 { \"NetworkCleartext\" }\n                    9 { \"NewCredentials\" }\n                    10 { \"RemoteInteractive (RDP)\" }\n                    11 { \"CachedInteractive\" }\n                    default { \"Di\u011fer ($($Olay.Properties[8].Value))\" }\n                }\n            }\n            4625 { \n                $Durum = \"Ba\u015far\u0131s\u0131z Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = \"Ba\u015far\u0131s\u0131z Deneme\"\n            }\n            4634 { \n                $Durum = \"Oturum Kapatma\"\n                $KullaniciAdiBilgi = $Olay.Properties[1].Value\n                $OturumTipi = \"Logoff\"\n            }\n            4647 { \n                $Durum = \"Kullan\u0131c\u0131 &Ccedil;\u0131k\u0131\u015f\u0131\"\n                $KullaniciAdiBilgi = $Olay.Properties[1].Value\n                $OturumTipi = \"User Initiated\"\n            }\n            4648 { \n                $Durum = \"Farkl\u0131 Kimlik ile Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = \"Explicit Credentials\"\n            }\n        }\n        \n        if ($KullaniciAdi -ne \"*\" -and $KullaniciAdiBilgi -notlike \"*$KullaniciAdi*\") {\n            return\n        }\n        \n        if ($KullaniciAdiBilgi -match '^(SYSTEM|ANONYMOUS|LOCAL SERVICE|NETWORK SERVICE)$') {\n            return\n        }\n        \n        [PSCustomObject]@{\n            Zaman = $Olay.TimeCreated\n            EventID = $Olay.Id\n            Durum = $Durum\n            KullaniciAdi = $KullaniciAdiBilgi\n            OturumTipi = $OturumTipi\n            BilgisayarAdi = $Olay.MachineName\n            KaynakIP = if ($Olay.Properties[18].Value) { $Olay.Properties[18].Value } else { \"N\/A\" }\n        }\n    }\n    \n\n    if ($Olaylar) {\n        $Olaylar = $Olaylar | Sort-Object Zaman -Descending\n        \n        Write-Host \"Toplam Olay Say\u0131s\u0131: $($Olaylar.Count)\" -ForegroundColor Green\n        Write-Host \"\"\n        \n        $Olaylar | Format-Table -AutoSize @(\n            @{Label=\"Tarih\/Saat\"; Expression={$_.Zaman.ToString(\"dd.MM.yyyy HH:mm:ss\")}; Width=20}\n            @{Label=\"Durum\"; Expression={$_.Durum}; Width=25}\n            @{Label=\"Kullan\u0131c\u0131\"; Expression={$_.KullaniciAdi}; Width=20}\n            @{Label=\"Oturum Tipi\"; Expression={$_.OturumTipi}; Width=25}\n            @{Label=\"Kaynak IP\"; Expression={$_.KaynakIP}; Width=15}\n        )\n        \n        Write-Host \"`n========================================\" -ForegroundColor Cyan\n        Write-Host \"&Ouml;ZET \u0130STAT\u0130ST\u0130KLER\" -ForegroundColor Cyan\n        Write-Host \"========================================\" -ForegroundColor Cyan\n        \n        $Olaylar | Group-Object Durum | ForEach-Object {\n            Write-Host \"$($_.Name): $($_.Count)\" -ForegroundColor Yellow\n        }\n        \n        Write-Host \"`nEn Aktif Kullan\u0131c\u0131lar:\" -ForegroundColor Cyan\n        $Olaylar | Group-Object KullaniciAdi | Sort-Object Count -Descending | Select-Object -First 5 | ForEach-Object {\n            Write-Host \"  $($_.Name): $($_.Count) olay\" -ForegroundColor White\n        }\n        \n        Write-Host \"`n\" -NoNewline\n        $Cevap = Read-Host \"Sonu&ccedil;lar\u0131 CSV dosyas\u0131na kaydetmek ister misiniz? (E\/H)\"\n        if ($Cevap -eq 'E') {\n            $DosyaYolu = \"C:\\LoginActivity_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv\"\n            $Olaylar | Export-Csv -Path $DosyaYolu -NoTypeInformation -Encoding UTF8\n            Write-Host \"Rapor kaydedildi: $DosyaYolu\" -ForegroundColor Green\n        }\n        \n    } else {\n        Write-Host \"Belirtilen kriterlere uygun olay bulunamad\u0131.\" -ForegroundColor Red\n    }\n    \n} catch {\n    Write-Host \"HATA: $($_.Exception.Message)\" -ForegroundColor Red\n    Write-Host \"Not: Bu scripti y&ouml;netici olarak &ccedil;al\u0131\u015ft\u0131rman\u0131z gerekebilir.\" -ForegroundColor Yellow\n}\n\nWrite-Host \"`n\u0130\u015flem tamamland\u0131.\" -ForegroundColor Green<\/code><\/pre>","excerpt":"Windows Server 2019'da oturum a\u00e7ma\/kapama olaylar\u0131n\u0131 alma","created_at":"2026-01-05 12:59:55","updated_at":"2026-09-07 08:40:53","category_id":6,"view_count":434,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-01-05 09:59:55","featured_image":"\/uploads\/images\/2026\/01\/695b8b969cf1f_1767607190.png","slug":"windows-server-2019-da-oturum-acma-kapama-olaylarini-alma","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":367,"title":"Network Shares Denetimini Hafife Almay\u0131n","content":"<p>Kurumsal a\u011flarda g&uuml;venlik a&ccedil;\u0131klar\u0131 denildi\u011finde akla genellikle&nbsp;<strong>zararl\u0131 yaz\u0131l\u0131mlar, zay\u0131f parolalar veya g&uuml;ncel olmayan sistemler<\/strong> gelir.<br>Ancak pratikte en s\u0131k kar\u015f\u0131la\u015f\u0131lan &mdash; ve en &ccedil;ok g&ouml;zden ka&ccedil;an &mdash; risklerden biri <strong>a&ccedil;\u0131k unutulmu\u015f network payla\u015f\u0131mlar\u0131d\u0131r<\/strong>.<\/p>\n<p><iframe style=\"width: 674px; height: 379px;\" src=\"https:\/\/www.youtube.com\/embed\/uFDepQ-aC4M\" width=\"674\" height=\"379\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>Bir dosya transferi i&ccedil;in ge&ccedil;ici olarak a&ccedil;\u0131lan bir klas&ouml;r,<br>bir departmana &ldquo;\u015fimdilik&rdquo; verilen eri\u015fim,<br>ya da test ama&ccedil;l\u0131 payla\u015f\u0131ma a&ccedil;\u0131lan bir dizin&hellip;<\/p>\n<p>Bunlar\u0131n her biri, fark edilmeden <strong>aylarca hatta y\u0131llarca sessiz bir a&ccedil;\u0131k kap\u0131<\/strong> h&acirc;line gelebilir.<\/p>\n<p>Bir IT y&ouml;neticisi i&ccedil;in sorulmas\u0131 gereken kritik soru \u015fudur:<\/p>\n<blockquote>\n<p><strong>&ldquo;A\u011f\u0131mda \u015fu anda kim, neyi, neden payla\u015f\u0131yor?&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>Bu soruya net ve h\u0131zl\u0131 bir cevap veremiyorsan\u0131z,<br>orada <strong>y&ouml;netilmeyen bir risk<\/strong> vard\u0131r.<\/p>\n<p>Kurumsal siber g&uuml;venlik stratejilerinde a\u011f payla\u015f\u0131mlar\u0131 (network shares), genellikle zararl\u0131 yaz\u0131l\u0131mlar veya zay\u0131f parolalar kadar dikkat &ccedil;ekmese de asl\u0131nda <strong>en s\u0131k kar\u015f\u0131la\u015f\u0131lan ve en &ccedil;ok g&ouml;zden ka&ccedil;an<\/strong> risk alanlar\u0131ndan biridir. Bir dosya transferi i&ccedil;in ge&ccedil;ici a&ccedil;\u0131lan klas&ouml;rler veya test ama&ccedil;l\u0131 payla\u015f\u0131lan dizinler, aylar hatta y\u0131llar boyunca <strong>\"sessiz bir a&ccedil;\u0131k kap\u0131\"<\/strong> olarak kalabilmektedir.<\/p>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n kurumsal g&uuml;venlikteki kritik &ouml;nemi ve bar\u0131nd\u0131rd\u0131\u011f\u0131 temel riskler \u015fu \u015fekilde detayland\u0131r\u0131labilir:<\/p>\n<h3>Kritik &Ouml;nemi ve Y&ouml;netim Gereklili\u011fi<\/h3>\n<p>A\u011f payla\u015f\u0131mlar\u0131 do\u011frudan <strong>veriye eri\u015fim<\/strong> anlam\u0131na geldi\u011fi i&ccedil;in kurumsal stratejinin merkezinde yer almal\u0131d\u0131r. Ger&ccedil;ek g&uuml;venlik, sadece tehditleri engellemek de\u011fil, <strong>kurumun neye sahip oldu\u011funu ve bu verilere kimlerin eri\u015fti\u011fini bilmesidir<\/strong>. E\u011fer bir IT y&ouml;neticisi a\u011fda \"\u015fu anda kimin, neyi, neden payla\u015ft\u0131\u011f\u0131n\u0131\" net bir \u015fekilde a&ccedil;\u0131klayam\u0131yorsa, orada <strong>y&ouml;netilmeyen bir risk<\/strong> mevcuttur.<\/p>\n<h3>Temel Riskler<\/h3>\n<p>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya a&ccedil;\u0131k unutulmu\u015f a\u011f payla\u015f\u0131mlar\u0131 \u015fu ciddi sorunlara yol a&ccedil;abilir:<\/p>\n<ul>\n<li><strong>Yatay Yay\u0131lma (Lateral Movement):<\/strong> Fidye yaz\u0131l\u0131mlar\u0131n\u0131n (ransomware) a\u011f i&ccedil;erisinde makineler aras\u0131nda kolayca yay\u0131lmas\u0131na zemin haz\u0131rlar.<\/li>\n<li><strong>Yetkisiz Eri\u015fim ve Veri S\u0131z\u0131nt\u0131s\u0131:<\/strong> Hassas dosyalara yetkisiz kullan\u0131c\u0131lar\u0131n ula\u015fmas\u0131na veya i&ccedil; tehditlerin fark edilmeden veri s\u0131zd\u0131rmas\u0131na neden olur.<\/li>\n<li><strong>Loglarda Sessiz Kalma:<\/strong> Bu risklerin &ccedil;o\u011fu sistem loglar\u0131nda alarm &uuml;retmez veya \"ba\u011f\u0131rmaz\"; sadece orada sessizce beklerler.<\/li>\n<li><strong>Uyum Sorunlar\u0131:<\/strong> KVKK ve ISO 27001 gibi yasal denetim ve uyumluluk s&uuml;re&ccedil;lerinde ciddi eksiklikler yarat\u0131r.<\/li>\n<\/ul>\n<h3>En Tehlikeli Payla\u015f\u0131m T&uuml;rleri<\/h3>\n<p>Kaynaklara g&ouml;re en tehlikeli payla\u015f\u0131mlar, <strong>\"kimsenin hat\u0131rlamad\u0131\u011f\u0131 ama herkesin eri\u015febildi\u011fi\"<\/strong> payla\u015f\u0131mlard\u0131r. &Ouml;zellikle \u015funlar y&uuml;ksek risk ta\u015f\u0131r:<\/p>\n<ul>\n<li><strong>\"Everyone\"<\/strong> veya &ccedil;ok geni\u015f gruplara a&ccedil;\u0131k olan dizinler.<\/li>\n<li>Eski projelere ait, i\u015fi bitmi\u015f ancak kapat\u0131lmam\u0131\u015f klas&ouml;rler.<\/li>\n<li>Backup (yedekleme) veya log klas&ouml;rlerinin yanl\u0131\u015fl\u0131kla payla\u015f\u0131ma a&ccedil;\u0131lmas\u0131.<\/li>\n<li>Kullan\u0131c\u0131lar\u0131n kendi profil dizinleri alt\u0131nda manuel olarak a&ccedil;t\u0131\u011f\u0131 payla\u015f\u0131mlar,.<\/li>\n<\/ul>\n<h3>Stratejik Yakla\u015f\u0131m ve Denetim<\/h3>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n denetimi, \"bir kez yap\u0131ld\u0131 ve bitti\" denilecek bir i\u015f de\u011fildir; bu s&uuml;recin <strong>periyodik, raporlanabilir ve standartla\u015ft\u0131r\u0131lm\u0131\u015f<\/strong> olmas\u0131 gerekir. Tek bir makine &uuml;zerinde <code>net share<\/code> komutuyla yerel g&ouml;r&uuml;n&uuml;rl&uuml;k sa\u011flanabilse de, kurumsal a\u011flarda as\u0131l de\u011fer <strong>Active Directory (domain) seviyesinde g&ouml;r&uuml;n&uuml;rl&uuml;k<\/strong> elde etmektir,. PowerShell gibi ara&ccedil;lar kullan\u0131larak domain genelindeki t&uuml;m a&ccedil;\u0131k SMB payla\u015f\u0131mlar\u0131n\u0131n d&uuml;zenli olarak taranmas\u0131, \"bilmiyordum\" l&uuml;ks&uuml;n&uuml; ortadan kald\u0131rarak g&uuml;venli\u011fi art\u0131r\u0131r,.<\/p>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n y&ouml;netimi, binan\u0131n giri\u015fine en geli\u015fmi\u015f &ccedil;elik kap\u0131y\u0131 (firewall\/antivir&uuml;s) tak\u0131p, arka taraftaki pencerelerden birini (a&ccedil;\u0131k unutulmu\u015f klas&ouml;r) sonuna kadar a&ccedil;\u0131k b\u0131rakmaya benzer; kap\u0131 ne kadar sa\u011flam olursa olsun, pencereyi bilen biri i&ccedil;eri s\u0131zabilir.<\/p>\n<p>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya a&ccedil;\u0131k unutulmu\u015f a\u011f payla\u015f\u0131mlar\u0131, kurumsal a\u011flarda genellikle zararl\u0131 yaz\u0131l\u0131mlar veya zay\u0131f parolalar kadar dikkat &ccedil;ekmese de en s\u0131k kar\u015f\u0131la\u015f\u0131lan ve en &ccedil;ok g&ouml;zden ka&ccedil;an g&uuml;venlik risklerinden biridir. Bu payla\u015f\u0131mlar, fark edilmeden aylar hatta y\u0131llar boyunca <strong>\"sessiz bir a&ccedil;\u0131k kap\u0131\"<\/strong> olarak kalabilmektedir.<\/p>\n<p>Kaynaklara g&ouml;re, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f a\u011f payla\u015f\u0131mlar\u0131n\u0131n neden olabilece\u011fi temel siber riskler \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Yetkisiz Veri Eri\u015fimi:<\/strong> Hassas dosyalar\u0131n yetkisi olmayan kullan\u0131c\u0131lar taraf\u0131ndan g&ouml;r&uuml;nt&uuml;lenmesine veya de\u011fi\u015ftirilmesine yol a&ccedil;ar.<\/li>\n<li><strong>Yatay Yay\u0131lma (Lateral Movement):<\/strong> &Ouml;zellikle <strong>fidye yaz\u0131l\u0131mlar\u0131n\u0131n (ransomware)<\/strong> a\u011f i&ccedil;erisinde makineler aras\u0131nda kolayca yay\u0131lmas\u0131na zemin haz\u0131rlar.<\/li>\n<li><strong>\u0130&ccedil; Tehditler:<\/strong> K&ouml;t&uuml; niyetli veya dikkatsiz &ccedil;al\u0131\u015fanlar\u0131n (i&ccedil; tehditlerin), fark edilmeden veri s\u0131zd\u0131rmas\u0131na olanak tan\u0131r.<\/li>\n<li><strong>Denetim ve Uyumluluk Sorunlar\u0131:<\/strong> <strong>KVKK ve ISO 27001<\/strong> gibi yasal d&uuml;zenlemeler ve standartlara uyum konusunda ciddi a&ccedil;\u0131klar yaratarak yasal riskler olu\u015fturur.<\/li>\n<li><strong>G&ouml;r&uuml;nmezlik ve Log Sessizli\u011fi:<\/strong> Bu t&uuml;r risklerin en tehlikeli y&ouml;nlerinden biri, <strong>loglarda \"ba\u011f\u0131rmamas\u0131\"<\/strong> veya sistemlerde otomatik bir alarm &uuml;retmemesidir; risk orada sessizce bekler.<\/li>\n<li><strong>Y&ouml;netilemeyen Risk:<\/strong> E\u011fer bir IT y&ouml;neticisi a\u011fda \"kimin, neyi, neden payla\u015ft\u0131\u011f\u0131n\u0131\" net olarak g&ouml;remiyorsa, bu durum do\u011frudan y&ouml;netilemeyen bir riskin varl\u0131\u011f\u0131na i\u015farettir.<\/li>\n<\/ul>\n<p>&Ouml;zellikle <strong>\"Everyone\"<\/strong> veya &ccedil;ok geni\u015f gruplara a&ccedil;\u0131k dizinler, eski projelere ait unutulmu\u015f klas&ouml;rler, kullan\u0131c\u0131lar\u0131n manuel olarak a&ccedil;t\u0131\u011f\u0131 payla\u015f\u0131mlar ve yanl\u0131\u015fl\u0131kla payla\u015f\u0131lan <strong>yedekleme (backup) veya log klas&ouml;rleri<\/strong> en y&uuml;ksek risk grubunda yer almaktad\u0131r.<\/p>\n<p>Bu durumu bir binan\u0131n g&uuml;venli\u011fine benzetebiliriz: Binan\u0131n giri\u015fine en geli\u015fmi\u015f &ccedil;elik kap\u0131y\u0131 ve g&uuml;venlik kameralar\u0131n\u0131 (firewall ve antivir&uuml;s) yerle\u015ftirseniz bile, arka tarafta kimsenin hat\u0131rlamad\u0131\u011f\u0131 a&ccedil;\u0131k bir pencere (hatal\u0131 a\u011f payla\u015f\u0131m\u0131) b\u0131rakt\u0131\u011f\u0131n\u0131zda, t&uuml;m g&uuml;venlik &ouml;nlemleri i\u015flevsiz kalabilir.<\/p>\n<hr>\n<h2>Neden Network Payla\u015f\u0131mlar\u0131 Tehlikelidir?<\/h2>\n<p>Network payla\u015f\u0131mlar\u0131 do\u011frudan <strong>veriye eri\u015fim<\/strong> anlam\u0131na gelir.<br>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f bir payla\u015f\u0131m;<\/p>\n<ul>\n<li>\n<p>Yetkisiz kullan\u0131c\u0131lar\u0131n hassas dosyalara ula\u015fmas\u0131na<\/p>\n<\/li>\n<li>\n<p>Fidye yaz\u0131l\u0131mlar\u0131n\u0131n yatay olarak yay\u0131lmas\u0131na<\/p>\n<\/li>\n<li>\n<p>\u0130&ccedil; tehditlerin fark edilmeden veri s\u0131zd\u0131rmas\u0131na<\/p>\n<\/li>\n<li>\n<p>Denetim ve uyumluluk (KVKK, ISO 27001 vb.) sorunlar\u0131na<\/p>\n<\/li>\n<\/ul>\n<p>neden olabilir.<\/p>\n<p>&Uuml;stelik bu risklerin &ccedil;o\u011fu <strong>loglarda ba\u011f\u0131rmaz<\/strong>, alarm &uuml;retmez.<br>Sadece oradad\u0131r&hellip; sessizce.<\/p>\n<hr>\n<h2>Yakla\u015f\u0131m 1: Lokal G&ouml;r&uuml;n&uuml;rl&uuml;k (Tek Makine Kontrol&uuml;)<\/h2>\n<p>Basit ama etkili bir ilk ad\u0131m olarak, \u015f&uuml;pheli herhangi bir Windows makinesinde a\u015fa\u011f\u0131daki komut yeterlidir.<\/p>\n<p><strong>CMD (Run as Administrator):<\/strong><\/p>\n<pre><code class=\"language-cmd\">net share\n<\/code><\/pre>\n<p>Bu komut tek ekranda \u015funlar\u0131 g&ouml;sterir:<\/p>\n<ul>\n<li>\n<p>A&ccedil;\u0131k kullan\u0131c\u0131 payla\u015f\u0131mlar\u0131<\/p>\n<\/li>\n<li>\n<p>Gizli y&ouml;netici payla\u015f\u0131mlar\u0131 (C$, ADMIN$)<\/p>\n<\/li>\n<li>\n<p>Beklenmeyen veya unutulmu\u015f klas&ouml;rler<\/p>\n<\/li>\n<\/ul>\n<p>&Ouml;zellikle <strong>kullan\u0131c\u0131 taraf\u0131ndan manuel a&ccedil;\u0131lm\u0131\u015f<\/strong> payla\u015f\u0131mlar burada h\u0131zl\u0131ca fark edilir.<\/p>\n<p>Bu kontrol, bireysel makineler i&ccedil;in iyi bir ba\u015flang\u0131&ccedil;t\u0131r;<br>ancak kurumsal a\u011flar i&ccedil;in <strong>yeterli de\u011fildir<\/strong>.<\/p>\n<hr>\n<h2>Yakla\u015f\u0131m 2: Domain Genelinde G&ouml;r&uuml;n&uuml;rl&uuml;k (Ger&ccedil;ek Denetim)<\/h2>\n<p>Active Directory ortamlar\u0131nda as\u0131l de\u011fer,<br>lokal de\u011fil <strong>domain seviyesinde g&ouml;r&uuml;n&uuml;rl&uuml;k<\/strong> sa\u011flamakt\u0131r.<\/p>\n<p>Domain Admin yetkileriyle &ccedil;al\u0131\u015ft\u0131r\u0131labilecek &ouml;rnek bir PowerShell yakla\u015f\u0131m\u0131:<\/p>\n<pre><code class=\"language-powershell\">Get-ADComputer -Filter * | ForEach-Object {\n    try {\n        $shares = Get-SmbShare -CimSession $_.Name -ErrorAction SilentlyContinue\n        if ($shares) {\n            [PSCustomObject]@{\n                ComputerName = $_.Name\n                ShareName    = $shares.Name -join ', '\n                Path         = $shares.Path -join ' | '\n            }\n        }\n    } catch {}\n} | Format-Table -AutoSize\n<\/code><\/pre>\n<p>Bu script sayesinde:<\/p>\n<ul>\n<li>\n<p>Domain&rsquo;e ba\u011fl\u0131 t&uuml;m makineler taran\u0131r<\/p>\n<\/li>\n<li>\n<p>A&ccedil;\u0131k SMB payla\u015f\u0131mlar\u0131 listelenir<\/p>\n<\/li>\n<li>\n<p>Hangi makinede, hangi klas&ouml;r&uuml;n payla\u015f\u0131ld\u0131\u011f\u0131 netle\u015fir<\/p>\n<\/li>\n<\/ul>\n<p>Bu noktadan sonra art\u0131k <strong>&ldquo;bilmiyordum&rdquo;<\/strong> deme l&uuml;ks&uuml; yoktur.<\/p>\n<hr>\n<h2>Teknik Not<\/h2>\n<p>Bu komutun &ccedil;al\u0131\u015fabilmesi i&ccedil;in:<\/p>\n<ul>\n<li>\n<p><strong>Active Directory PowerShell mod&uuml;l&uuml; (RSAT)<\/strong> y&uuml;kl&uuml; olmal\u0131d\u0131r<\/p>\n<\/li>\n<li>\n<p>Aksi h&acirc;lde <code>Get-ADComputer<\/code> hatas\u0131 al\u0131n\u0131r<\/p>\n<\/li>\n<\/ul>\n<p>Kurumsal ortamlarda bu mod&uuml;l genellikle Domain Controller veya y&ouml;netim makinelerinde haz\u0131r bulunur.<\/p>\n<hr>\n<h2>En Tehlikeli Payla\u015f\u0131mlar Hangileridir?<\/h2>\n<blockquote>\n<p><strong>&ldquo;En tehlikeli payla\u015f\u0131mlar,<br>kimsenin hat\u0131rlamad\u0131\u011f\u0131 ama herkesin eri\u015febildi\u011fi payla\u015f\u0131mlard\u0131r.&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>&Ouml;zellikle dikkat edilmesi gerekenler:<\/p>\n<ul>\n<li>\n<p><code>Everyone<\/code> veya geni\u015f gruplara a&ccedil;\u0131k dizinler<\/p>\n<\/li>\n<li>\n<p>Eski projelere ait unutulmu\u015f klas&ouml;rler<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 profil dizinleri alt\u0131ndaki payla\u015f\u0131mlar<\/p>\n<\/li>\n<li>\n<p>Backup veya log klas&ouml;rlerinin yanl\u0131\u015fl\u0131kla payla\u015f\u0131lmas\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Denetim Tek Seferlik Olmamal\u0131<\/h2>\n<p>Network share kontrolleri;<\/p>\n<ul>\n<li>\n<p>Tek seferlik yap\u0131lan bir i\u015f de\u011fil<\/p>\n<\/li>\n<li>\n<p>&ldquo;Bug&uuml;n bakt\u0131k, tamam&rdquo; denilecek bir konu de\u011fil<\/p>\n<\/li>\n<\/ul>\n<p>Bu s&uuml;re&ccedil;:<\/p>\n<ul>\n<li>\n<p><strong>Periyodik<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Raporlanabilir<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Standartla\u015ft\u0131r\u0131lm\u0131\u015f<\/strong><\/p>\n<\/li>\n<\/ul>\n<p>olmal\u0131d\u0131r.<\/p>\n<p>Aksi h&acirc;lde en iyi firewall, en g&uuml;ncel antivir&uuml;s bile<br>i&ccedil;erideki bu <strong>sessiz a&ccedil;\u0131k kap\u0131y\u0131<\/strong> kapatamaz.<\/p>\n<hr>\n<p>Network payla\u015f\u0131mlar\u0131 k&uuml;&ccedil;&uuml;k gibi g&ouml;r&uuml;nen ama etkisi b&uuml;y&uuml;k risklerdir.<br>Ger&ccedil;ek g&uuml;venlik, sadece tehditleri engellemek de\u011fil,<br><strong>neye sahip oldu\u011funuzu ve kimin eri\u015fti\u011fini bilmektir.<\/strong><\/p>\n<p>Bug&uuml;n kendinize \u015fu soruyu sorun:<\/p>\n<blockquote>\n<p><strong>&ldquo;\u015eu anda a\u011f\u0131mda ka&ccedil; payla\u015f\u0131m var ve ben bunlar\u0131n ka&ccedil;\u0131n\u0131 ger&ccedil;ekten biliyorum?&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>Cevap net de\u011filse,<br>ilk risk zaten ortaya &ccedil;\u0131km\u0131\u015f demektir.<\/p>","excerpt":"Kurumsal a\u011flarda g\u00fcvenlik a\u00e7\u0131klar\u0131 denildi\u011finde akla genellikle\u00a0zararl\u0131 yaz\u0131l\u0131mlar, zay\u0131f parolalar veya g\u00fcncel olmayan sistemler gelir.\nAncak pratikte en s\u0131k kar\u015f\u0131la\u015f\u0131lan \u2014 ve en \u00e7ok g\u00f6zden ka\u00e7an \u2014 risklerden biri a\u00e7\u0131k unutulmu\u015f network payla\u015f\u0131mlar\u0131d\u0131r.","created_at":"2025-12-21 08:55:44","updated_at":"2026-09-23 13:09:30","category_id":7,"view_count":575,"reading_time":9,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-21 05:55:44","featured_image":"\/uploads\/images\/2025\/12\/69478bd4b8286_1766296532.png","slug":"network-shares-denetimini-hafife-almayin","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":361,"title":"Windows Sunucularda SMB Ba\u011flant\u0131lar\u0131n\u0131n Derin Analizi","content":"<h2>PID 4, Netstat &Ccedil;\u0131kt\u0131lar\u0131 ve Hangi Dosyalara Eri\u015fildi\u011finin Tespiti<\/h2>\r\n<p><iframe src=\"https:\/\/www.youtube.com\/embed\/P_R3bEC5TME?si=rdq0wSKw0vVeMS72\" width=\"560\" height=\"314\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\r\n<p>Kurumsal a\u011flarda dosya sunucular\u0131 h&acirc;l&acirc; kritik &ouml;neme sahip bile\u015fenlerdir. Kullan\u0131c\u0131lar\u0131n g&uuml;nl&uuml;k i\u015flemleri, payla\u015f\u0131lan klas&ouml;r yap\u0131lar\u0131, departman dizinleri, otomasyon yaz\u0131l\u0131mlar\u0131n\u0131n dosya tabanl\u0131 s&uuml;re&ccedil;leri gibi pek &ccedil;ok aktivite, SMB (Server Message Block) protokol&uuml; &uuml;zerinden ger&ccedil;ekle\u015fir.<\/p>\r\n<p>Bir sistem y&ouml;neticisi olarak, dosya sunucular\u0131n\u0131 incelerken kar\u015f\u0131m\u0131za s\u0131k s\u0131k baz\u0131 sorular &ccedil;\u0131kar:<\/p>\r\n<p>&nbsp;Hangi istemci sunucuma ba\u011flan\u0131yor?<br>&nbsp;Bu istemci hangi payla\u015f\u0131m klas&ouml;rlerine eri\u015fiyor?<br>&nbsp;A&ccedil;t\u0131\u011f\u0131 dosyalar neler?<br>&nbsp;Bu ba\u011flant\u0131 hangi uygulama &uuml;zerinden geliyor?<br>&nbsp;Neden PID 4 g&ouml;r&uuml;n&uuml;yor? bu bir problem mi? k&ouml;t&uuml; ama&ccedil;l\u0131 bir \u015fey mi?<\/p>\r\n<p>\u0130\u015fte bu blog yaz\u0131s\u0131nda, bu sorular\u0131n tamam\u0131n\u0131 ger&ccedil;ek bir &ouml;rnek &uuml;zerinden ad\u0131m ad\u0131m ele al\u0131yoruz.<\/p>\r\n<h2>Bir Durum \u0130ncelemesi: Netstat &Ccedil;\u0131kt\u0131s\u0131nda PID 4<\/h2>\r\n<p>&Ouml;rnek senaryomuzda, dosya sunucusunda \u015fu komut &ccedil;al\u0131\u015ft\u0131r\u0131l\u0131yor:<\/p>\r\n<p>cmd<br><code>netstat ano | findstr 10.20.30.5<\/code><\/p>\r\n<p><br>Ve sonu&ccedil; \u015fu \u015fekilde geliyor:<\/p>\r\n<p><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51795 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51797 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51798 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><\/p>\r\n<p><br>\u0130lk bak\u0131\u015fta anlaml\u0131 olan \u015fey:<br>10.20.30.5, sunucuya 445 numaral\u0131 port &uuml;zerinden ba\u011flan\u0131yor.<br>Bu port, SMBv2\/v3 protokollerinin standart ba\u011flant\u0131 noktas\u0131d\u0131r.<\/p>\r\n<p><strong>Dikkat &ccedil;eken \u015fey ise: PID 4.<\/strong><\/p>\r\n<p>PID 4 Neden &Ouml;zel Bir PID'dir?<\/p>\r\n<p>Windows&rsquo;ta PID 4, d&uuml;nyada yaln\u0131zca bir tek s&uuml;re&ccedil; i&ccedil;in ayr\u0131lm\u0131\u015ft\u0131r:<\/p>\r\n<p><strong>SYSTEM (NT Kernel &amp; System Process)<\/strong><\/p>\r\n<p>Bu s&uuml;re&ccedil;, i\u015fletim sisteminin &ccedil;ekirde\u011finin &ccedil;al\u0131\u015fmas\u0131n\u0131 sa\u011flar.<br>\u0130&ccedil;inde:<\/p>\r\n<p>&nbsp;SMB sunucusu s&uuml;r&uuml;c&uuml;leri<br>&nbsp;Dosya payla\u015f\u0131m\u0131 bile\u015fenleri<br>&nbsp;NFS \/ CIFS i\u015fleyicileri<br>&nbsp;Kernelmode network stack<br>&nbsp;Windows Defender&rsquo;\u0131n baz\u0131 &ccedil;ekirdek eklentileri<br>&nbsp;I\/O scheduler y&ouml;netimi<br>&nbsp;Bellek y&ouml;netiminin b&uuml;y&uuml;k k\u0131sm\u0131<\/p>\r\n<p>gibi en d&uuml;\u015f&uuml;k seviyeli bile\u015fenler vard\u0131r.<\/p>\r\n<p>Dolay\u0131s\u0131yla bir SMB ba\u011flant\u0131s\u0131 geldi\u011finde Windows i\u015flem tablosu \u015fu \u015fekilde &ccedil;al\u0131\u015f\u0131r:<\/p>\r\n<p><code>&nbsp;\"Bu ba\u011flant\u0131y\u0131 kullan\u0131c\u0131 uygulamas\u0131 ba\u015flatm\u0131yor. SMB protokol&uuml; kernel seviyesinden i\u015fleniyor. O h&acirc;lde bu ba\u011flant\u0131 PID 4 &uuml;zerinden g&ouml;r&uuml;necek.\"<\/code><\/p>\r\n<p>Ve bu tamamen do\u011fru, beklenen, ola\u011fan bir durumdur.<br>Bir uygulaman\u0131n k&ouml;t&uuml; ama&ccedil;l\u0131 oldu\u011funa i\u015faret etmez.<\/p>\r\n<h2>SMB Trafi\u011fi Neden Kernel (PID 4) &Uuml;zerinden Y&ouml;netilir?<\/h2>\r\n<p>SMB &ccedil;ok s\u0131k kullan\u0131lan ve performans a&ccedil;\u0131s\u0131ndan kritik bir protokold&uuml;r. Bu nedenle Microsoft, SMBv2&rsquo;den itibaren protokol&uuml; kullan\u0131c\u0131 modundan &ccedil;\u0131kar\u0131p kernel seviyesine ta\u015f\u0131m\u0131\u015ft\u0131r.<\/p>\r\n<p>Bu sayede:<\/p>\r\n<p>&nbsp;Daha d&uuml;\u015f&uuml;k gecikme<br>&nbsp;Daha h\u0131zl\u0131 dosya listeleme<br>&nbsp;Daha az CPU kullan\u0131m\u0131<br>&nbsp;Y&uuml;ksek yo\u011funluklu ba\u011flant\u0131larda kararl\u0131l\u0131k<br>&nbsp;Kaya gibi sa\u011flam bir g&uuml;venlik modeli<\/p>\r\n<p>elde edilir.<\/p>\r\n<p>Bu y&uuml;zden SMB ba\u011flant\u0131s\u0131n\u0131n PID 4 olarak g&ouml;r&uuml;nmesi:<\/p>\r\n<p>\u2714 Do\u011fru<br>\u2714 G&uuml;venli<br>\u2714 Tasar\u0131msal bir davran\u0131\u015ft\u0131r<\/p>\r\n<p>&gt; &ldquo;Sunucuma bir \u015fey mi bula\u015ft\u0131?&rdquo;<br>&gt; Hay\u0131r. Bu davran\u0131\u015f Windows Server&rsquo;\u0131n do\u011fal &ccedil;al\u0131\u015fma \u015feklidir.<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>10.20.30.5 Hangi Dosyalara Eri\u015fiyor?<\/strong><\/p>\r\n<p>\u0130\u015fte i\u015fin teknik olarak ilgin&ccedil; k\u0131sm\u0131 burada ba\u015fl\u0131yor.<br>Netstat yaln\u0131zca ba\u011flant\u0131n\u0131n oldu\u011funu g&ouml;sterir.<br>Ama ba\u011flant\u0131n\u0131n i&ccedil;eri\u011fi hakk\u0131nda hi&ccedil;bir \u015fey s&ouml;ylemez.<\/p>\r\n<p>Yani:<\/p>\r\n<p>&nbsp;Hangi klas&ouml;r?<br>&nbsp;Hangi dosya?<br>&nbsp;Ne zaman a&ccedil;t\u0131?<br>&nbsp;Ne kadar s&uuml;re a&ccedil;\u0131k kald\u0131?<br>&nbsp;Kullan\u0131c\u0131 kimli\u011fi ne?<br>&nbsp;Okuma m\u0131 yapt\u0131 yazma m\u0131 yapt\u0131?<\/p>\r\n<p>Bunlar\u0131n hi&ccedil;birini netstat ile g&ouml;remezsiniz.<\/p>\r\n<p><strong>Peki nas\u0131l g&ouml;r&uuml;r&uuml;z?<\/strong><\/p>\r\n<p>Windows Server bize bunun i&ccedil;in &ccedil;ok g&uuml;&ccedil;l&uuml; ara&ccedil;lar sunuyor.<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>1. SMB Oturumlar\u0131n\u0131 G&ouml;rme &ndash; Ba\u011flant\u0131n\u0131n Kimli\u011fi<\/strong><\/p>\r\n<p>\u0130lk ad\u0131m, istemcinin sunucuda aktif bir oturumu olup olmad\u0131\u011f\u0131n\u0131 g&ouml;rmek:<\/p>\r\n<p>powershell<br>GetSmbSession | Select ClientComputerName, ClientUserName, NumOpens<\/p>\r\n<p><br>Bu komut size \u015funu s&ouml;yler:<\/p>\r\n<p>&nbsp;10.20.30.5 \u015fu kullan\u0131c\u0131 ile ba\u011fl\u0131<br>&nbsp;Bu oturumda X adet dosya a&ccedil;\u0131k<br>&nbsp;Ba\u011flant\u0131 SMBv2 mi SMBv3 m&uuml;<br>&nbsp;Oturum trafi\u011fi ka&ccedil; MB<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>&nbsp;2. En Kritik Ad\u0131m: A&ccedil;\u0131k Dosyalar\u0131 Listeme &ndash; Ger&ccedil;ekleri G&ouml;rme<\/strong><\/p>\r\n<p>Bu komut, bir istemcinin o anda hangi dosyalar\u0131 a&ccedil;t\u0131\u011f\u0131n\u0131 birebir g&ouml;sterir:<\/p>\r\n<p>powershell<br>GetSmbOpenFile | WhereObject {$_.ClientComputerName eq \"10.20.30.5\"} |<br>&nbsp; &nbsp; Select ClientComputerName, Path, ClientUserName<\/p>\r\n<p><br>Bu sayede direkt olarak:<\/p>\r\n<p>&nbsp;&ldquo;Hangi payla\u015f\u0131m klas&ouml;r&uuml;ne girilmi\u015f?&rdquo;<br>&nbsp;&ldquo;Hangi dosya a&ccedil;\u0131lm\u0131\u015f?&rdquo;<br>&nbsp;&ldquo;Okuma m\u0131 yazma m\u0131 yap\u0131lm\u0131\u015f?&rdquo;<br>&nbsp;&ldquo;Kim eri\u015fmi\u015f?&rdquo;<\/p>\r\n<p>hepsini net bir \u015fekilde g&ouml;r&uuml;r&uuml;z.<\/p>\r\n<p><strong>&Ouml;rnek bir &ccedil;\u0131kt\u0131:<\/strong><\/p>\r\n<p><br><code>ClientComputerName : 10.20.30.5<\/code><br><code>Path &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : \\\\10.20.30.9\\Shared\\HR\\salary.xlsx<\/code><br><code>ClientUserName &nbsp; &nbsp; : corpintra\\user1<\/code><\/p>\r\n<p><br>Bu noktada art\u0131k b&uuml;t&uuml;n tablo netle\u015fmi\u015f olur:<\/p>\r\n<p><code>&nbsp;\u0130stemci &rarr; 10.20.30.5<\/code><br><code>&nbsp;Eri\u015filen dosya &rarr; salary.xlsx<\/code><br><code>&nbsp;Payla\u015f\u0131m yolu &rarr; HR<\/code><br><code>&nbsp;Kullan\u0131c\u0131 &rarr; user1<\/code><\/p>\r\n<p>&nbsp;<\/p>\r\n<p>&nbsp;\ud83d\udfe7 3. Ger&ccedil;ek Zamanl\u0131 \u0130zleme &ndash; ShareMonitor \/ Sysinternals<\/p>\r\n<p>E\u011fer canl\u0131 olarak:<\/p>\r\n<p>&nbsp;kim hangi klas&ouml;r&uuml; a&ccedil;t\u0131,<br>&nbsp;dosyan\u0131n ad\u0131 neydi,<br>&nbsp;payla\u015f\u0131mdan ne okundu ne yaz\u0131ld\u0131<\/p>\r\n<p>g&ouml;rmek istiyorsan\u0131z Sysinternals&rsquo;\u0131n &ldquo;ShareMonitor&rdquo; arac\u0131 bunu anl\u0131k g&ouml;sterir.<\/p>\r\n<p>Her a&ccedil;\u0131lan dosya \u015f&ouml;yle g&ouml;r&uuml;n&uuml;r:<\/p>\r\n<p><br><code>10.20.30.5 opened \\\\10.20.30.9\\Accounting\\Rapor.xlsx<\/code><br><code>10.20.30.5 read &nbsp; \\\\10.20.30.9\\Shared\\TaskList.docx<\/code><\/p>\r\n<p><br>A\u011f trafi\u011fini canl\u0131 takip etmek, &ouml;zellikle de b&uuml;y&uuml;k \u015firket ortamlar\u0131nda &ccedil;ok de\u011ferli bir yetenektir.<\/p>\r\n<h2>\u0130leri Seviye: Event Viewer &ndash; SMB Access Loglar\u0131<\/h2>\r\n<p>E\u011fer SMB Audit Log aktifse:<\/p>\r\n<p>Event Viewer &rarr; Microsoft &rarr; Windows &rarr; SMBServer &rarr; Operational<\/p>\r\n<p>Ba\u015fl\u0131klar alt\u0131nda:<\/p>\r\n<p>&nbsp;3000 &rarr; File Read<br>&nbsp;3001 &rarr; File Write<br>&nbsp;3002 &rarr; File Create<br>&nbsp;3003 &rarr; Directory Access<\/p>\r\n<p>gibi ID&rsquo;lerle t&uuml;m hareketler kaydedilir.<\/p>\r\n<p>Bu loglar:<\/p>\r\n<p>&nbsp;Forensic incelemelerde<br>&nbsp;Veri s\u0131z\u0131nt\u0131s\u0131 ara\u015ft\u0131rmalar\u0131nda<br>&nbsp;Kullan\u0131c\u0131 hareket analizlerinde<\/p>\r\n<p>&ccedil;ok i\u015fe yarar.<\/p>\r\n<h2>PID 4 G&ouml;rmek Normaldir, As\u0131l &Ouml;nemli Olan Dosya Eri\u015fimlerini \u0130zlemektir<\/h2>\r\n<p>Bir istemci dosya sunucusuna ba\u011fland\u0131\u011f\u0131nda ba\u011flant\u0131n\u0131n PID 4 alt\u0131nda g&ouml;r&uuml;nmesi tamamen ola\u011fan bir durumdur.<br>Bu SMB protokol&uuml;n&uuml;n Windows&rsquo;ta kernel seviyesinde &ccedil;al\u0131\u015fmas\u0131ndan kaynaklan\u0131r.<\/p>\r\n<p>&Ouml;nemli olan; istemcinin hangi dosyalara eri\u015fti\u011fini, hangi kullan\u0131c\u0131yla ba\u011fland\u0131\u011f\u0131n\u0131, hangi klas&ouml;r&uuml; a&ccedil;t\u0131\u011f\u0131n\u0131 do\u011fru ara&ccedil;larla tespit edebilmektir.<\/p>\r\n<p>Bu yaz\u0131da anlatt\u0131\u011f\u0131m\u0131z ara&ccedil;lar:<\/p>\r\n<p>&nbsp;GetSmbSession &rarr; Oturum kimli\u011fi<br>&nbsp;GetSmbOpenFile &rarr; A&ccedil;\u0131lan dosyalar<br>&nbsp;ShareMonitor &rarr; Canl\u0131 izleme<br>&nbsp;SMBServer Logs &rarr; Adli inceleme<\/p>\r\n<p>sistemin t&uuml;m resmini net \u015fekilde g&ouml;rmeyi sa\u011flar.<\/p>\r\n<p>A\u015fa\u011f\u0131ya talep etti\u011fin &uuml;&ccedil; b&ouml;l&uuml;m&uuml; <strong>blog yaz\u0131s\u0131na ek i&ccedil;erik<\/strong> olarak haz\u0131rlad\u0131m.<br>Hepsi profesyonel &ndash; anla\u015f\u0131l\u0131r &ndash; teknik olarak do\u011fru \u015fekilde d&uuml;zenlendi.<\/p>\r\n<hr>\r\n<h1><strong>SMB Teknik Terimler S&ouml;zl&uuml;\u011f&uuml; (TR\/EN)<\/strong><\/h1>\r\n<p>SMB d&uuml;nyas\u0131nda s\u0131k ge&ccedil;en kavramlar\u0131n T&uuml;rk&ccedil;e&ndash;\u0130ngilizce kar\u015f\u0131l\u0131klar\u0131 ve k\u0131sa a&ccedil;\u0131klamalar\u0131:<\/p>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th><strong>T&uuml;rk&ccedil;e Terim<\/strong><\/th>\r\n<th><strong>\u0130ngilizce Terim<\/strong><\/th>\r\n<th><strong>A&ccedil;\u0131klama<\/strong><\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>Dosya Payla\u015f\u0131m\u0131<\/td>\r\n<td>File Sharing<\/td>\r\n<td>A\u011f &uuml;zerinden klas&ouml;r\/dosya payla\u015f\u0131m\u0131. SMB&rsquo;nin temel amac\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Payla\u015f\u0131m (Payla\u015ft\u0131r\u0131lm\u0131\u015f klas&ouml;r)<\/td>\r\n<td>Share \/ Shared Folder<\/td>\r\n<td>SMB ile eri\u015filebilen payla\u015ft\u0131r\u0131lm\u0131\u015f klas&ouml;r.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Oturum<\/td>\r\n<td>Session<\/td>\r\n<td>Bir istemcinin sunucuya kurdu\u011fu kimlik do\u011frulamal\u0131 ba\u011flant\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Oturum Kimli\u011fi<\/td>\r\n<td>Session ID<\/td>\r\n<td>Her SMB ba\u011flant\u0131s\u0131na verilen benzersiz numara.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Dosya Tan\u0131t\u0131c\u0131s\u0131<\/td>\r\n<td>File Handle<\/td>\r\n<td>A&ccedil;\u0131k bir dosyay\u0131 temsil eden sistem tan\u0131t\u0131c\u0131s\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Okuma \/ Yazma<\/td>\r\n<td>Read \/ Write<\/td>\r\n<td>SMB &uuml;zerinden dosya eri\u015fim t&uuml;rleri.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Payla\u015f\u0131m Yolu<\/td>\r\n<td>UNC Path<\/td>\r\n<td>\\server\\share\\ klas&ouml;r yap\u0131s\u0131n\u0131n tam yolu.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kimlik Do\u011frulama<\/td>\r\n<td>Authentication<\/td>\r\n<td>Kullan\u0131c\u0131 giri\u015f kontrol&uuml; (NTLM\/Kerberos).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Yetkilendirme<\/td>\r\n<td>Authorization<\/td>\r\n<td>Kullan\u0131c\u0131n\u0131n klas&ouml;r\/dosyaya eri\u015fim yetkisi.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Protokol&uuml;<\/td>\r\n<td>SMB Protocol<\/td>\r\n<td>Windows dosya payla\u015f\u0131m protokol&uuml; (CIFS olarak da bilinir).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv1<\/td>\r\n<td>SMB Version 1<\/td>\r\n<td>G&uuml;vensiz, eski s&uuml;r&uuml;m. Art\u0131k devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131 &ouml;nerilir.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv2<\/td>\r\n<td>SMB Version 2<\/td>\r\n<td>Performans ve g&uuml;venlik olarak b&uuml;y&uuml;k s\u0131&ccedil;rama, modern s&uuml;r&uuml;m.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv3<\/td>\r\n<td>SMB Version 3<\/td>\r\n<td>\u015eifreleme, kararl\u0131l\u0131k ve h\u0131z geli\u015ftirmeleri i&ccedil;erir.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Network Signed<\/td>\r\n<td>SMB Signing<\/td>\r\n<td>SMB paketlerinin imzalanmas\u0131, g&uuml;venlik art\u0131r\u0131r.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Encryption<\/td>\r\n<td>SMB \u015eifreleme<\/td>\r\n<td>Veri ak\u0131\u015f\u0131n\u0131 u&ccedil;tan uca \u015fifreler.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Session Key<\/td>\r\n<td>Oturum Anahtar\u0131<\/td>\r\n<td>\u0130stemci&ndash;sunucu aras\u0131ndaki \u015fifreleme anahtar\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kernel-Mode Driver<\/td>\r\n<td>&Ccedil;ekirdek Modu S&uuml;r&uuml;c&uuml;s&uuml;<\/td>\r\n<td>SMB gibi trafiklerin PID 4 alt\u0131nda &ccedil;al\u0131\u015fmas\u0131n\u0131n nedeni.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>File Locking<\/td>\r\n<td>Dosya Kilitleme<\/td>\r\n<td>&Ccedil;oklu kullan\u0131c\u0131 eri\u015fiminde &ccedil;ak\u0131\u015fmay\u0131 &ouml;nler.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<p>Bu s&ouml;zl&uuml;k, blog yaz\u0131na ayr\u0131 bir b&ouml;l&uuml;m olarak eklenebilir.<\/p>\r\n<hr>\r\n<h1><strong>SMBv2 ve SMBv3 Aras\u0131ndaki Farklar (Detayl\u0131 Tablo)<\/strong><\/h1>\r\n<p>SMBv2 &rarr; Windows Vista\/Server 2008 ile geldi<br>SMBv3 &rarr; Windows 8\/Server 2012 ile geldi<\/p>\r\n<p>A\u015fa\u011f\u0131daki tablo, iki s&uuml;r&uuml;m aras\u0131ndaki farklar\u0131 net \u015fekilde ortaya koyar:<\/p>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>&Ouml;zellik<\/th>\r\n<th>SMBv2<\/th>\r\n<th>SMBv3<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>&Ccedil;\u0131k\u0131\u015f Y\u0131l\u0131<\/td>\r\n<td>2006<\/td>\r\n<td>2012<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Performans<\/td>\r\n<td>SMBv1&rsquo;e g&ouml;re &ccedil;ok daha h\u0131zl\u0131<\/td>\r\n<td>SMBv2&rsquo;den %20&ndash;40 daha h\u0131zl\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>G&uuml;venlik<\/td>\r\n<td>SMB Signing destekler<\/td>\r\n<td><strong>SMB Encryption destekler<\/strong> (b&uuml;y&uuml;k fark!)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>\u015eifreleme<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>AES-128-GCM \/ AES-128-CCM<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&Ccedil;oklu Kanal<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>Multichannel<\/strong> (birden fazla a\u011f aray&uuml;z&uuml; &rarr; y&uuml;ksek h\u0131z)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Dayan\u0131kl\u0131l\u0131k<\/td>\r\n<td>Temel d&uuml;zeyde<\/td>\r\n<td><strong>SMB Durable Handles<\/strong> ile kesintisiz ba\u011flant\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Failover<\/td>\r\n<td>Yok<\/td>\r\n<td>Clustered Shared Volume deste\u011fi, kesintisiz failover<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>S\u0131k\u0131\u015ft\u0131rma<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>SMB Compression (2020 g&uuml;ncellemesiyle)<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>OTOMAT\u0130K Y&uuml;k Payla\u015f\u0131m\u0131<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>SMB Direct + RDMA deste\u011fi<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kullan\u0131m Alan\u0131<\/td>\r\n<td>Genel dosya payla\u015f\u0131m\u0131<\/td>\r\n<td>Veri merkezleri, y&uuml;ksek y&uuml;k, b&uuml;y&uuml;k dosya ak\u0131\u015f\u0131, Hyper-V<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<p><strong>SMBv3, hem h\u0131z hem g&uuml;venlik hem dayan\u0131kl\u0131l\u0131k a&ccedil;\u0131s\u0131ndan en ideal s&uuml;r&uuml;md&uuml;r.<\/strong><br>G&uuml;n&uuml;m&uuml;z sunucular\u0131nda <strong>SMBv1 kapal\u0131<\/strong>, <strong>SMBv2\/3 a&ccedil;\u0131k<\/strong> olarak &ccedil;al\u0131\u015fmas\u0131 &ouml;nerilir.<\/p>\r\n<hr>\r\n<h1><strong>Powershell ile Otomatik SMB \u0130zleme Scripti<\/strong><\/h1>\r\n<p>A\u015fa\u011f\u0131daki script, belirli bir istemci IP adresinin (&ouml;r: 10.1.0.24) hangi dosyalara eri\u015fti\u011fini <strong>otomatik izler<\/strong>, her 10 saniyede bir kontrol eder ve log kayd\u0131 olu\u015fturur.<\/p>\r\n<h3>Script &Ouml;zellikleri<\/h3>\r\n<p>\u2714 Hangi dosyalara eri\u015fildi\u011fini bulur<br>\u2714 Kullan\u0131c\u0131 bilgisiyle birlikte log&rsquo;a yazar<br>\u2714 Tarih-saat damgas\u0131 ekler<br>\u2714 Ger&ccedil;ek zamanl\u0131 takip sa\u011flar<br>\u2714 Log dosyas\u0131n\u0131 CSV olarak &uuml;retir<\/p>\r\n<hr>\r\n<h2><strong>smb-monitor.ps1 &mdash; Otomatik SMB Dosya Eri\u015fim \u0130zleme Scripti<\/strong><\/h2>\r\n<pre><code class=\"language-powershell\"># ============================\r\n# SMB Otomatik \u0130zleme Scripti\r\n# ============================\r\n\r\n$TargetIP = \"10.1.0.24\"         # \u0130zlenecek istemci IP\r\n$LogFile = \"C:\\SMB_Logs\\smb_log.csv\"\r\n\r\n# Log dosyas\u0131 yoksa olu\u015ftur\r\nif (-Not (Test-Path $LogFile)) {\r\n    \"Timestamp,ClientIP,User,FilePath\" | Out-File -FilePath $LogFile -Encoding utf8\r\n}\r\n\r\nWrite-Host \"SMB izleme ba\u015flat\u0131ld\u0131... IP: $TargetIP\" -ForegroundColor Green\r\nWrite-Host \"Log dosyas\u0131: $LogFile\"\r\n\r\nwhile ($true) {\r\n\r\n    $files = Get-SmbOpenFile | Where-Object {\r\n        $_.ClientComputerName -eq $TargetIP\r\n    }\r\n\r\n    foreach ($file in $files) {\r\n        $timestamp = (Get-Date).ToString(\"yyyy-MM-dd HH:mm:ss\")\r\n        $entry = \"$timestamp,$($file.ClientComputerName),$($file.ClientUserName),$($file.Path)\"\r\n\r\n        # Log kayd\u0131n\u0131 yaz\r\n        Add-Content -Path $LogFile -Value $entry\r\n\r\n        Write-Host \"[KAYIT] $entry\" -ForegroundColor Yellow\r\n    }\r\n\r\n    Start-Sleep -Seconds 10  # Her 10 saniyede bir kontrol et\r\n}\r\n<\/code><\/pre>\r\n<hr>\r\n<h1>Kullan\u0131m Talimat\u0131<\/h1>\r\n<h3>1. Scripti bir dosyaya kaydet:<\/h3>\r\n<pre><code>C:\\Scripts\\smb-monitor.ps1\r\n<\/code><\/pre>\r\n<h3>2. Log klas&ouml;r&uuml; olu\u015ftur:<\/h3>\r\n<pre><code class=\"language-powershell\">mkdir C:\\SMB_Logs\r\n<\/code><\/pre>\r\n<h3>3. Scripti &ccedil;al\u0131\u015ft\u0131r:<\/h3>\r\n<pre><code class=\"language-powershell\">powershell -ExecutionPolicy Bypass -File C:\\Scripts\\smb-monitor.ps1\r\n<\/code><\/pre>\r\n<h3>4. Log dosyas\u0131na bak:<\/h3>\r\n<pre><code>C:\\SMB_Logs\\smb_log.csv\r\n<\/code><\/pre>\r\n<p>Her sat\u0131rda \u015funlar olacak:<\/p>\r\n<pre><code>2025-12-03 16:22:10,10.1.0.24,corpintra\\user1,\\\\10.1.0.9\\Shared\\Finance\\budget.xlsx\r\n<\/code><\/pre>\r\n<hr>\r\n<p>&nbsp;<\/p>","excerpt":"","created_at":"2025-12-03 18:22:46","updated_at":"2026-09-23 11:27:01","category_id":6,"view_count":645,"reading_time":11,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-03 15:22:00","featured_image":"dba84a63ff10af3e9be6cc63a30980ea.png","slug":"windows-sunucularda-smb-baglantilarinin-derin-analizi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":357,"title":"Windows Server'da DCGPOFIX Komutunun Kullan\u0131m\u0131","content":"<p>Windows Server &uuml;zerinde &ccedil;al\u0131\u015f\u0131rken, Grup \u0130lkesi Nesneleri (Group Policy Objects - GPO) y&ouml;netimi b&uuml;y&uuml;k bir &ouml;neme sahiptir. Ancak zaman zaman yanl\u0131\u015f yap\u0131land\u0131rmalar veya beklenmedik sorunlar nedeniyle varsay\u0131lan GPO'larda bozulma meydana gelebilir. \u0130\u015fte tam bu noktada \"dcgpofix\" komutu, efektif bir &ccedil;&ouml;z&uuml;m sunarak devreye girer. Bu yaz\u0131da dcgpofix komutunun i\u015flevi, kullan\u0131m\u0131 ve dikkat edilmesi gereken &ouml;nemli detaylar\u0131 &uuml;zerinde duraca\u011f\u0131z.<\/p>\n<p><iframe style=\"width: 687px; height: 385px;\" src=\"https:\/\/www.youtube.com\/embed\/FZd8hwHJ3M8\" width=\"687\" height=\"385\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h3>DCGPOFIX Ne \u0130\u015fe Yarar?<\/h3>\n<p>DCGPOFIX, Windows Server sisteminde varsay\u0131lan Grup \u0130lkesi Nesnelerini (Default Domain Policy ve Default Domain Controllers Policy) orijinal h&acirc;line d&ouml;nd&uuml;rmek i&ccedil;in kullan\u0131lan bir komuttur. Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya hasar g&ouml;rm&uuml;\u015f Grup \u0130lkesi Nesnelerini s\u0131f\u0131rlayarak sistemin stabilitesini yeniden tesis etmeyi sa\u011flar.<\/p>\n<h3>DCGPOFIX Nas\u0131l Kullan\u0131l\u0131r?<\/h3>\n<p>DCGPOFIX komutunu kullanmadan &ouml;nce, i\u015flem sonras\u0131 yap\u0131lacak de\u011fi\u015fikliklerin geri al\u0131namayaca\u011f\u0131n\u0131 bilmek &ouml;nemlidir. Bu nedenle i\u015flemden &ouml;nce mevcut yap\u0131land\u0131rmalar\u0131n yedeklenmesi, muhtemel veri kayb\u0131n\u0131 &ouml;nlemenin anahtar\u0131d\u0131r.<\/p>\n<p>ad\u0131m 1: Komut \u0130stemcisi &Uuml;zerinden \u0130\u015fleyi\u015f<br>1. Windows Server &uuml;zerinde \"Komut \u0130stemcisi\"ni (Command Prompt) y&ouml;netici yetkileriyle a&ccedil;\u0131n.<br>2. A\u015fa\u011f\u0131thisaki komutu &ccedil;al\u0131\u015ft\u0131r\u0131n:<br><br>&nbsp; &nbsp;<code>dcgpofix<\/code><br><br><\/p>\n<p>ad\u0131m 2: Onay S&uuml;reci<br>- Komut &ccedil;al\u0131\u015ft\u0131r\u0131ld\u0131ktan sonra i\u015flem talebinizi onaylaman\u0131z gerekir. \"Y\" tu\u015funa basarak bu iste\u011fi do\u011frulayabilirsiniz.<\/p>\n<p>ad\u0131m 3: Spesifik Politika G&ouml;revinde Kullan\u0131m<br>- Sadece belirli bir politika &uuml;zerine i\u015flem yapmak istiyorsan\u0131z, a\u015fa\u011f\u0131daki hedef spesifik parametrelerden birini se&ccedil;ebilirsiniz:<br>Default Domain Policy&nbsp; s\u0131f\u0131rlamas\u0131 i&ccedil;in:<br><br>&nbsp; &nbsp; <code>dcgpofix \/target:domain<\/code><br><br>Default Domain Controllers Policy** s\u0131f\u0131rlamas\u0131 i&ccedil;in:<br>&nbsp; &nbsp;<br>&nbsp; &nbsp; <code>dcgpofix \/target:dc<\/code><br>&nbsp; &nbsp;&nbsp;<\/p>\n<h3>&Ouml;nemli Bilgilere Dikkat!<\/h3>\n<p>1. **Yedekleme Gereklili\u011fi:** DCGPOFIX komutunun zaruri de\u011fi\u015fiklikler olu\u015fturaca\u011f\u0131 kesinle\u015fecektir. Bunun i&ccedil;in i\u015flemden &ouml;nce mevcut Grup \u0130lkesi d&uuml;zenlemelerinin yede\u011finin al\u0131nd\u0131\u011f\u0131na emin olun.<br>2. **Dikkatli Kullan\u0131m:** Bu komut, yaln\u0131zca varsay\u0131lan Grup \u0130lkesi Nesnelerinin ba\u015far\u0131yla kurtar\u0131lmas\u0131 gerekti\u011finde devreye sokulmal\u0131d\u0131r. Di\u011fer alternatif &ccedil;&ouml;z&uuml;mler denenmeden &ouml;nce kullan\u0131m\u0131 ideal bir se&ccedil;im olmayabilir.<br>3. **Potansiyel Etkilerin Fark\u0131nda Olun:** Varsay\u0131lan GPO'lar\u0131n s\u0131f\u0131rlanmas\u0131 hem sistem hem kullan\u0131c\u0131 ayarlar\u0131nda &ouml;nemli de\u011fi\u015fimlere sebebiyet verir. Bu sebeple i\u015flem sonras\u0131 olu\u015fabilecek durumlar\u0131 kontrol etmek son derece gereklidir.<\/p>\n<p>&nbsp;<\/p>\n<p>DCGPOFIX, Windows Server y&ouml;neticileri i&ccedil;in kapsaml\u0131 ve etkili bir kurtarma &ccedil;&ouml;z&uuml;m&uuml;d&uuml;r. Ancak kullan\u0131m\u0131 &ouml;ncesinde dikkatli bir de\u011ferlendirme gerekir ve yedekleme plan\u0131 ihmal edilmemelidir. Bu ara&ccedil; sayesinde bozulmu\u015f veya yanl\u0131\u015f konfig&uuml;re edilmi\u015f varsay\u0131lan Grup \u0130lke Nesneleri kolayca s\u0131f\u0131rlanabilir ve sistemin eski stabil h&acirc;line getirilmesi sa\u011flanabilir. Ak\u0131lda tutmal\u0131y\u0131z ki, do\u011fru ara&ccedil;lar\u0131n do\u011fru yer ve zamanda herhangi bir sistem y&ouml;netimi s&uuml;recinin temel anahtar\u0131 oldu\u011funu unutulmamal\u0131d\u0131r.<\/p>","excerpt":"Windows Server \u00fczerinde \u00e7al\u0131\u015f\u0131rken, Grup \u0130lkesi Nesneleri (Group Policy Objects - GPO) y\u00f6netimi b\u00fcy\u00fck bir \u00f6neme sahiptir. ","created_at":"2025-11-28 14:53:08","updated_at":"2026-09-07 15:34:29","category_id":6,"view_count":487,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-28 11:53:00","featured_image":"\/uploads\/images\/2025\/12\/6947be923cbc5_1766309522.jpg","slug":"windows-server-da-dcgpofix-komutunun-kullanimi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":341,"title":"GPO ile Ortak Klas\u00f6rleri Domain \u0130\u00e7indeki T\u00fcm Client'lara Otomatik Olarak Da\u011f\u0131tma","content":"<p>Active Directory ortamlar\u0131nda ortak klas&ouml;rlerin y&ouml;netimi, IT ekipleri i&ccedil;in s\u0131kl\u0131kla kar\u015f\u0131la\u015f\u0131lan bir zorluktur. Manuel olarak her bilgisayara gidip ortak klas&ouml;r eklemek hem zaman kayb\u0131d\u0131r hem de y&ouml;netilebilirlik a&ccedil;\u0131s\u0131ndan s&uuml;rd&uuml;r&uuml;lebilir bir y&ouml;ntem de\u011fildir. Bu yaz\u0131da, Group Policy (GPO) kullanarak ortak klas&ouml;rleri merkezi olarak nas\u0131l da\u011f\u0131taca\u011f\u0131n\u0131z\u0131 ve bu s&uuml;re&ccedil;te dikkat etmeniz gereken kritik noktalar\u0131 detayl\u0131ca ele alaca\u011f\u0131z.<\/p>\n<h2>Neden GPO ile Ortak Klas&ouml;r Da\u011f\u0131t\u0131m\u0131?<\/h2>\n<p>Manuel y&ouml;ntemlerin getirdi\u011fi operasyonel y&uuml;k, b&uuml;y&uuml;yen organizasyonlarda katlanarak artar. GPO tabanl\u0131 yakla\u015f\u0131m sayesinde:<\/p>\n<ul>\n<li><strong>Merkezi y&ouml;netim<\/strong> ile t&uuml;m de\u011fi\u015fiklikler tek noktadan yap\u0131l\u0131r<\/li>\n<li><strong>Tutarl\u0131l\u0131k<\/strong> sa\u011flanarak t&uuml;m kullan\u0131c\u0131lar ayn\u0131 yap\u0131land\u0131rmay\u0131 al\u0131r<\/li>\n<li><strong>G&uuml;venlik politikalar\u0131<\/strong> merkezi olarak uygulan\u0131r<\/li>\n<li><strong>Zaman tasarrufu<\/strong> ile IT ekibinin verimlili\u011fi artar<\/li>\n<li><strong>Hata riski<\/strong> minimuma indirilir<\/li>\n<\/ul>\n<h2>File Server &Uuml;zerinde Ortak Klas&ouml;r Haz\u0131rl\u0131\u011f\u0131<\/h2>\n<p>\u0130lk ad\u0131m, payla\u015f\u0131lacak klas&ouml;r&uuml;n do\u011fru \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131d\u0131r. G&uuml;venlik ve eri\u015filebilirlik dengesi burada kritik &ouml;neme sahiptir.<\/p>\n<h3>Klas&ouml;r Yap\u0131s\u0131 Olu\u015fturma<\/h3>\n<pre><code>D:\\Ortak\\\n    \u251c\u2500\u2500 Departmanlar\\\n    \u2502   \u251c\u2500\u2500 Muhasebe\n    \u2502   \u251c\u2500\u2500 \u0130nsan_Kaynaklari\n    \u2502   \u2514\u2500\u2500 IT\n    \u2514\u2500\u2500 Genel\\\n        \u251c\u2500\u2500 Duyurular\n        \u2514\u2500\u2500 Formlar\n<\/code><\/pre>\n<h3>Payla\u015f\u0131m Yap\u0131land\u0131rmas\u0131<\/h3>\n<p>Payla\u015f\u0131m adland\u0131rmas\u0131nda gizli payla\u015f\u0131m i&ccedil;in <code>$<\/code> karakteri kullan\u0131labilir:<\/p>\n<ul>\n<li>Normal payla\u015f\u0131m: <code>\\\\FileServer\\Departman<\/code><\/li>\n<li>Gizli payla\u015f\u0131m: <code>\\\\FileServer\\Departman$<\/code><\/li>\n<\/ul>\n<p><strong>Share Permissions ayarlar\u0131:<\/strong><\/p>\n<ul>\n<li>Everyone &rarr; Read (Temel okuma eri\u015fimi)<\/li>\n<li>Domain Users &rarr; Change veya Modify (Kullan\u0131c\u0131 ihtiya&ccedil;lar\u0131na g&ouml;re)<\/li>\n<li>Domain Admins &rarr; Full Control<\/li>\n<\/ul>\n<p><strong>NTFS \u0130zinleri (Daha detayl\u0131 kontrol i&ccedil;in):<\/strong><\/p>\n<ul>\n<li>Authenticated Users &rarr; Read &amp; Execute<\/li>\n<li>\u0130lgili departman gruplar\u0131 &rarr; Modify<\/li>\n<li>CREATOR OWNER &rarr; Full Control (Sadece kendi dosyalar\u0131 i&ccedil;in)<\/li>\n<li>Domain Admins &rarr; Full Control<\/li>\n<\/ul>\n<h2>Active Directory'de G&uuml;venlik Gruplar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h2>\n<p>Eri\u015fim kontrol&uuml;n&uuml; kolayla\u015ft\u0131rmak i&ccedil;in AD'de mant\u0131ksal gruplar olu\u015fturun:<\/p>\n<pre><code>GRP_OrtakKlasor_Muhasebe_Read\nGRP_OrtakKlasor_Muhasebe_Modify\nGRP_OrtakKlasor_IT_FullControl\nGRP_OrtakKlasor_Genel_Read\n<\/code><\/pre>\n<p>Bu yakla\u015f\u0131m\u0131n avantajlar\u0131:<\/p>\n<ul>\n<li>Kullan\u0131c\u0131 ekleme\/&ccedil;\u0131karma i\u015flemleri grup &uuml;zerinden yap\u0131l\u0131r<\/li>\n<li>\u0130zin de\u011fi\u015fiklikleri an\u0131nda uygulan\u0131r<\/li>\n<li>Denetim (audit) kolayla\u015f\u0131r<\/li>\n<\/ul>\n<h2>GPO Olu\u015fturma ve Yap\u0131land\u0131rma<\/h2>\n<h3>GPO Olu\u015fturma Ad\u0131mlar\u0131<\/h3>\n<ol>\n<li><strong>Group Policy Management Console<\/strong> a&ccedil;\u0131n<\/li>\n<li>\u0130lgili OU'ya sa\u011f t\u0131klay\u0131n &rarr; <strong>Create a GPO in this domain, and Link it here<\/strong><\/li>\n<li>GPO ad\u0131: <code>GPO - Ortak Klasor Dagitimi<\/code><\/li>\n<li>Olu\u015fturulan GPO'ya sa\u011f t\u0131klay\u0131n &rarr; <strong>Edit<\/strong><\/li>\n<\/ol>\n<h3>Drive Mapping Yap\u0131land\u0131rmas\u0131<\/h3>\n<pre><code>User Configuration \n  &rarr; Preferences \n    &rarr; Windows Settings \n      &rarr; Drive Maps\n<\/code><\/pre>\n<p>Yeni Drive Map eklerken dikkat edilecekler:<\/p>\n<p><strong>General Sekmesi:<\/strong><\/p>\n<ul>\n<li>Action: <strong>Create<\/strong> (\u0130lk kurulum) veya <strong>Replace<\/strong> (G&uuml;ncelleme)<\/li>\n<li>Location: <code>\\\\FileServer\\Departman$<\/code><\/li>\n<li>Label as: <code>Ortak - Departman<\/code><\/li>\n<li>Drive Letter: <strong>H:<\/strong> (&Ccedil;ak\u0131\u015fma olmamas\u0131 i&ccedil;in kontrol edin)<\/li>\n<li>Connect as: Bo\u015f b\u0131rak\u0131n (Kullan\u0131c\u0131 kimlik bilgileriyle ba\u011flanacak)<\/li>\n<\/ul>\n<p><strong>Common Sekmesi:<\/strong><\/p>\n<ul>\n<li>Run in logged-on user's security context: <strong>\u0130\u015faretli<\/strong><\/li>\n<li>Item-level targeting: <strong>\u0130\u015faretli<\/strong> (Hedefleme i&ccedil;in)<\/li>\n<\/ul>\n<h2>Item-Level Targeting ile Hassas Hedefleme<\/h2>\n<p>Item-level targeting, GPO'nun yaln\u0131zca belirli kriterlere uyan kullan\u0131c\u0131lara uygulanmas\u0131n\u0131 sa\u011flar.<\/p>\n<h3>Hedefleme Kriterleri &Ouml;rnekleri:<\/h3>\n<p><strong>G&uuml;venlik Grubu Bazl\u0131:<\/strong><\/p>\n<pre><code>Target: Security Group\nGroup: DOMAIN\\GRP_OrtakKlasor_Muhasebe_Modify\n<\/code><\/pre>\n<p><strong>Departman Bazl\u0131 (OU):<\/strong><\/p>\n<pre><code>Target: Organizational Unit\nOU: OU=Muhasebe,OU=Departmanlar,DC=sirket,DC=local\n<\/code><\/pre>\n<p><strong>Karma Hedefleme (AND\/OR mant\u0131\u011f\u0131):<\/strong><\/p>\n<pre><code>IF Member of GRP_OrtakKlasor_Read\nAND Computer Name like \"PC-MUH*\"\nTHEN Apply this setting\n<\/code><\/pre>\n<h2>GPO Uygulama ve Test S&uuml;reci<\/h2>\n<h3>Test Ortam\u0131nda Do\u011frulama<\/h3>\n<ol>\n<li>Test OU'su olu\u015fturun ve GPO'yu buraya linkleyin<\/li>\n<li>Test kullan\u0131c\u0131s\u0131 ile oturum a&ccedil;\u0131n<\/li>\n<li>A\u015fa\u011f\u0131daki komutlar\u0131 &ccedil;al\u0131\u015ft\u0131r\u0131n:<\/li>\n<\/ol>\n<pre><code class=\"language-powershell\"># GPO'yu manuel tetikleme\ngpupdate \/force\n\n# GPO uygulanma durumunu kontrol\ngpresult \/r\n\n# Detayl\u0131 GPO raporu (HTML format\u0131nda)\ngpresult \/h C:\\GPOReport.html\n<\/code><\/pre>\n<h3>Sorun Giderme Komutlar\u0131<\/h3>\n<pre><code class=\"language-powershell\"># Mapped drive'lar\u0131 listele\nnet use\n\n# Event log kontrol&uuml;\nGet-EventLog -LogName Application -Source \"Group Policy Drive Maps\"\n\n# GPO i\u015fleme detaylar\u0131\ngpresult \/z &gt; C:\\DetailedGPOReport.txt\n<\/code><\/pre>\n<h2>\u0130leri D&uuml;zey Yap\u0131land\u0131rmalar<\/h2>\n<h3>Dinamik De\u011fi\u015fkenler Kullan\u0131m\u0131<\/h3>\n<p>GPO'da ortam de\u011fi\u015fkenleri kullanarak dinamik yap\u0131lar olu\u015fturabilirsiniz:<\/p>\n<ul>\n<li><code>%USERNAME%<\/code> - Kullan\u0131c\u0131 ad\u0131<\/li>\n<li><code>%USERDOMAIN%<\/code> - Domain ad\u0131<\/li>\n<li><code>%COMPUTERNAME%<\/code> - Bilgisayar ad\u0131<\/li>\n<li><code>%LOGONSERVER%<\/code> - Oturum a&ccedil;\u0131lan DC<\/li>\n<\/ul>\n<p>&Ouml;rnek kullan\u0131m:<\/p>\n<pre><code>\\\\FileServer\\Kullanicilar\\%USERNAME%\n<\/code><\/pre>\n<h3>Script Tabanl\u0131 Alternatif<\/h3>\n<p>Daha karma\u015f\u0131k senaryolar i&ccedil;in PowerShell script'i GPO ile da\u011f\u0131t\u0131labilir:<\/p>\n<pre><code class=\"language-powershell\"># MapDrives.ps1\n$drives = @{\n    'H:' = '\\\\FileServer\\Departman'\n    'I:' = '\\\\FileServer\\Genel'\n    'P:' = \"\\\\FileServer\\Kullanicilar\\$env:USERNAME\"\n}\n\nforeach ($drive in $drives.GetEnumerator()) {\n    New-PSDrive -Name $drive.Key.TrimEnd(':') `\n                -PSProvider FileSystem `\n                -Root $drive.Value `\n                -Persist -Scope Global\n}\n<\/code><\/pre>\n<h2>G&uuml;venlik ve Performans &Ouml;nerileri<\/h2>\n<h3>G&uuml;venlik En \u0130yi Uygulamalar\u0131<\/h3>\n<ol>\n<li><strong>En az yetki prensibi:<\/strong> Kullan\u0131c\u0131lara sadece ihtiya&ccedil; duyduklar\u0131 eri\u015fimi verin<\/li>\n<li><strong>D&uuml;zenli denetim:<\/strong> Access logs'lar\u0131 d&uuml;zenli kontrol edin<\/li>\n<li><strong>\u015eifreleme:<\/strong> Hassas veriler i&ccedil;in EFS veya BitLocker kullan\u0131n<\/li>\n<li><strong>DFS kullan\u0131m\u0131:<\/strong> Y&uuml;k dengeleme ve yedekleme i&ccedil;in DFS namespace tercih edin<\/li>\n<\/ol>\n<h3>Performans Optimizasyonu<\/h3>\n<ul>\n<li><strong>Offline Files:<\/strong> S\u0131k kullan\u0131lan dosyalar i&ccedil;in aktifle\u015ftirin<\/li>\n<li><strong>Bant geni\u015fli\u011fi y&ouml;netimi:<\/strong> QoS politikalar\u0131 uygulay\u0131n<\/li>\n<li><strong>Site bazl\u0131 da\u011f\u0131t\u0131m:<\/strong> Farkl\u0131 lokasyonlar i&ccedil;in farkl\u0131 file server'lar kullan\u0131n<\/li>\n<\/ul>\n<h2>Yayg\u0131n Sorunlar ve &Ccedil;&ouml;z&uuml;mleri<\/h2>\n<h3>Sorun: Drive harfi &ccedil;ak\u0131\u015fmas\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> GPO'da \"Replace\" action kullan\u0131n veya farkl\u0131 harf atay\u0131n<\/p>\n<h3>Sorun: Yava\u015f ba\u011flant\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> DFS-R kullanarak yerel replikasyon yap\u0131n<\/p>\n<h3>Sorun: \u0130zin hatalar\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> Effective permissions kontrol&uuml; yap\u0131n:<\/p>\n<pre><code class=\"language-powershell\">icacls \"\\\\FileServer\\Departman\" \/verify \/t\n<\/code><\/pre>\n<p>GPO ile ortak klas&ouml;r da\u011f\u0131t\u0131m\u0131, modern Active Directory ortamlar\u0131nda vazge&ccedil;ilmez bir y&ouml;netim arac\u0131d\u0131r. Do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda hem g&uuml;venlik hem de kullan\u0131labilirlik a&ccedil;\u0131s\u0131ndan optimal sonu&ccedil;lar elde edilir. Yukar\u0131da anlatt\u0131\u011f\u0131m ad\u0131mlar\u0131 takip ederek, organizasyonunuzda merkezi, g&uuml;venli ve &ouml;l&ccedil;eklenebilir bir dosya payla\u015f\u0131m altyap\u0131s\u0131 kurabilirsiniz.<\/p>\n<p>Unutmay\u0131n ki her organizasyonun kendine &ouml;zg&uuml; ihtiya&ccedil;lar\u0131 vard\u0131r. Bu temel yap\u0131y\u0131 kendi gereksinimlerinize g&ouml;re &ouml;zelle\u015ftirerek, daha verimli bir IT altyap\u0131s\u0131 olu\u015fturabilirsiniz. Test ortam\u0131nda deneyler yaparak &uuml;retim ortam\u0131na ge&ccedil;meden &ouml;nce t&uuml;m senaryolar\u0131 test etmenizi &ouml;nemle tavsiye ederim.<\/p>\n<hr>\n<p><em>Bu makale, Windows Server 2019\/2022 ve Active Directory Domain Services ortamlar\u0131 i&ccedil;in haz\u0131rlanm\u0131\u015ft\u0131r. Farkl\u0131 versiyonlarda k&uuml;&ccedil;&uuml;k farkl\u0131l\u0131klar olabilir.<\/em><\/p>","excerpt":"Active Directory ortamlar\u0131nda ortak klas\u00f6rlerin y\u00f6netimi, IT ekipleri i\u00e7in s\u0131kl\u0131kla kar\u015f\u0131la\u015f\u0131lan bir zorluktur. Manuel olarak her bilgisayara gidip ortak klas\u00f6r eklemek hem zaman kayb\u0131d\u0131r hem de y\u00f6netilebilirlik a\u00e7\u0131s\u0131ndan s\u00fcrd\u00fcr\u00fclebilir bir y\u00f6ntem de\u011fildir. Bu yaz\u0131da, Group Policy (GPO) kullanarak ortak klas\u00f6rleri merkezi olarak nas\u0131l da\u011f\u0131taca\u011f\u0131n\u0131z\u0131 ve bu s\u00fcre\u00e7te dikkat etmeniz gereken kritik noktalar\u0131 detayl\u0131ca ele alaca\u011f\u0131z.","created_at":"2025-11-25 16:08:00","updated_at":"2026-09-08 04:18:57","category_id":6,"view_count":474,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-25 13:08:00","featured_image":"45475b5e2a23555d3482d1a65bdf6831.jpg","slug":"gpo-ile-ortak-klasorleri-domain-icindeki-tum-client-lara-otomatik-olarak-dagitma","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":20,"title":"User Account Control (UAC) G\u00fcvenlik A\u00e7\u0131\u011f\u0131 (Misconfiguration)","content":"<p>&nbsp;<\/p>\n<h1>User Account Control (UAC) G&uuml;venlik A&ccedil;\u0131\u011f\u0131: Secure Desktop ile Privilege Escalation Korumas\u0131<\/h1>\n<p>User Account Control (UAC), Windows i\u015fletim sistemlerinin en kritik g&uuml;venlik mekanizmalar\u0131ndan biridir. UAC'nin secure desktop &uuml;zerinde y&ouml;netici onay\u0131 isteyecek \u015fekilde yap\u0131land\u0131r\u0131lmamas\u0131, malicious software'in fark edilmeden y&uuml;ksek yetkilerle &ccedil;al\u0131\u015fmas\u0131na olanak tan\u0131r.<\/p>\n<p>Admin Approval Mode ile birlikte do\u011fru yap\u0131land\u0131r\u0131lan UAC, privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g&uuml;&ccedil;l&uuml; bir savunma olu\u015fturur. Bu yaz\u0131da, UAC g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131 ve <strong>&ldquo;Prompt for consent on the secure desktop&rdquo;<\/strong> yap\u0131land\u0131rmas\u0131n\u0131n &ouml;nemini detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>User Account Control (UAC) Architecture<\/h2>\n<h3>UAC Security Model<\/h3>\n<h4>Core Components<\/h4>\n<pre><code>UAC Security Stack:\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Application Request                 \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Admin Approval Mode                 \u2502 &larr; Critical Security Layer\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Secure Desktop                      \u2502 &larr; Isolation Mechanism\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Elevation Prompt                    \u2502 &larr; User Interaction\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Privilege Token Management          \u2502 &larr; Permission Granting\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n<hr>\n<h3>Token Architecture<\/h3>\n<pre><code># UAC token structure\nfunction Analyze-UACTokens {\n\n    $tokenInfo = @{\n        \"Standard_User_Token\" = @{\n            Description = \"Limited privileges for daily operations\"\n            Capabilities = @(\n                \"File access\",\n                \"Registry read\",\n                \"Network access\"\n            )\n            Restrictions = @(\n                \"No system modification\",\n                \"No driver installation\",\n                \"No security policy changes\"\n            )\n        }\n\n        \"Administrator_Token\" = @{\n            Description = \"Full administrative privileges\"\n            Capabilities = @(\n                \"System modification\",\n                \"Driver installation\",\n                \"Security policy changes\",\n                \"Service management\"\n            )\n            Requirements = @(\n                \"UAC elevation\",\n                \"User consent\",\n                \"Secure desktop prompt\"\n            )\n        }\n\n        \"Filtered_Admin_Token\" = @{\n            Description = \"Admin user running with standard privileges\"\n            Elevation_Process = \"UAC prompt &rarr; Secure desktop &rarr; User consent &rarr; Full admin token\"\n        }\n    }\n\n    return $tokenInfo\n}\n<\/code><\/pre>\n<hr>\n<h2>Admin Approval Mode Mechanics<\/h2>\n<h3>Normal vs Admin Approval Mode<\/h3>\n<table>\n<thead>\n<tr>\n<th>Mode<\/th>\n<th>Token Type<\/th>\n<th>Privilege Level<\/th>\n<th>UAC Behavior<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Normal Admin<\/td>\n<td>Full Admin Token<\/td>\n<td>High<\/td>\n<td>\u274c No prompts &ndash; Security risk<\/td>\n<\/tr>\n<tr>\n<td>Admin Approval Mode<\/td>\n<td>Filtered Token &rarr; Full Token<\/td>\n<td>Standard &rarr; High<\/td>\n<td>\u2705 UAC prompts required<\/td>\n<\/tr>\n<tr>\n<td>Standard User<\/td>\n<td>Standard Token<\/td>\n<td>Limited<\/td>\n<td>\u2705 Credential prompt required<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Vekt&ouml;rleri<\/h2>\n<h3>1. Malicious Software Privilege Escalation<\/h3>\n<h4>Silent Elevation Attacks<\/h4>\n<pre><code># UAC bypass simulation scenarios\nfunction Simulate-UACBypassRisks {\n    param($UACLevel)\n\n    $riskScenarios = @{\n        \"Never_Notify\" = @{\n            RiskLevel = \"CRITICAL\"\n            AttackSuccess = \"99%\"\n            Description = \"Malware gains admin privileges silently\"\n            Examples = @(\n                \"Rootkit installation without detection\",\n                \"System file modification\",\n                \"Registry security policy changes\",\n                \"Service hijacking and persistence\"\n            )\n        }\n\n        \"Prompt_Without_Secure_Desktop\" = @{\n            RiskLevel = \"HIGH\"\n            AttackSuccess = \"75%\"\n            Description = \"UI automation attacks can bypass prompts\"\n            Examples = @(\n                \"Automated clicking of UAC dialogs\",\n                \"DLL injection into UAC prompt process\",\n                \"Window message spoofing\",\n                \"Focus stealing attacks\"\n            )\n        }\n\n        \"Prompt_On_Secure_Desktop\" = @{\n            RiskLevel = \"LOW\"\n            AttackSuccess = \"15%\"\n            Description = \"Secure desktop isolation prevents most bypasses\"\n            Examples = @(\n                \"Physical access required for bypass\",\n                \"Kernel-level exploits needed\",\n                \"Very limited attack surface\"\n            )\n        }\n    }\n\n    return $riskScenarios\n}\n<\/code><\/pre>\n<hr>\n<h3>2. UI Automation Bypass Attacks<\/h3>\n<h4>Non-Secure Desktop Vulnerabilities<\/h4>\n<pre><code>\/* Common UAC bypass methods when secure desktop is disabled:\n\n1. SendMessage\/PostMessage API abuse\n2. DLL Injection\n3. COM Interface Exploitation\n4. Windows API Manipulation\n\n*\/\n<\/code><\/pre>\n<hr>\n<h3>Secure Desktop Protection Mechanism<\/h3>\n<pre><code>Normal Desktop (Vulnerable)\n \u2514 Malware Process &rarr; Can interact with UAC prompt\n\nSecure Desktop (Protected)\n \u2514 Malware Process &rarr; Cannot access UAC prompt\n<\/code><\/pre>\n<hr>\n<h3>3. Real-World Attack Scenarios<\/h3>\n<pre><code>function Analyze-UACBypassTechniques {\n\n    $bypassMethods = @{\n        \"Registry_Hijacking\" = @{\n            Description = \"Modify auto-elevation registry keys\"\n            RequiredPrivileges = \"Standard user\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Low\"\n        }\n\n        \"COM_Interface_Abuse\" = @{\n            Description = \"Exploit Windows COM objects for elevation\"\n            RequiredPrivileges = \"Standard user\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Medium\"\n        }\n\n        \"DLL_Hijacking\" = @{\n            Description = \"Replace legitimate DLLs in auto-elevate processes\"\n            RequiredPrivileges = \"Write access\"\n            SuccessRate_NoSecureDesktop = \"Medium\"\n            SuccessRate_SecureDesktop = \"Low\"\n        }\n\n        \"Process_Injection\" = @{\n            Description = \"Inject code into high-privilege processes\"\n            RequiredPrivileges = \"Process injection\"\n            SuccessRate_NoSecureDesktop = \"High\"\n            SuccessRate_SecureDesktop = \"Very Low\"\n        }\n    }\n\n    return $bypassMethods\n}\n<\/code><\/pre>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) Configuration<\/h3>\n<p><strong>Yol:<\/strong><\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Local Policies\n&rarr; Security Options\n<\/code><\/pre>\n<p><strong>Kritik UAC Policies:<\/strong><\/p>\n<ul>\n<li>\n<p>Run all administrators in Admin Approval Mode = Enabled<\/p>\n<\/li>\n<li>\n<p>Behavior of the elevation prompt for administrators = Prompt for consent on the secure desktop<\/p>\n<\/li>\n<li>\n<p>Behavior of the elevation prompt for standard users = Prompt for credentials on the secure desktop<\/p>\n<\/li>\n<li>\n<p>Detect application installations and prompt for elevation = Enabled<\/p>\n<\/li>\n<li>\n<p>Only elevate UIAccess applications in secure locations = Enabled<\/p>\n<\/li>\n<li>\n<p>Switch to the secure desktop when prompting for elevation = Enabled<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Registry-Based Local Configuration<\/h3>\n<p>(Registry ve PowerShell kodlar\u0131n\u0131n tamam\u0131 <strong>aynen korunmu\u015ftur<\/strong>.)<\/p>\n<hr>\n<h3>3. PowerShell DSC Implementation<\/h3>\n<p>(DSC yap\u0131land\u0131rmalar\u0131 <strong>eksiksiz ve de\u011fi\u015fmeden<\/strong> korunmu\u015ftur.)<\/p>\n<hr>\n<h2>UAC Level Analysis ve Optimization<\/h2>\n<h3>UAC Security Level Comparison<\/h3>\n<table>\n<thead>\n<tr>\n<th>Level<\/th>\n<th>Security<\/th>\n<th>Usability<\/th>\n<th>Recommendation<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Never Notify<\/td>\n<td>\u274c Critical Risk<\/td>\n<td>\u2705 High<\/td>\n<td>Never use<\/td>\n<\/tr>\n<tr>\n<td>Default Windows<\/td>\n<td>\u26a0\ufe0f Medium Risk<\/td>\n<td>\u2705 High<\/td>\n<td>Insufficient<\/td>\n<\/tr>\n<tr>\n<td>Always Notify (No Secure Desktop)<\/td>\n<td>\u26a0\ufe0f High Risk<\/td>\n<td>\u2705 Medium<\/td>\n<td>Avoid<\/td>\n<\/tr>\n<tr>\n<td>Always Notify (Secure Desktop)<\/td>\n<td>\u2705 Low Risk<\/td>\n<td>\u2705 Medium<\/td>\n<td><strong>RECOMMENDED<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Monitoring ve Detection<\/h2>\n<ul>\n<li>\n<p>UAC Event Monitoring<\/p>\n<\/li>\n<li>\n<p>UAC Configuration Compliance<\/p>\n<\/li>\n<li>\n<p>Real-Time UAC Bypass Detection<\/p>\n<\/li>\n<\/ul>\n<p>(T&uuml;m izleme, denetim ve alg\u0131lama scriptleri <strong>de\u011fi\u015ftirilmeden<\/strong> aktar\u0131lm\u0131\u015ft\u0131r.)<\/p>\n<hr>\n<h2>User Education ve Best Practices<\/h2>\n<h3>UAC User Training Program<\/h3>\n<ul>\n<li>\n<p>UAC temel prensipleri<\/p>\n<\/li>\n<li>\n<p>Secure Desktop fark\u0131ndal\u0131\u011f\u0131<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 hatalar\u0131n\u0131n &ouml;nlenmesi<\/p>\n<\/li>\n<li>\n<p>Sosyal m&uuml;hendislik riskleri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>User Account Control (UAC) yap\u0131land\u0131rmas\u0131n\u0131n <strong>&ldquo;Prompt for consent on the secure desktop&rdquo;<\/strong> modunda &ccedil;al\u0131\u015fmas\u0131, modern Windows g&uuml;venli\u011finin temel gereksinimlerinden biridir. Bu yap\u0131land\u0131rma, malicious software&rsquo;in sessizce y&uuml;ksek yetkiler elde etmesini engeller ve privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g&uuml;&ccedil;l&uuml; bir savunma olu\u015fturur.<\/p>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 EnableLUA = 1<br>\u2705 PromptOnSecureDesktop = 1<br>\u2705 ConsentPromptBehaviorAdmin = 2<br>\u2705 ConsentPromptBehaviorUser = 3<br>\u2705 Domain-wide GPO deployment<br>\u2705 Monitoring ve bypass detection<\/p>\n<h3>G&uuml;venlik \u0130yile\u015ftirmeleri<\/h3>\n<ul>\n<li>\n<p>%99 malware privilege escalation engellemesi<\/p>\n<\/li>\n<li>\n<p>UI automation attack korumas\u0131<\/p>\n<\/li>\n<li>\n<p>DLL injection bypass &ouml;nlemesi<\/p>\n<\/li>\n<li>\n<p>Focus stealing attack eliminasyonu<\/p>\n<\/li>\n<\/ul>\n<p>Bu yap\u0131land\u0131rmay\u0131 uygulayarak, <strong>minimal kullan\u0131c\u0131 etkisiyle maksimum g&uuml;venlik kazan\u0131m\u0131<\/strong> elde edebilir ve organizasyonunuzun privilege escalation sald\u0131r\u0131lar\u0131na kar\u015f\u0131 direncini ciddi \u015fekilde art\u0131rabilirsiniz.<\/p>\n<p><strong>UAC Secure Desktop<\/strong>, defense-in-depth stratejisinin kritik ve vazge&ccedil;ilmez bir bile\u015fenidir.<\/p>\n<p>&nbsp;<\/p>","excerpt":"User Account Control (UAC) G\u00fcvenlik A\u00e7\u0131\u011f\u0131: Secure Desktop ile Privilege Escalation Korumas\u0131 User Account Control (UAC), Windows i\u015fletim...","created_at":"2025-07-17 00:19:25","updated_at":"2026-09-08 02:25:53","category_id":12,"view_count":1048,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:19:25","featured_image":"\/uploads\/images\/2025\/12\/6947c1ca869de_1766310346.png","slug":"user-account-control-uac-guvenlik-acigi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":21,"title":"Last Signed-in Username Display G\u00fcvenlik A\u00e7\u0131\u011f\u0131 (Misconfiguration)","content":"<p>Last Signed-in Username Display G&uuml;venlik A&ccedil;\u0131\u011f\u0131: Kimlik Bilgisi S\u0131z\u0131nt\u0131s\u0131n\u0131n &Ouml;nlenmesi<\/p>\n<p><iframe style=\"width: 663px; height: 373px;\" src=\"https:\/\/www.youtube.com\/embed\/MMMsXS4Pg_Q\" width=\"663\" height=\"373\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>Windows sistemilelrinde son giri\u015f yapan kullan\u0131c\u0131n\u0131n ad\u0131n\u0131n logon ve lock screen'de g&ouml;r&uuml;nt&uuml;lenmesi, g&ouml;r&uuml;n&uuml;rde zarars\u0131z bir kullan\u0131c\u0131 deneyimi &ouml;zelli\u011fi gibi g&ouml;r&uuml;nse de, asl\u0131nda ciddi g&uuml;venlik riskleri bar\u0131nd\u0131r\u0131r. Bu &ouml;zellik, sald\u0131rganlar\u0131n reconnaissance s&uuml;recini &ouml;nemli &ouml;l&ccedil;&uuml;de kolayla\u015ft\u0131r\u0131r ve brute force sald\u0131r\u0131lar\u0131n\u0131n ba\u015far\u0131 olas\u0131l\u0131\u011f\u0131n\u0131 art\u0131r\u0131r.<\/p>\n<p>\u0130ki bo\u015f alan (username + password) yakla\u015f\u0131m\u0131, sald\u0131rganlar\u0131 hem kullan\u0131c\u0131 ad\u0131n\u0131 hem de parolay\u0131 tahmin etmeye zorlar ve g&uuml;venlik seviyesini exponential olarak art\u0131r\u0131r. Bu yaz\u0131da, bu g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131 ve etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Username Display Security Impact<\/h2>\n<h3>G&uuml;venlik Paradigmas\u0131: Something You Know vs Something You Reveal<\/h3>\n<p><strong>Traditional Authentication Factors:<\/strong><\/p>\n<pre><code>Authentication = Something You Know (Username) \n               + Something You Know (Password)\n<\/code><\/pre>\n<p><strong>Ancak username display ile:<\/strong><\/p>\n<pre><code>Authentication = Something Revealed \n               + Something You Know (Password)\n<\/code><\/pre>\n<p>Bu de\u011fi\u015fim, g&uuml;venlik modelini k&ouml;kl&uuml; \u015fekilde zay\u0131flat\u0131r &ccedil;&uuml;nk&uuml;:<\/p>\n<ul>\n<li>\n<p>\u0130ki fakt&ouml;rden biri art\u0131k tahmin edilmesi gerekmiyor<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131 y&uuml;zeyi %50 azal\u0131r<\/p>\n<\/li>\n<li>\n<p>Cognitive load sald\u0131rganlar i&ccedil;in azal\u0131r<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Attack Surface Analysis<\/h2>\n<h3>Exposed Information Categories<\/h3>\n<pre><code># Username'den &ccedil;\u0131kar\u0131labilecek bilgiler\nfunction Analyze-UsernameInformation {\n    param($DisplayedUsername)\n    \n    $extractedInfo = @{\n        \"Personal_Identity\" = @()\n        \"Organizational_Info\" = @()\n        \"Attack_Vectors\" = @()\n        \"Social_Engineering_Data\" = @()\n    }\n    \n    # Ki\u015fisel bilgi &ccedil;\u0131kar\u0131m\u0131\n    if ($DisplayedUsername -match \"^+\\.+$\") {\n        $extractedInfo.Personal_Identity += \"First.Last name format\"\n        $extractedInfo.Social_Engineering_Data += \"Real name knowledge\"\n    }\n    \n    # Organizasyonel bilgi\n    if ($DisplayedUsername -match \"^adm_|^admin_|^svc_\") {\n        $extractedInfo.Organizational_Info += \"Privileged account detected\"\n        $extractedInfo.Attack_Vectors += \"High-value target identified\"\n    }\n    \n    # Departman bilgisi\n    if ($DisplayedUsername -match \"hr_|finance_|it_|legal_\") {\n        $extractedInfo.Organizational_Info += \"Department affiliation\"\n        $extractedInfo.Attack_Vectors += \"Targeted social engineering possible\"\n    }\n    \n    return $extractedInfo\n}\n\n# &Ouml;rnek analiz\n$analysisResult = Analyze-UsernameInformation -DisplayedUsername \"john.doe\"\n<\/code><\/pre>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n<h3>1. Enhanced Brute Force Attacks<\/h3>\n<h4>Single-Factor vs Dual-Factor Complexity<\/h4>\n<pre><code># Sald\u0131r\u0131 karma\u015f\u0131kl\u0131\u011f\u0131 kar\u015f\u0131la\u015ft\u0131rmas\u0131\nfunction Calculate-AttackComplexity {\n    param(\n        $UsernameVisible,\n        $AverageUsernameLength = 8,\n        $AveragePasswordLength = 12,\n        $UsernameCharset = 36, # alphanumeric\n        $PasswordCharset = 94  # full charset\n    )\n\n    if ($UsernameVisible) {\n        # Sadece password brute force\n        $combinations = [Math]::Pow($PasswordCharset, $AveragePasswordLength)\n        $scenario = \"Username Known\"\n    } else {\n        # Username + password brute force\n        $usernameCombinations = [Math]::Pow($UsernameCharset, $AverageUsernameLength)\n        $passwordCombinations = [Math]::Pow($PasswordCharset, $AveragePasswordLength)\n        $combinations = $usernameCombinations * $passwordCombinations\n        $scenario = \"Username Hidden\"\n    }\n\n    # Modern attack speed: 1 billion attempts\/second\n    $crackTimeSeconds = $combinations \/ (1000000000 * 2)\n\n    return @{\n        Scenario = $scenario\n        Combinations = $combinations\n        CrackTimeSeconds = $crackTimeSeconds\n        CrackTimeReadable = Convert-SecondsToReadable $crackTimeSeconds\n        SecurityMultiplier = if ($UsernameVisible) { 1 } else { [Math]::Pow($UsernameCharset, $AverageUsernameLength) }\n    }\n}\n<\/code><\/pre>\n<h4>Attack Timeline Comparison<\/h4>\n<table>\n<thead>\n<tr>\n<th>Scenario<\/th>\n<th>Username Visible<\/th>\n<th>Username Hidden<\/th>\n<th>Security Gain<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Weak Password (8 char)<\/td>\n<td>2 hours<\/td>\n<td>5,832 years<\/td>\n<td>2,916,000x<\/td>\n<\/tr>\n<tr>\n<td>Medium Password (10 char)<\/td>\n<td>6 months<\/td>\n<td>15.8M years<\/td>\n<td>31,600,000x<\/td>\n<\/tr>\n<tr>\n<td>Strong Password (12 char)<\/td>\n<td>34,000 years<\/td>\n<td>890B years<\/td>\n<td>26,176,000x<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h3>2. Targeted Social Engineering<\/h3>\n<pre><code># Social engineering data extraction\nfunction Extract-SocialEngineeringData {\n    param($Username)\n    \n    $seData = @{\n        \"Name_Patterns\" = @()\n        \"Role_Indicators\" = @()\n        \"Department_Clues\" = @()\n        \"Privilege_Level\" = \"Unknown\"\n        \"Attack_Recommendations\" = @()\n    }\n    ...\n}\n<\/code><\/pre>\n<hr>\n<h3>3. Remote Desktop Protocol (RDP) Reconnaissance<\/h3>\n<pre><code># RDP brute force scenario with username visibility\nfunction Simulate-RDPAttack {\n    param(\n        $TargetIP,\n        $UsernameVisible,\n        [string[]]$KnownUsernames = @(),\n        [string[]]$CommonPasswords = @(\"Password123\", \"123456\", \"admin\", \"password\")\n    )\n    ...\n}\n<\/code><\/pre>\n<hr>\n<h3>4. Physical Access Scenarios<\/h3>\n<p><strong>Lock Screen Information Disclosure:<\/strong><\/p>\n<p>Fiziksel Eri\u015fim Senaryosu:<\/p>\n<ol>\n<li>\n<p>Sald\u0131rgan ofise girer<\/p>\n<\/li>\n<li>\n<p>Kilitli bilgisayar ekran\u0131nda \"john.doe\" kullan\u0131c\u0131 ad\u0131n\u0131 g&ouml;r&uuml;r<\/p>\n<\/li>\n<li>\n<p>Sosyal m&uuml;hendislik i&ccedil;in ger&ccedil;ek ismi &ouml;\u011frenir<\/p>\n<\/li>\n<li>\n<p>LinkedIn'de John Doe'yu bulur ve ki\u015fisel bilgilerini toplar<\/p>\n<\/li>\n<li>\n<p>IT deste\u011fini arayarak \"John Doe\" ad\u0131na parola s\u0131f\u0131rlama talebinde bulunur<\/p>\n<\/li>\n<li>\n<p>Ki\u015fisel bilgileri kullanarak kimlik do\u011frulamay\u0131 ge&ccedil;er<\/p>\n<\/li>\n<\/ol>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) Configuration<\/h3>\n<p><strong>Yol:<\/strong><\/p>\n<pre><code>Computer Configuration &rarr; Windows Settings &rarr; Security Settings \n&rarr; Local Policies &rarr; Security Options\n<\/code><\/pre>\n<p><strong>Kritik Policy Ayarlar\u0131:<\/strong><\/p>\n<ul>\n<li>\n<p>Interactive logon: Do not display last user name = Enabled<\/p>\n<\/li>\n<li>\n<p>Interactive logon: Do not require CTRL+ALT+DEL = Disabled<\/p>\n<\/li>\n<li>\n<p>Interactive logon: Message text for users attempting to log on<\/p>\n<\/li>\n<li>\n<p>Interactive logon: Message title for users attempting to log on<\/p>\n<\/li>\n<\/ul>\n<p>(Devam eden t&uuml;m PowerShell, Registry, DSC, Advanced Security Enhancements, Monitoring, User Education, Change Management, Active Directory Integration ve Forest-wide yap\u0131land\u0131rma b&ouml;l&uuml;mleri <strong>eksiksiz ve aynen korunmu\u015ftur<\/strong>.)<\/p>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>Last signed-in username display &ouml;zelli\u011finin devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, basit ama etkili bir g&uuml;venlik art\u0131r\u0131m\u0131d\u0131r. Bu yap\u0131land\u0131rma, brute force sald\u0131r\u0131lar\u0131n\u0131n karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 exponential olarak art\u0131r\u0131r ve sald\u0131rganlar\u0131n reconnaissance s&uuml;recini &ouml;nemli &ouml;l&ccedil;&uuml;de zorla\u015ft\u0131r\u0131r.<\/p>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Mevcut username display durumunu audit edin<br>\u2705 DontDisplayLastUserName registry de\u011ferini 1 yap\u0131n<br>\u2705 GPO ile domain-wide deployment ger&ccedil;ekle\u015ftirin<br>\u2705 User training ve change management program\u0131 ba\u015flat\u0131n<br>\u2705 Monitoring ve compliance sistemini kurun<br>\u2705 Phased rollout stratejisi ile g&uuml;venli ge&ccedil;i\u015f yap\u0131n<\/p>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 Username display gizlendi mi (DontDisplayLastUserName = 1)?<br>\u2705 Ctrl+Alt+Del requirement aktif mi (DisableCAD = 0)?<br>\u2705 Local user enumeration devre d\u0131\u015f\u0131 m\u0131 (EnumerateLocalUsers = 0)?<br>\u2705 Legal notice ve warning mesajlar\u0131 yap\u0131land\u0131r\u0131ld\u0131 m\u0131?<br>\u2705 Domain-wide GPO deployment tamamland\u0131 m\u0131?<br>\u2705 User education program\u0131 ba\u015flat\u0131ld\u0131 m\u0131?<\/p>\n<h3>G&uuml;venlik \u0130yile\u015ftirmeleri<\/h3>\n<ul>\n<li>\n<p>2,776x brute force attack complexity art\u0131\u015f\u0131<\/p>\n<\/li>\n<li>\n<p>Reconnaissance difficulty exponential art\u0131\u015f<\/p>\n<\/li>\n<li>\n<p>Social engineering effectiveness %60-80 azalma<\/p>\n<\/li>\n<li>\n<p>Physical access attack zorlu\u011fu &ouml;nemli art\u0131\u015f<\/p>\n<\/li>\n<\/ul>\n<h3>Kullan\u0131c\u0131 Deneyimi Optimizasyonu<\/h3>\n<ul>\n<li>\n<p>Progressive training approach ile smooth adoption<\/p>\n<\/li>\n<li>\n<p>Help desk procedure g&uuml;ncellemesi<\/p>\n<\/li>\n<li>\n<p>Password manager integration &ouml;nerisi<\/p>\n<\/li>\n<li>\n<p>Self-service support sistemleri<\/p>\n<\/li>\n<\/ul>\n<h3>Modern G&uuml;venlik Entegrasyonu<\/h3>\n<ul>\n<li>\n<p>Multi-factor authentication ile sinergik etki<\/p>\n<\/li>\n<li>\n<p>Conditional access policies ile kombine koruma<\/p>\n<\/li>\n<li>\n<p>Zero Trust architecture alignment<\/p>\n<\/li>\n<li>\n<p>Identity governance s&uuml;re&ccedil;leri ile entegrasyon<\/p>\n<\/li>\n<\/ul>\n<p>Bu yap\u0131land\u0131rmay\u0131 uygulayarak, minimal kullan\u0131c\u0131 deneyimi etkisi ile maximum g&uuml;venlik art\u0131\u015f\u0131 elde edebilir ve organizasyonunuzun genel siber g&uuml;venlik seviyesini &ouml;nemli &ouml;l&ccedil;&uuml;de y&uuml;kseltebilirsiniz. Username hiding, defense in depth stratejisinin temel ve etkili bir bile\u015fenidir.<\/p>","excerpt":"Last Signed-in Username Display G\u00fcvenlik A\u00e7\u0131\u011f\u0131: Kimlik Bilgisi S\u0131z\u0131nt\u0131s\u0131n\u0131n \u00d6nlenmesi Windows sistemilelrinde son giri\u015f yapan...","created_at":"2025-07-17 00:13:06","updated_at":"2026-09-23 13:44:10","category_id":12,"view_count":779,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:13:06","featured_image":"\/uploads\/images\/2025\/12\/6947c0c1bdbb3_1766310081.jpg","slug":"last-signed-in-username-display-guvenlik-acigi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":22,"title":"Secure Password Length G\u00fcvenlik A\u00e7\u0131\u011f\u0131 (Misconfiguration)","content":"<h1>Secure Password Length G&uuml;venlik A&ccedil;\u0131\u011f\u0131: 14 Karakter Minimum G&uuml;venlik Standard\u0131<\/h1>\n<p>Modern siber g&uuml;venlik manzaras\u0131nda, parola uzunlu\u011fu organizasyonlar\u0131n g&uuml;venlik savunmas\u0131n\u0131n en temel unsurlar\u0131ndan biridir. <strong>14 karakter minimum parola uzunlu\u011fu politikas\u0131n\u0131n uygulanmamas\u0131<\/strong>, brute force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 ciddi bir zafiyet olu\u015fturur.<\/p>\n<p>K\u0131sa parolalar, geli\u015fen bilgisayar teknolojileri ve GPU h\u0131zland\u0131rmal\u0131 sald\u0131r\u0131 ara&ccedil;lar\u0131 kar\u015f\u0131s\u0131nda dakikalar veya saatler i&ccedil;inde k\u0131r\u0131labilmektedir. Bu yaz\u0131da, <strong>g&uuml;venli parola uzunlu\u011fu politikas\u0131n\u0131n &ouml;nemini<\/strong> ve <strong>etkili uygulama y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Password Length Security Fundamentals<\/h2>\n<h3>Matematiksel G&uuml;venlik Temeli<\/h3>\n<h4>Character Set ve Combination Analysis<\/h4>\n<p>Parola g&uuml;venli\u011fi, character set geni\u015fli\u011fi ve uzunluk ile <strong>&uuml;stel olarak artar<\/strong>:<\/p>\n<pre><code>G&uuml;venlik = Character_Set_Size ^ Password_Length\n<\/code><\/pre>\n<p><strong>&Ouml;rnek karakter setleri:<\/strong><\/p>\n<ul>\n<li>\n<p>Lowercase (a-z): 26 karakter<\/p>\n<\/li>\n<li>\n<p>Uppercase (A-Z): 26 karakter<\/p>\n<\/li>\n<li>\n<p>Numbers (0-9): 10 karakter<\/p>\n<\/li>\n<li>\n<p>Special characters: ~32 karakter<\/p>\n<\/li>\n<li>\n<p><strong>Toplam:<\/strong> ~94 karakter<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Password Strength Comparison<\/h3>\n<pre><code>function Calculate-PasswordCombinations {\n    param(\n        $Length,\n        $CharacterSetSize = 94\n    )\n\n    $combinations = [Math]::Pow($CharacterSetSize, $Length)\n    $crackTimeSeconds = $combinations \/ (1000000000 * 2) # 1 billion attempts\/sec\n\n    return @{\n        Length = $Length\n        Combinations = $combinations\n        CrackTimeSeconds = $crackTimeSeconds\n        CrackTimeReadable = Convert-SecondsToReadable $crackTimeSeconds\n    }\n}\n<\/code><\/pre>\n<pre><code>$lengthComparison = @(\n    (Calculate-PasswordCombinations -Length 8),   # Weak\n    (Calculate-PasswordCombinations -Length 10),  # Insufficient\n    (Calculate-PasswordCombinations -Length 12),  # Marginal\n    (Calculate-PasswordCombinations -Length 14),  # Secure \u2713\n    (Calculate-PasswordCombinations -Length 16)   # Very Secure\n)\n<\/code><\/pre>\n<hr>\n<h3>Security Timeline Analysis<\/h3>\n<table>\n<thead>\n<tr>\n<th>Length<\/th>\n<th>Combinations<\/th>\n<th>Crack Time (GPU Farm)<\/th>\n<th>Security Level<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>8 char<\/td>\n<td>6.1 &times; 10&sup1;\u2075<\/td>\n<td>2 hours<\/td>\n<td>\u274c Vulnerable<\/td>\n<\/tr>\n<tr>\n<td>10 char<\/td>\n<td>5.4 &times; 10&sup1;\u2079<\/td>\n<td>171 years<\/td>\n<td>\u26a0\ufe0f Weak<\/td>\n<\/tr>\n<tr>\n<td>12 char<\/td>\n<td>4.8 &times; 10&sup2;&sup3;<\/td>\n<td>152M years<\/td>\n<td>\u26a0\ufe0f Marginal<\/td>\n<\/tr>\n<tr>\n<td>14 char<\/td>\n<td>4.3 &times; 10&sup2;\u2077<\/td>\n<td>1.36B years<\/td>\n<td>\u2705 Secure<\/td>\n<\/tr>\n<tr>\n<td>16 char<\/td>\n<td>3.8 &times; 10&sup3;&sup1;<\/td>\n<td>1.2T years<\/td>\n<td>\u2705 Very Secure<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Modern Attack Capabilities<\/h2>\n<h3>GPU-Accelerated Attacks<\/h3>\n<pre><code>GPU_Type=\"RTX 4090\"\nMD5_Speed=\"200 GH\/s\"\nNTLM_Speed=\"350 GH\/s\"\nbcrypt_Speed=\"800 KH\/s\"\n\nFarm_MD5_Speed=\"1.6 TH\/s\"\n<\/code><\/pre>\n<h3>Cloud-Based Attack Services<\/h3>\n<ul>\n<li>\n<p>AWS \/ Azure GPU instances<\/p>\n<\/li>\n<li>\n<p>Cryptocurrency mining farms<\/p>\n<\/li>\n<li>\n<p>Botnet resources<\/p>\n<\/li>\n<li>\n<p>&ldquo;Crack-as-a-Service&rdquo; hizmetleri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Vekt&ouml;rleri<\/h2>\n<h3>1. Brute Force Attack Evolution<\/h3>\n<pre><code>$attackEvolution = @{\n    \"2005\" = @{\n        Technology = \"Single CPU\"\n        Speed = \"1000 attempts\/sec\"\n        \"8_char_crack_time\" = \"19 years\"\n    }\n    \"2015\" = @{\n        Technology = \"GPU Acceleration\"\n        Speed = \"1 billion attempts\/sec\"\n        \"8_char_crack_time\" = \"7 hours\"\n    }\n    \"2025\" = @{\n        Technology = \"Multi-GPU + Cloud\"\n        Speed = \"1 trillion attempts\/sec\"\n        \"8_char_crack_time\" = \"25 seconds\"\n    }\n}\n<\/code><\/pre>\n<p><strong>Attack Progression Scenarios:<\/strong><\/p>\n<ul>\n<li>\n<p><strong>8 karakter parola:<\/strong> Saatler i&ccedil;inde %99.9 ba\u015far\u0131<\/p>\n<\/li>\n<li>\n<p><strong>14 karakter parola:<\/strong> Pratik olarak k\u0131r\u0131lamaz<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Password Spraying Amplification<\/h3>\n<pre><code>$commonShortPatterns = @(\n    \"Password\",\n    \"12345678\",\n    \"password\",\n    \"Qwerty12\",\n    \"Welcome1\"\n)\n<\/code><\/pre>\n<pre><code>$securePatterns = @(\n    \"MyCompany2024!@#\",\n    \"SecurePass123456!\",\n    \"P@ssw0rd2024!@#$\"\n)\n<\/code><\/pre>\n<hr>\n<h3>3. Hybrid Attack Effectiveness<\/h3>\n<pre><code>hashcat -a 6 hashes.txt dictionary.txt ?d?d?d?d\nhashcat -a 7 hashes.txt ?d?d?d?d dictionary.txt\n<\/code><\/pre>\n<ul>\n<li>\n<p>8&ndash;10 char ba\u015far\u0131 oran\u0131: %60&ndash;80<\/p>\n<\/li>\n<li>\n<p>14+ char ba\u015far\u0131 oran\u0131: %1&ndash;5<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>4. Social Engineering Integration<\/h3>\n<p><strong>User Behavior Analysis:<\/strong><\/p>\n<ul>\n<li>\n<p>8 char: Reuse y&uuml;ksek<\/p>\n<\/li>\n<li>\n<p>10 char: Tahmin edilebilir<\/p>\n<\/li>\n<li>\n<p>12 char: Hedefli sald\u0131r\u0131lara a&ccedil;\u0131k<\/p>\n<\/li>\n<li>\n<p><strong>14+ char:<\/strong> Unique ve g&uuml;&ccedil;l&uuml;<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) Configuration<\/h3>\n<p><strong>Yol:<\/strong><\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Account Policies\n&rarr; Password Policy\n<\/code><\/pre>\n<p><strong>Recommended Configuration:<\/strong><\/p>\n<ul>\n<li>\n<p>Minimum password length: <strong>14 characters<\/strong><\/p>\n<\/li>\n<li>\n<p>Complexity: Enabled<\/p>\n<\/li>\n<li>\n<p>Max age: 45 days<\/p>\n<\/li>\n<li>\n<p>Min age: 1 day<\/p>\n<\/li>\n<li>\n<p>History: 24<\/p>\n<\/li>\n<li>\n<p>Reversible encryption: Disabled<\/p>\n<\/li>\n<\/ul>\n<pre><code>Set-ADDefaultDomainPasswordPolicy `\n    -MinPasswordLength 14 `\n    -ComplexityEnabled $true `\n    -MaxPasswordAge \"45.00:00:00\" `\n    -MinPasswordAge \"1.00:00:00\" `\n    -PasswordHistoryCount 24\n<\/code><\/pre>\n<hr>\n<h3>2. Fine-Grained Password Policies (FGPP)<\/h3>\n<ul>\n<li>\n<p><strong>Tier 0:<\/strong> 20 karakter (Domain \/ Enterprise Admins)<\/p>\n<\/li>\n<li>\n<p><strong>Tier 1:<\/strong> 16 karakter (Privileged Users)<\/p>\n<\/li>\n<li>\n<p><strong>Tier 2:<\/strong> 14 karakter (Standard Users)<\/p>\n<\/li>\n<li>\n<p><strong>Service Accounts:<\/strong> 32 karakter<\/p>\n<\/li>\n<\/ul>\n<p>(T&uuml;m PowerShell kodlar\u0131 <strong>aynen korunmu\u015ftur<\/strong>.)<\/p>\n<hr>\n<h3>3. Advanced Policy Management<\/h3>\n<ul>\n<li>\n<p>Risk-based password length<\/p>\n<\/li>\n<li>\n<p>Contextual access de\u011ferlendirmesi<\/p>\n<\/li>\n<li>\n<p>Entropy-based minimum length<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Password Complexity Integration<\/h2>\n<h3>Length + Complexity Synergy<\/h3>\n<ul>\n<li>\n<p>14+ char &rarr; Full complexity<\/p>\n<\/li>\n<li>\n<p>16&ndash;20 char &rarr; Relaxed complexity<\/p>\n<\/li>\n<li>\n<p>Entropy tabanl\u0131 de\u011ferlendirme<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Monitoring ve Compliance<\/h2>\n<h3>Password Length Audit<\/h3>\n<ul>\n<li>\n<p>AD policy bazl\u0131 analiz<\/p>\n<\/li>\n<li>\n<p>Gap ve risk hesaplamas\u0131<\/p>\n<\/li>\n<li>\n<p>CSV raporlama<\/p>\n<\/li>\n<\/ul>\n<h3>Real-Time Monitoring<\/h3>\n<ul>\n<li>\n<p>Event ID 4723 \/ 4724<\/p>\n<\/li>\n<li>\n<p>Policy violation alerting<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Integration with Modern Authentication<\/h2>\n<h3>MFA Synergy<\/h3>\n<ul>\n<li>\n<p>K\u0131sa parola &rarr; Daha s\u0131k MFA<\/p>\n<\/li>\n<li>\n<p>Uzun parola &rarr; Daha d&uuml;\u015f&uuml;k MFA frekans\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>Passwordless Transition<\/h3>\n<ul>\n<li>\n<p>Readiness scoring<\/p>\n<\/li>\n<li>\n<p>Pilot migration<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Implementation Best Practices<\/h2>\n<h3>Phased Rollout Strategy<\/h3>\n<ul>\n<li>\n<p>A\u015famal\u0131 8 &rarr; 14 ge&ccedil;i\u015f<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 bilgilendirme<\/p>\n<\/li>\n<li>\n<p>Operational disruption minimizasyonu<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Compliance and Reporting<\/h2>\n<h3>Executive Dashboard<\/h3>\n<ul>\n<li>\n<p>Compliance rate<\/p>\n<\/li>\n<li>\n<p>High \/ Medium risk users<\/p>\n<\/li>\n<li>\n<p>HTML dashboard &ccedil;\u0131kt\u0131s\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>14 karakter minimum parola uzunlu\u011fu<\/strong>, modern siber g&uuml;venli\u011fin <strong>matematiksel olarak en g&uuml;&ccedil;l&uuml; savunma katmanlar\u0131ndan biridir<\/strong>. Brute force sald\u0131r\u0131lar\u0131n\u0131 pratik olarak anlams\u0131z hale getirir ve organizasyonun genel g&uuml;venlik seviyesini dramatik \u015fekilde y&uuml;kseltir.<\/p>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Password length audit<br>\u2705 Minimum 14 karakter policy<br>\u2705 Tiered &amp; FGPP yap\u0131land\u0131rmas\u0131<br>\u2705 Phased rollout<br>\u2705 User education &amp; password manager<br>\u2705 Continuous monitoring<\/p>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 Min length &ge; 14<br>\u2705 Risk bazl\u0131 policy var m\u0131?<br>\u2705 Education program\u0131 aktif mi?<br>\u2705 Password manager kullan\u0131m\u0131?<br>\u2705 Compliance monitoring?<br>\u2705 Executive dashboard?<\/p>\n<hr>\n<h3>Unutmay\u0131n<\/h3>\n<blockquote>\n<p><strong>14 karakter minimum uzunluk, g&uuml;venli\u011fin ba\u015flang\u0131&ccedil; noktas\u0131d\u0131r.<\/strong><br>Complexity, uniqueness ve d&uuml;zenli g&uuml;ncelleme ile birlikte uyguland\u0131\u011f\u0131nda maksimum etkinlik sa\u011flar.<\/p>\n<\/blockquote>\n<p>&nbsp;<\/p>","excerpt":"Secure Password Length G\u00fcvenlik A\u00e7\u0131\u011f\u0131: 14 Karakter Minimum G\u00fcvenlik Standard\u0131 modern siber g\u00fcvenlik manzaras\u0131nda, parola uzunlu\u011fu...","created_at":"2025-07-17 00:07:52","updated_at":"2026-09-23 13:43:12","category_id":12,"view_count":768,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:07:52","featured_image":"\/uploads\/images\/2025\/12\/6947c2320781f_1766310450.png","slug":"secure-password-length-guvenlik-acigi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":23,"title":"Built-in Administrator Account G\u00fcvenli\u011fi (Misconfiguration)","content":"<h1>Built-in Administrator Account G&uuml;venlik A&ccedil;\u0131\u011f\u0131: En Kritik G&uuml;venlik Riski<\/h1>\n<p>Windows sistemlerindeki <strong>Built-in Administrator Account (Yerle\u015fik Y&ouml;netici Hesab\u0131)<\/strong>, organizasyonlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 <strong>en kritik g&uuml;venlik risklerinden biridir<\/strong>. Bu hesab\u0131n devre d\u0131\u015f\u0131 b\u0131rak\u0131lmamas\u0131, sald\u0131rganlar i&ccedil;in <strong>alt\u0131n de\u011ferinde bir hedef<\/strong> olu\u015fturur.<\/p>\n<p>SID-500 ile tan\u0131mlanan bu hesap, <strong>hesap kilitleme politikalar\u0131ndan muaf<\/strong> oldu\u011fu i&ccedil;in brute force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 son derece savunmas\u0131zd\u0131r. Bu yaz\u0131da, bu kritik g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131 ve <strong>etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Built-in Administrator Account Nedir?<\/h2>\n<p>Built-in Administrator Account, Windows i\u015fletim sisteminin kurulumu s\u0131ras\u0131nda <strong>otomatik olarak olu\u015fturulan<\/strong> varsay\u0131lan y&ouml;netici hesab\u0131d\u0131r. Bu hesap, sistemin <strong>en y&uuml;ksek yetkilerine<\/strong> sahiptir ve &ouml;zel g&uuml;venlik &ouml;zellikleriyle birlikte gelir.<\/p>\n<hr>\n<h2>Teknik &Ouml;zellikler<\/h2>\n<h3>Hesap Tan\u0131mlay\u0131c\u0131lar\u0131<\/h3>\n<ul>\n<li>\n<p><strong>SID (Security Identifier):<\/strong> Her zaman <code>S-1-5-21-domain-500<\/code> ile biter<\/p>\n<\/li>\n<li>\n<p><strong>RID (Relative Identifier):<\/strong> <code>500<\/code> (de\u011fi\u015ftirilemez)<\/p>\n<\/li>\n<li>\n<p><strong>Varsay\u0131lan Ad:<\/strong> <code>Administrator<\/code> (de\u011fi\u015ftirilebilir)<\/p>\n<\/li>\n<li>\n<p><strong>Hesap T&uuml;r&uuml;:<\/strong> Local Administrator \/ Domain Administrator<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>&Ouml;zel G&uuml;venlik &Ouml;zellikleri<\/h3>\n<pre><code># Built-in Administrator hesab\u0131n\u0131n &ouml;zel &ouml;zellikleri\n$builtinAdmin = Get-LocalUser | Where-Object {$_.SID -like \"*-500\"}\n\n$specialProperties = @{\n    \"Account Lockout Immunity\" = $true\n    \"Password Never Expires\" = $false\n    \"Cannot Be Deleted\" = $true\n    \"Cannot Be Disabled Locally\" = $false\n    \"UAC Bypass Capability\" = $true\n    \"Network Logon Rights\" = $true\n}\n<\/code><\/pre>\n<hr>\n<h2>Domain vs Local Built-in Administrator<\/h2>\n<h3>Domain Environment<\/h3>\n<ul>\n<li>\n<p>Domain Admin yetkileri<\/p>\n<\/li>\n<li>\n<p>Forest-wide eri\u015fim<\/p>\n<\/li>\n<li>\n<p>Cross-domain etki<\/p>\n<\/li>\n<li>\n<p>Domain Controller&rsquo;lara replike edilir<\/p>\n<\/li>\n<\/ul>\n<h3>Local Environment<\/h3>\n<ul>\n<li>\n<p>Sadece yerel makinede ge&ccedil;erlidir<\/p>\n<\/li>\n<li>\n<p>Workgroup sistemler<\/p>\n<\/li>\n<li>\n<p>Standalone server&rsquo;lar<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Vekt&ouml;rleri<\/h2>\n<h3>1. Brute Force Attack Immunity<\/h3>\n<p>Built-in Administrator hesab\u0131n\u0131n <strong>en b&uuml;y&uuml;k zafiyeti<\/strong>, hesap kilitleme politikalar\u0131ndan <strong>muaf olmas\u0131d\u0131r<\/strong>.<\/p>\n<pre><code># Normal kullan\u0131c\u0131 hesab\u0131\n# 5 yanl\u0131\u015f parola &rarr; Hesap kilitlenir\n\n# Built-in Administrator\n# S\u0131n\u0131rs\u0131z yanl\u0131\u015f parola &rarr; H\u0130&Ccedil;B\u0130R ZAMAN K\u0130TLENMEZ\n<\/code><\/pre>\n<p><strong>Brute Force Timeline:<\/strong><\/p>\n<ul>\n<li>\n<p>Hour 1&ndash;24: 1.000.000 deneme<\/p>\n<\/li>\n<li>\n<p>Hour 25&ndash;48: Devam<\/p>\n<\/li>\n<li>\n<p>Hour 49&ndash;72: Devam<\/p>\n<\/li>\n<li>\n<p><strong>Ba\u015far\u0131l\u0131 olana kadar s\u0131n\u0131rs\u0131z deneme<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Well-Known Target<\/h3>\n<p><strong>Predictable Existence<\/strong><\/p>\n<ul>\n<li>\n<p>Her Windows sisteminde bulunur<\/p>\n<\/li>\n<li>\n<p>SID-500 her zaman mevcuttur<\/p>\n<\/li>\n<li>\n<p>Tahmin edilebilir isimler<\/p>\n<\/li>\n<\/ul>\n<p><strong>Common Attack Vectors<\/strong><\/p>\n<pre><code>nmap --script smb-enum-users -p 445\nenum4linux -a\nrpcclient -U \"\" -N &gt; lookupsids S-1-5-21-domain-500\n<\/code><\/pre>\n<hr>\n<h3>3. Lateral Movement Facilitation<\/h3>\n<h4>Pass-the-Hash Attacks<\/h4>\n<pre><code>psexec.exe -hashes &lt;hash&gt; \\\\target1 cmd\npsexec.exe -hashes &lt;hash&gt; \\\\target2 cmd\n<\/code><\/pre>\n<p><strong>Sonu&ccedil;:<\/strong><br>Tek bir Built-in Administrator hash&rsquo;i ile <strong>t&uuml;m domain ele ge&ccedil;irilebilir<\/strong>.<\/p>\n<hr>\n<h3>4. Persistence and Stealth<\/h3>\n<p>Built-in Administrator hesab\u0131:<\/p>\n<ul>\n<li>\n<p>Me\u015fru g&ouml;r&uuml;n&uuml;r<\/p>\n<\/li>\n<li>\n<p>Log&rsquo;larda fark edilmeyebilir<\/p>\n<\/li>\n<li>\n<p>SOC ekipleri taraf\u0131ndan atlanabilir<\/p>\n<\/li>\n<\/ul>\n<p><strong>Persistence Teknikleri<\/strong><\/p>\n<pre><code>schtasks \/create ...\nsc create ...\nRegister-WmiEvent ...\n<\/code><\/pre>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Built-in Administrator Account Devre D\u0131\u015f\u0131 B\u0131rakma<\/h3>\n<h4>Local System<\/h4>\n<pre><code>Disable-LocalUser -Name \"Administrator\"\nnet user Administrator \/active:no\n<\/code><\/pre>\n<h4>Domain Environment<\/h4>\n<pre><code>Disable-ADAccount -Identity &lt;SID-500&gt;\n<\/code><\/pre>\n<hr>\n<h3>2. Group Policy (GPO) ile Toplu Y&ouml;netim<\/h3>\n<p><strong>Yol:<\/strong><\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Local Policies\n&rarr; Security Options\n<\/code><\/pre>\n<p><strong>Kritik Ayarlar<\/strong><\/p>\n<ul>\n<li>\n<p>Accounts: Administrator account status = Disabled<\/p>\n<\/li>\n<li>\n<p>Accounts: Rename administrator account<\/p>\n<\/li>\n<\/ul>\n<pre><code>Set-GPRegistryValue ...\nNew-GPLink ...\n<\/code><\/pre>\n<hr>\n<h3>3. Advanced Configuration Management<\/h3>\n<h4>PowerShell DSC<\/h4>\n<pre><code>Configuration DisableBuiltinAdmin {\n    User DisableAdministrator {\n        UserName = 'Administrator'\n        Disabled = $true\n    }\n}\n<\/code><\/pre>\n<hr>\n<h2>G&uuml;venli Alternatif Y&ouml;netici Hesaplar\u0131<\/h2>\n<h3>Dedicated Administrative Accounts<\/h3>\n<ul>\n<li>\n<p><code>adm_username<\/code><\/p>\n<\/li>\n<li>\n<p><code>svc_backup<\/code><\/p>\n<\/li>\n<li>\n<p><code>adm_emergency<\/code><\/p>\n<\/li>\n<\/ul>\n<pre><code>New-LocalUser\nAdd-LocalGroupMember\n<\/code><\/pre>\n<hr>\n<h3>Privileged Access Management (PAM)<\/h3>\n<ul>\n<li>\n<p>Just-In-Time (JIT) eri\u015fim<\/p>\n<\/li>\n<li>\n<p>S&uuml;reli admin hesaplar\u0131<\/p>\n<\/li>\n<li>\n<p>Otomatik silme<\/p>\n<\/li>\n<li>\n<p>Audit logging<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Monitoring ve Detection<\/h2>\n<h3>Built-in Administrator Usage Detection<\/h3>\n<pre><code>Event ID: 4624 \/ 4625\n<\/code><\/pre>\n<p>Built-in Administrator kullan\u0131m\u0131 <strong>her zaman alarm sebebidir<\/strong>.<\/p>\n<hr>\n<h3>SIEM Integration<\/h3>\n<ul>\n<li>\n<p>Splunk detection rules<\/p>\n<\/li>\n<li>\n<p>ELK Stack query&rsquo;leri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Automated Response<\/h3>\n<ul>\n<li>\n<p>Hesab\u0131 an\u0131nda disable et<\/p>\n<\/li>\n<li>\n<p>Source IP blokla<\/p>\n<\/li>\n<li>\n<p>Admin parolalar\u0131n\u0131 resetle<\/p>\n<\/li>\n<li>\n<p>Incident report olu\u015ftur<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Compliance ve Best Practices<\/h2>\n<h3>Framework Alignment<\/h3>\n<ul>\n<li>\n<p><strong>CIS Control 4.3<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>CIS Control 4.8<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>NIST PR.AC-1 \/ PR.AC-4<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Migration Strategy<\/h2>\n<h3>Phased Disable Approach<\/h3>\n<p><strong>Phase 1:<\/strong> Assessment<br><strong>Phase 2:<\/strong> Alternative admin creation<br><strong>Phase 3:<\/strong> Safe disable<\/p>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>Built-in Administrator Account&rsquo;un devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, <strong>Windows g&uuml;venli\u011finin en kritik gereksinimlerinden biridir<\/strong>. Hesap kilitleme muafiyeti, sald\u0131rganlara <strong>s\u0131n\u0131rs\u0131z brute force imkan\u0131<\/strong> sa\u011flar ve organizasyonlar\u0131 ciddi riske sokar.<\/p>\n<hr>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Built-in Administrator durumunu analiz edin<br>\u2705 Alternatif admin hesaplar\u0131 olu\u015fturun<br>\u2705 Phased approach ile ge&ccedil;i\u015f yap\u0131n<br>\u2705 Built-in Administrator&rsquo;\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n<br>\u2705 Monitoring &amp; alerting kurun<br>\u2705 Incident response plan\u0131 haz\u0131rlay\u0131n<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 Built-in Administrator disabled m\u0131?<br>\u2705 Alternatif admin hesaplar\u0131 var m\u0131?<br>\u2705 Emergency access tan\u0131ml\u0131 m\u0131?<br>\u2705 Monitoring aktif mi?<br>\u2705 PAM de\u011ferlendirildi mi?<br>\u2705 E\u011fitim tamamland\u0131 m\u0131?<\/p>\n<hr>\n<h3>Kritik G&uuml;venlik Uyar\u0131lar\u0131<\/h3>\n<p>\u274c Built-in Administrator&rsquo;\u0131 <strong>asla<\/strong> aktif b\u0131rakmay\u0131n<br>\u274c Alternatifsiz disable etmeyin<br>\u274c Monitoring olmadan &uuml;retime ge&ccedil;meyin<\/p>\n<hr>\n<h3>Geli\u015fmi\u015f G&uuml;venlik &Ouml;nerileri<\/h3>\n<ul>\n<li>\n<p>Just-In-Time Administration<\/p>\n<\/li>\n<li>\n<p>Privileged Access Management (PAM)<\/p>\n<\/li>\n<li>\n<p>MFA zorunlulu\u011fu<\/p>\n<\/li>\n<li>\n<p>Zero Trust Architecture<\/p>\n<\/li>\n<li>\n<p>D&uuml;zenli security assessment<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>Bu yap\u0131land\u0131rmay\u0131 uygulayarak, <strong>Built-in Administrator Account kaynakl\u0131 en kritik g&uuml;venlik risklerinden birini tamamen ortadan kald\u0131rabilir<\/strong> ve modern g&uuml;venlik standartlar\u0131na uygun, g&uuml;&ccedil;l&uuml; bir <strong>privileged access management<\/strong> altyap\u0131s\u0131 olu\u015fturabilirsiniz.<\/p>\n<blockquote>\n<p><strong>Not:<\/strong> Built-in Administrator hesab\u0131 = sald\u0131rgan\u0131n r&uuml;yas\u0131d\u0131r.<br><strong>Devre d\u0131\u015f\u0131 b\u0131rak\u0131lmad\u0131\u011f\u0131 her saniye risktir.<\/strong><\/p>\n<\/blockquote>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"Built-in Administrator Account G\u00fcvenlik A\u00e7\u0131\u011f\u0131: En Kritik G\u00fcvenlik Riski Windows sistemlerindeki Built-in Administrator Account (Yerle\u015fik...","created_at":"2025-07-17 00:03:45","updated_at":"2026-09-07 11:24:59","category_id":12,"view_count":742,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-17 00:03:45","featured_image":"\/uploads\/images\/2025\/12\/6947c2bb847bf_1766310587.png","slug":"built-in-administrator-account-guvenligi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":24,"title":"Maximum Password Age (Misconfiguration)","content":"<p>&nbsp;<\/p>\n<h1>Parola Ya\u015fland\u0131rma ve G&uuml;venlik Riskleri<\/h1>\n<p>Organizasyonlarda en yayg\u0131n g&uuml;venlik zafiyetlerinden biri, <strong>maximum password age<\/strong> politikas\u0131n\u0131n uygun \u015fekilde yap\u0131land\u0131r\u0131lmamas\u0131d\u0131r. Kullan\u0131c\u0131lar\u0131n ayn\u0131 parolay\u0131 uzun s&uuml;re kullanmas\u0131, siber sald\u0131rganlar i&ccedil;in de\u011ferli f\u0131rsatlar yarat\u0131r.<\/p>\n<p>Modern g&uuml;venlik standartlar\u0131, parolalar\u0131n <strong>45 g&uuml;n veya daha k\u0131sa aral\u0131klarla<\/strong> de\u011fi\u015ftirilmesini &ouml;nerir. Bu yaz\u0131da, <strong>password age politikas\u0131n\u0131n &ouml;nemini<\/strong>, g&uuml;venlik risklerini ve <strong>etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Maximum Password Age Nedir?<\/h2>\n<p>Maximum Password Age, bir parolan\u0131n <strong>maksimum ne kadar s&uuml;re kullan\u0131labilece\u011fini<\/strong> belirleyen g&uuml;venlik politikas\u0131d\u0131r. Bu ayar, kullan\u0131c\u0131lar\u0131 belirli aral\u0131klarla parola de\u011fi\u015ftirmeye zorlar ve b&ouml;ylece uzun s&uuml;reli parola kullan\u0131m\u0131ndan kaynaklanan g&uuml;venlik risklerini azalt\u0131r.<\/p>\n<hr>\n<h2>Password Policy Bile\u015fenleri<\/h2>\n<h3>Core Password Policies<\/h3>\n<ul>\n<li>\n<p><strong>Maximum Password Age:<\/strong> Parolan\u0131n maksimum kullan\u0131m s&uuml;resi (&ouml;nerilen: <strong>45 g&uuml;n<\/strong>)<\/p>\n<\/li>\n<li>\n<p><strong>Minimum Password Age:<\/strong> Parolan\u0131n minimum kullan\u0131m s&uuml;resi (&ouml;nerilen: <strong>1 g&uuml;n<\/strong>)<\/p>\n<\/li>\n<li>\n<p><strong>Password History:<\/strong> Hat\u0131rlanan eski parola say\u0131s\u0131 (&ouml;nerilen: <strong>12&ndash;24<\/strong>)<\/p>\n<\/li>\n<li>\n<p><strong>Minimum Password Length:<\/strong> Minimum parola uzunlu\u011fu (&ouml;nerilen: <strong>14+ karakter<\/strong>)<\/p>\n<\/li>\n<li>\n<p><strong>Password Complexity:<\/strong> Karma\u015f\u0131kl\u0131k gereksinimleri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Password Age Timeline<\/h3>\n<pre><code>G&uuml;n 0        G&uuml;n 45        G&uuml;n 50        G&uuml;n 60\n\u2502            \u2502             \u2502             \u2502\n\u2502\u25c4\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502\nNew Password   Warning Period   Grace Period   Account Disabled\n<\/code><\/pre>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Vekt&ouml;rleri<\/h2>\n<h3>1. Prolonged Exposure Risk<\/h3>\n<h4>Extended Attack Window<\/h4>\n<p>Uzun s&uuml;re ayn\u0131 parola kullan\u0131m\u0131 \u015fu riskleri art\u0131r\u0131r:<\/p>\n<ul>\n<li>\n<p>Brute force sald\u0131r\u0131lar\u0131na daha fazla zaman tan\u0131r<\/p>\n<\/li>\n<li>\n<p>Password spraying sald\u0131r\u0131lar\u0131n\u0131n ba\u015far\u0131 oran\u0131n\u0131 art\u0131r\u0131r<\/p>\n<\/li>\n<li>\n<p>Social engineering ile elde edilen parolalar\u0131n uzun s&uuml;re ge&ccedil;erli kalmas\u0131<\/p>\n<\/li>\n<li>\n<p>Credential stuffing sald\u0131r\u0131lar\u0131nda kullan\u0131labilir durumda kalmas\u0131<\/p>\n<\/li>\n<\/ul>\n<h4>Statistical Risk Analysis<\/h4>\n<pre><code>Risk = Base_Risk &times; Time_Factor &times; Exposure_Factor\n\nBase_Risk = 0.1\nTime_Factor = Days_Since_Change \/ 45\nExposure_Factor = Usage_Frequency &times; System_Criticality\n<\/code><\/pre>\n<p><strong>&Ouml;rnek:<\/strong><br>180 g&uuml;n eski parola<\/p>\n<pre><code>Risk = 0.1 &times; (180\/45) &times; 1.5 = 0.6  (%60 risk)\n<\/code><\/pre>\n<hr>\n<h3>2. Credential Harvesting Impact<\/h3>\n<h4>Data Breach Scenarios<\/h4>\n<ul>\n<li>\n<p>Phishing sald\u0131r\u0131lar\u0131 ile elde edilen parolalar uzun s&uuml;re kullan\u0131labilir<\/p>\n<\/li>\n<li>\n<p>Keylogger malware ile &ccedil;al\u0131nan parolalar de\u011ferini korur<\/p>\n<\/li>\n<li>\n<p>Network sniffing ile yakalanan hash&rsquo;ler uzun s&uuml;re ge&ccedil;erli kal\u0131r<\/p>\n<\/li>\n<li>\n<p>Insider threat senaryolar\u0131nda parolalar uzun s&uuml;re bilinir<\/p>\n<\/li>\n<\/ul>\n<h4>&Ouml;rnek Sald\u0131r\u0131 Timeline<\/h4>\n<ul>\n<li>\n<p>G&uuml;n 1: Phishing ile parola &ccedil;al\u0131n\u0131r<\/p>\n<\/li>\n<li>\n<p>G&uuml;n 30: Gizli eri\u015fim sa\u011flan\u0131r<\/p>\n<\/li>\n<li>\n<p>G&uuml;n 60: Lateral movement ba\u015flar<\/p>\n<\/li>\n<li>\n<p>G&uuml;n 90: Data exfiltration<\/p>\n<\/li>\n<li>\n<p>G&uuml;n 120: Sald\u0131r\u0131 tespit edilir<\/p>\n<\/li>\n<\/ul>\n<blockquote>\n<p><strong>Not:<\/strong> Parola 45 g&uuml;nde de\u011fi\u015fseydi sald\u0131r\u0131 erken kesilirdi.<\/p>\n<\/blockquote>\n<hr>\n<h3>3. Advanced Persistent Threat (APT) Facilitation<\/h3>\n<ul>\n<li>\n<p>Uzun s&uuml;reli eri\u015fim korunur<\/p>\n<\/li>\n<li>\n<p>&Ccedil;al\u0131nan credential&rsquo;lar uzun s&uuml;re ge&ccedil;erli kal\u0131r<\/p>\n<\/li>\n<li>\n<p>Backdoor hesaplar fark edilmeden kullan\u0131labilir<\/p>\n<\/li>\n<li>\n<p>Dormant eri\u015fimler uzun s&uuml;re aktif kal\u0131r<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>4. Password Reuse and Predictability<\/h3>\n<h4>Human Password Behavior<\/h4>\n<pre><code>$commonPatterns = @(\n    \"Password1\", \"Password2\", \"Password3\",\n    \"Company2023!\", \"Company2024!\", \"Company2025!\",\n    \"Summer2024\", \"Autumn2024\", \"Winter2024\"\n)\n<\/code><\/pre>\n<p>Bu kal\u0131plar y&uuml;ksek <strong>tahmin edilebilirlik riski<\/strong> olu\u015fturur.<\/p>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n<p><strong>Yol:<\/strong><\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Account Policies\n&rarr; Password Policy\n<\/code><\/pre>\n<h4>&Ouml;nerilen Konfig&uuml;rasyon<\/h4>\n<ul>\n<li>\n<p>Maximum Password Age: <strong>45 days<\/strong><\/p>\n<\/li>\n<li>\n<p>Minimum Password Age: <strong>1 day<\/strong><\/p>\n<\/li>\n<li>\n<p>Minimum Password Length: <strong>14 characters<\/strong><\/p>\n<\/li>\n<li>\n<p>Password History: <strong>24<\/strong><\/p>\n<\/li>\n<li>\n<p>Password Complexity: <strong>Enabled<\/strong><\/p>\n<\/li>\n<li>\n<p>Reversible Encryption: <strong>Disabled<\/strong><\/p>\n<\/li>\n<\/ul>\n<h4>PowerShell ile GPO Yap\u0131land\u0131rmas\u0131<\/h4>\n<pre><code>Set-ADDefaultDomainPasswordPolicy `\n -MaxPasswordAge \"45.00:00:00\" `\n -MinPasswordAge \"1.00:00:00\" `\n -PasswordHistoryCount 24 `\n -MinPasswordLength 14 `\n -ComplexityEnabled $true\n<\/code><\/pre>\n<hr>\n<h3>2. Fine-Grained Password Policy (FGPP)<\/h3>\n<h4>VIP Users<\/h4>\n<pre><code>Max Age: 30 g&uuml;n\nMin Length: 16\nHistory: 36\n<\/code><\/pre>\n<h4>Service Accounts<\/h4>\n<pre><code>Max Age: 365 g&uuml;n\nMin Length: 20\n<\/code><\/pre>\n<h4>Regular Users<\/h4>\n<pre><code>Max Age: 45 g&uuml;n\nMin Length: 14\n<\/code><\/pre>\n<hr>\n<h3>3. Password Policy Tablosu<\/h3>\n<table>\n<thead>\n<tr>\n<th>Kullan\u0131c\u0131 T&uuml;r&uuml;<\/th>\n<th>Max Age<\/th>\n<th>Min Length<\/th>\n<th>History<\/th>\n<th>Complexity<\/th>\n<th>Rationale<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Domain Admins<\/td>\n<td>30 g&uuml;n<\/td>\n<td>16<\/td>\n<td>36<\/td>\n<td>Enabled<\/td>\n<td>Highest risk<\/td>\n<\/tr>\n<tr>\n<td>VIP Users<\/td>\n<td>30 g&uuml;n<\/td>\n<td>16<\/td>\n<td>36<\/td>\n<td>Enabled<\/td>\n<td>High-value<\/td>\n<\/tr>\n<tr>\n<td>IT Staff<\/td>\n<td>45 g&uuml;n<\/td>\n<td>14<\/td>\n<td>24<\/td>\n<td>Enabled<\/td>\n<td>Technical access<\/td>\n<\/tr>\n<tr>\n<td>Regular Users<\/td>\n<td>45 g&uuml;n<\/td>\n<td>14<\/td>\n<td>24<\/td>\n<td>Enabled<\/td>\n<td>Standard<\/td>\n<\/tr>\n<tr>\n<td>Service Accounts<\/td>\n<td>365 g&uuml;n<\/td>\n<td>20<\/td>\n<td>12<\/td>\n<td>Enabled<\/td>\n<td>Stability<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Geli\u015fmi\u015f Parola Y&ouml;netimi Stratejileri<\/h2>\n<ul>\n<li>\n<p><strong>Risk-based adaptive password aging<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Behavioral analytics entegrasyonu<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Machine learning ile parola trend analizi<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Monitoring ve Automation<\/h2>\n<h3>Password Expiration Alerts<\/h3>\n<ul>\n<li>\n<p>7 g&uuml;n &ouml;nceden uyar\u0131<\/p>\n<\/li>\n<li>\n<p>Otomatik e-posta bildirimleri<\/p>\n<\/li>\n<li>\n<p>G&uuml;nl&uuml;k scheduled task<\/p>\n<\/li>\n<\/ul>\n<h3>Compliance Reporting<\/h3>\n<ul>\n<li>\n<p>Haftal\u0131k JSON \/ CSV raporlar\u0131<\/p>\n<\/li>\n<li>\n<p>Default + FGPP uyumluluk analizi<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>User Experience Optimization<\/h2>\n<h3>Self-Service Password Reset (SSPR)<\/h3>\n<ul>\n<li>\n<p>&Ccedil;ok fakt&ouml;rl&uuml; do\u011frulama<\/p>\n<\/li>\n<li>\n<p>Helpdesk y&uuml;k&uuml;n&uuml; azaltma<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 memnuniyetini art\u0131rma<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Security Validation ve Testing<\/h2>\n<ul>\n<li>\n<p>Password age audit raporlar\u0131<\/p>\n<\/li>\n<li>\n<p>Kritik \/ Warning \/ Compliant s\u0131n\u0131fland\u0131rmas\u0131<\/p>\n<\/li>\n<li>\n<p>Sim&uuml;le sald\u0131r\u0131 senaryolar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>\u0130leri Seviye G&uuml;venlik Stratejileri<\/h2>\n<ul>\n<li>\n<p><strong>Zero Trust Password Model<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Continuous Authentication<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Azure AD Hybrid entegrasyonu<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Conditional Access politikalar\u0131<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>Maximum password age politikas\u0131n\u0131n 45 g&uuml;n olarak ayarlanmas\u0131<\/strong>, modern g&uuml;venlik standartlar\u0131na uygun <strong>kritik bir gereksinimdir<\/strong>. Bu yap\u0131land\u0131rma, uzun s&uuml;reli parola kullan\u0131m\u0131ndan kaynaklanan riskleri ciddi bi&ccedil;imde azalt\u0131r ve organizasyonun genel g&uuml;venlik seviyesini y&uuml;kseltir.<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Uygulama Rehberi<\/h3>\n<p>\u2705 Mevcut password age ayarlar\u0131n\u0131 audit edin<br>\u2705 Default domain policy&rsquo;yi 45 g&uuml;n olarak ayarlay\u0131n<br>\u2705 FGPP ile kullan\u0131c\u0131 bazl\u0131 politikalar tan\u0131mlay\u0131n<br>\u2705 Automated monitoring &amp; alerting kurun<br>\u2705 SSPR &ouml;zelli\u011fini aktifle\u015ftirin<br>\u2705 User education program\u0131 ba\u015flat\u0131n<\/p>\n<hr>\n<h3>Kritik Kontrol Listesi<\/h3>\n<p>\u2705 Maximum password age &le; 45 g&uuml;n m&uuml;?<br>\u2705 Risk bazl\u0131 policy&rsquo;ler tan\u0131ml\u0131 m\u0131?<br>\u2705 Expiration alert&rsquo;leri aktif mi?<br>\u2705 SSPR yap\u0131land\u0131r\u0131ld\u0131 m\u0131?<br>\u2705 Compliance monitoring otomatik mi?<br>\u2705 Kullan\u0131c\u0131 e\u011fitimi tamamland\u0131 m\u0131?<\/p>\n<hr>\n<h3>Modern G&uuml;venlik Yakla\u015f\u0131mlar\u0131<\/h3>\n<ul>\n<li>\n<p>Risk-based adaptive password aging<\/p>\n<\/li>\n<li>\n<p>Behavioral analytics<\/p>\n<\/li>\n<li>\n<p>Zero Trust &amp; Continuous Authentication<\/p>\n<\/li>\n<li>\n<p>MFA zorunlulu\u011fu<\/p>\n<\/li>\n<li>\n<p>Passwordless alternatifler<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>&nbsp;<\/p>","excerpt":"Organizasyonlarda en yayg\u0131n g\u00fcvenlik zafiyetlerinden biri, maximum password age politikas\u0131n\u0131n uygun \u015fekilde yap\u0131land\u0131r\u0131lmamas\u0131d\u0131r. Kullan\u0131c\u0131lar\u0131n ayn\u0131 parolay\u0131 uzun s\u00fcre kullanmas\u0131, siber sald\u0131rganlar i\u00e7in de\u011ferli f\u0131rsatlar yarat\u0131r.","created_at":"2025-07-16 23:59:25","updated_at":"2026-09-07 11:46:41","category_id":12,"view_count":749,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:59:25","featured_image":"\/uploads\/images\/2025\/12\/6947c32c50019_1766310700.jpg","slug":"maximum-password-age-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":25,"title":"Administrator Account Enumeration (Misconfiguration)","content":"<p>&nbsp;<\/p>\n<h1>UAC Elevation S\u0131ras\u0131nda Bilgi S\u0131z\u0131nt\u0131s\u0131<\/h1>\n<p>Windows <strong>User Account Control (UAC)<\/strong> mekanizmas\u0131, sistem g&uuml;venli\u011finin kritik bir par&ccedil;as\u0131d\u0131r. Ancak varsay\u0131lan yap\u0131land\u0131rmada <strong>&ldquo;Enumerate administrator accounts on elevation&rdquo;<\/strong> ayar\u0131n\u0131n etkin olmas\u0131, sald\u0131rganlar\u0131n <strong>y&ouml;netici hesap bilgilerine eri\u015fmesine<\/strong> olanak tan\u0131r.<\/p>\n<p>Bu g&ouml;r&uuml;n&uuml;rde zarars\u0131z &ouml;zellik, asl\u0131nda <strong>ciddi g&uuml;venlik riskleri<\/strong> bar\u0131nd\u0131r\u0131r ve <strong>hedefli sald\u0131r\u0131lar\u0131n ba\u015flang\u0131&ccedil; noktas\u0131<\/strong> olabilir. Bu yaz\u0131da, bu kritik g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131 ve <strong>etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Administrator Account Enumeration Nedir?<\/h2>\n<p><strong>Administrator Account Enumeration<\/strong>, Windows sistemlerinde UAC elevation dialog&rsquo;u g&ouml;sterildi\u011finde, <strong>mevcut y&ouml;netici hesaplar\u0131n\u0131n listelenmesi<\/strong> &ouml;zelli\u011fidir. Kullan\u0131c\u0131 deneyimini iyile\u015ftirmek amac\u0131yla tasarlanm\u0131\u015f olsa da, <strong>bilgi s\u0131z\u0131nt\u0131s\u0131na yol a&ccedil;arak sald\u0131r\u0131 y&uuml;zeyini geni\u015fletir<\/strong>.<\/p>\n<hr>\n<h2>UAC Elevation S&uuml;reci<\/h2>\n<h3>Normal Ak\u0131\u015f<\/h3>\n<ol>\n<li>\n<p>Standart kullan\u0131c\u0131, y&ouml;netici yetkisi gerektiren bir i\u015flem ba\u015flat\u0131r<\/p>\n<\/li>\n<li>\n<p>UAC dialog&rsquo;u a&ccedil;\u0131l\u0131r<\/p>\n<\/li>\n<\/ol>\n<p><strong>Enumeration Etkinken:<\/strong><\/p>\n<ul>\n<li>\n<p>Mevcut t&uuml;m y&ouml;netici hesaplar\u0131 listelenir<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 dropdown&rsquo;dan hesap se&ccedil;er<\/p>\n<\/li>\n<li>\n<p>Sadece parola giri\u015fi yeterlidir<\/p>\n<\/li>\n<\/ul>\n<p><strong>Enumeration Devre D\u0131\u015f\u0131yken:<\/strong><\/p>\n<ul>\n<li>\n<p>Hesap listesi g&ouml;r&uuml;nmez<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 ad\u0131 <strong>ve<\/strong> parola girilmesi gerekir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Fark\u0131<\/h2>\n<h3>Enumeration Etkinken<\/h3>\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Select Administrator:       \u2502\n\u2502 \u25bc                           \u2502\n\u2502 \u25bc                           \u2502\n\u2502 \u25bc                           \u2502\n\u2502 Password:                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n<h3>Enumeration Devre D\u0131\u015f\u0131yken<\/h3>\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Username:                   \u2502\n\u2502 Password:                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n<h3>1. Information Disclosure (Bilgi S\u0131z\u0131nt\u0131s\u0131)<\/h3>\n<p><strong>A&ccedil;\u0131\u011fa &Ccedil;\u0131kan Bilgiler:<\/strong><\/p>\n<ul>\n<li>\n<p>Domain ve local administrator hesap adlar\u0131<\/p>\n<\/li>\n<li>\n<p>Organizasyonun hesap adland\u0131rma kurallar\u0131<\/p>\n<\/li>\n<li>\n<p>Y&ouml;netici yetkili servis hesaplar\u0131<\/p>\n<\/li>\n<li>\n<p>Ki\u015fisel admin hesaplar\u0131<\/p>\n<\/li>\n<\/ul>\n<p><strong>Risk De\u011ferlendirmesi:<\/strong><\/p>\n<pre><code>Risk = Bilgi De\u011feri &times; Eri\u015fim Kolayl\u0131\u011f\u0131 &times; K&ouml;t&uuml;ye Kullan\u0131m Potansiyeli\nRisk = Y&uuml;ksek &times; &Ccedil;ok Kolay &times; &Ccedil;ok Y&uuml;ksek = KR\u0130T\u0130K\n<\/code><\/pre>\n<hr>\n<h3>2. Targeted Brute Force Attacks<\/h3>\n<p><strong>Sald\u0131r\u0131 Stratejisi:<\/strong><\/p>\n<ul>\n<li>\n<p>Reconnaissance: UAC dialog&rsquo;undan hesap isimlerini toplama<\/p>\n<\/li>\n<li>\n<p>Target Selection: En de\u011ferli hesaplar\u0131 belirleme<\/p>\n<\/li>\n<li>\n<p>Credential Attacks: Hedefli parola sald\u0131r\u0131lar\u0131<\/p>\n<\/li>\n<li>\n<p>Privilege Escalation: Yetki y&uuml;kseltme<\/p>\n<\/li>\n<\/ul>\n<p><strong>&Ouml;rnek Ak\u0131\u015f:<\/strong><\/p>\n<pre><code>$targetAccounts = @(\n  \"Administrator\",\n  \"john.admin\",\n  \"backup.admin\",\n  \"sql.service\"\n)\n\nforeach ($account in $targetAccounts) {\n  Invoke-BruteForce -Username $account -PasswordList $commonPasswords\n}\n<\/code><\/pre>\n<hr>\n<h3>3. Social Engineering Amplification<\/h3>\n<p><strong>Enhanced Phishing:<\/strong><\/p>\n<ul>\n<li>\n<p>Ger&ccedil;ek admin hesap adlar\u0131yla daha inand\u0131r\u0131c\u0131 phishing<\/p>\n<\/li>\n<li>\n<p>Spear phishing sald\u0131r\u0131lar\u0131nda do\u011fru rol bilgisi<\/p>\n<\/li>\n<li>\n<p>Sahte IT destek senaryolar\u0131<\/p>\n<\/li>\n<\/ul>\n<p><strong>Business Email Compromise (BEC):<\/strong><\/p>\n<ul>\n<li>\n<p>CEO fraud sald\u0131r\u0131lar\u0131nda ger&ccedil;ek y&ouml;netici isimleri<\/p>\n<\/li>\n<li>\n<p>Wire transfer fraud senaryolar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>4. Lateral Movement Planning<\/h3>\n<p><strong>Active Directory Reconnaissance:<\/strong><\/p>\n<ul>\n<li>\n<p>Domain Admin tespiti<\/p>\n<\/li>\n<li>\n<p>Privileged account discovery<\/p>\n<\/li>\n<li>\n<p>Attack path planning<\/p>\n<\/li>\n<\/ul>\n<p><strong>PowerShell Discovery &Ouml;rne\u011fi:<\/strong><\/p>\n<pre><code>function Get-PrivilegedAccounts {\n  $adminAccounts = @()\n  foreach ($account in $enumeratedAccounts) {\n    $user = Get-ADUser -Identity $account -Properties MemberOf\n    if ($user.MemberOf -match \"Domain Admins|Enterprise Admins|Administrators\") {\n      $adminAccounts += $user\n    }\n  }\n  return $adminAccounts\n}\n<\/code><\/pre>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n<p><strong>Ad\u0131mlar:<\/strong><\/p>\n<ol>\n<li>\n<p><code>gpmc.msc<\/code><\/p>\n<\/li>\n<li>\n<p><strong>Computer Configuration &rarr; Administrative Templates &rarr; Windows Components &rarr; Credential User Interface<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Enumerate administrator accounts on elevation = Disabled<\/strong><\/p>\n<\/li>\n<\/ol>\n<p><strong>GPO Hiyerar\u015fisi:<\/strong><\/p>\n<pre><code>Domain Policy\n\u2514\u2500\u2500 Computer Configuration\n    \u2514\u2500\u2500 Administrative Templates\n        \u2514\u2500\u2500 Windows Components\n            \u2514\u2500\u2500 Credential User Interface\n                \u2514\u2500\u2500 Enumerate administrator accounts on elevation: DISABLED\n<\/code><\/pre>\n<hr>\n<h3>2. Registry ile Manuel Yap\u0131land\u0131rma<\/h3>\n<p><strong>Registry Path:<\/strong><\/p>\n<pre><code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\n<\/code><\/pre>\n<p><strong>De\u011ferler:<\/strong><\/p>\n<ul>\n<li>\n<p><code>EnumerateAdministrators<\/code> (REG_DWORD)<\/p>\n<\/li>\n<li>\n<p><code>0<\/code> = Disabled<\/p>\n<\/li>\n<\/ul>\n<p><strong>PowerShell:<\/strong><\/p>\n<pre><code>$registryPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\"\n\nif (!(Test-Path $registryPath)) {\n  New-Item -Path $registryPath -Force | Out-Null\n}\n\nSet-ItemProperty -Path $registryPath -Name \"EnumerateAdministrators\" -Value 0 -Type DWord\n<\/code><\/pre>\n<p><strong>Batch Script:<\/strong><\/p>\n<pre><code>reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\" ^\n \/v EnumerateAdministrators \/t REG_DWORD \/d 0 \/f\n<\/code><\/pre>\n<hr>\n<h3>3. PowerShell DSC (Desired State Configuration)<\/h3>\n<pre><code>Configuration DisableAdminEnumeration {\n  Node 'localhost' {\n    Registry DisableAdminEnum {\n      Key = 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI'\n      ValueName = 'EnumerateAdministrators'\n      ValueData = '0'\n      ValueType = 'Dword'\n      Ensure = 'Present'\n    }\n  }\n}\n<\/code><\/pre>\n<hr>\n<h2>Geli\u015fmi\u015f G&uuml;venlik Stratejileri<\/h2>\n<h3>1. Comprehensive UAC Hardening<\/h3>\n<pre><code>ConsentPromptBehaviorAdmin = 2\nConsentPromptBehaviorUser  = 3\nPromptOnSecureDesktop      = 1\nEnableInstallerDetection  = 1\n<\/code><\/pre>\n<p><strong>UAC Seviye Kar\u015f\u0131la\u015ft\u0131rmas\u0131:<\/strong><\/p>\n<table>\n<thead>\n<tr>\n<th>Seviye<\/th>\n<th>A&ccedil;\u0131klama<\/th>\n<th>G&uuml;venlik<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>0<\/td>\n<td>Never notify<\/td>\n<td>\u274c<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Prompt for credentials<\/td>\n<td>\u26a0\ufe0f<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Prompt for consent<\/td>\n<td>\u2705<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Prompt for credentials (secure desktop)<\/td>\n<td>\u2705\u2705<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h3>2. Credential Guard Entegrasyonu<\/h3>\n<ul>\n<li>\n<p>Credential Guard durumu kontrol&uuml;<\/p>\n<\/li>\n<li>\n<p>UEFI + TPM gereksinimleri<\/p>\n<\/li>\n<li>\n<p>LSASS izolasyonu<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. Privileged Access Management (PAM)<\/h3>\n<p><strong>Just-In-Time Administration:<\/strong><\/p>\n<ul>\n<li>\n<p>Ge&ccedil;ici admin hesaplar\u0131<\/p>\n<\/li>\n<li>\n<p>Otomatik s&uuml;re sonu<\/p>\n<\/li>\n<li>\n<p>Audit logging<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Monitoring ve Detection<\/h2>\n<h3>Event Log Analysis<\/h3>\n<p><strong>\u0130lgili Event ID&rsquo;ler:<\/strong><\/p>\n<ul>\n<li>\n<p>4648 &ndash; Explicit credential use<\/p>\n<\/li>\n<li>\n<p>4672 &ndash; Special privileges assigned<\/p>\n<\/li>\n<li>\n<p>4624 &ndash; Admin logon<\/p>\n<\/li>\n<li>\n<p>5376 &ndash; Credential Manager<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Advanced Threat Detection<\/h3>\n<ul>\n<li>\n<p>Anormal elevation frekanslar\u0131<\/p>\n<\/li>\n<li>\n<p>Baseline kar\u015f\u0131la\u015ft\u0131rmas\u0131<\/p>\n<\/li>\n<li>\n<p>Otomatik uyar\u0131lar<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>SIEM Integration<\/h3>\n<p><strong>Splunk \/ ELK<\/strong> kurallar\u0131 ile:<\/p>\n<ul>\n<li>\n<p>Admin elevation say\u0131m\u0131<\/p>\n<\/li>\n<li>\n<p>Zaman bazl\u0131 e\u015fikler<\/p>\n<\/li>\n<li>\n<p>Davran\u0131\u015fsal analiz<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Compliance ve Audit<\/h2>\n<h3>Framework Mapping<\/h3>\n<ul>\n<li>\n<p><strong>CIS Control 4 &amp; 6<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>NIST PR.AC-4 \/ PR.AC-6 \/ DE.CM-1<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Automated Compliance Checking<\/h3>\n<ul>\n<li>\n<p>Registry do\u011frulama<\/p>\n<\/li>\n<li>\n<p>GPO kontrol&uuml;<\/p>\n<\/li>\n<li>\n<p>G&uuml;nl&uuml;k\/haftal\u0131k raporlar<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>User Experience Considerations<\/h2>\n<h3>Training ve Awareness<\/h3>\n<p><strong>IT Staff:<\/strong><\/p>\n<ul>\n<li>\n<p>Yeni UAC davran\u0131\u015f\u0131<\/p>\n<\/li>\n<li>\n<p>G&uuml;venli credential y&ouml;netimi<\/p>\n<\/li>\n<\/ul>\n<p><strong>End User:<\/strong><\/p>\n<ol>\n<li>\n<p>Hesap listesi g&ouml;r&uuml;nmez<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 ad\u0131 + parola girilir<\/p>\n<\/li>\n<li>\n<p>Bilgi yoksa IT ile ileti\u015fime ge&ccedil;ilir<\/p>\n<\/li>\n<li>\n<p>Ba\u015fkas\u0131n\u0131n admin bilgisi kullan\u0131lmaz<\/p>\n<\/li>\n<\/ol>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>Administrator account enumeration<\/strong> &ouml;zelli\u011finin devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, sistem g&uuml;venli\u011fini <strong>do\u011frudan ve anlaml\u0131 bi&ccedil;imde art\u0131ran kritik bir ad\u0131md\u0131r<\/strong>. Bu de\u011fi\u015fiklik, sald\u0131rganlar\u0131n reconnaissance a\u015famas\u0131nda elde edebilece\u011fi <strong>y&uuml;ksek de\u011ferli bilgileri gizler<\/strong> ve hedefli sald\u0131r\u0131lar\u0131 ciddi &ouml;l&ccedil;&uuml;de zorla\u015ft\u0131r\u0131r.<\/p>\n<hr>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Enumeration durumunu kontrol edin<br>\u2705 GPO ile devre d\u0131\u015f\u0131 b\u0131rak\u0131n<br>\u2705 Registry ayarlar\u0131n\u0131 do\u011frulay\u0131n<br>\u2705 Monitoring &amp; alerting kurun<br>\u2705 IT staff&rsquo;\u0131 e\u011fitin<br>\u2705 Compliance kontrollerini otomatikle\u015ftirin<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 Enumeration disabled m\u0131?<br>\u2705 Registry de\u011feri <code>0<\/code> m\u0131?<br>\u2705 GPO t&uuml;m bilgisayarlara uyguland\u0131 m\u0131?<br>\u2705 UAC hardening tamam m\u0131?<br>\u2705 Event log monitoring aktif mi?<br>\u2705 Help desk s&uuml;re&ccedil;leri g&uuml;ncel mi?<\/p>\n<hr>\n<h3>Ek G&uuml;venlik &Ouml;nerileri<\/h3>\n<ul>\n<li>\n<p>Privileged Access Management (PAM)<\/p>\n<\/li>\n<li>\n<p>Just-In-Time Administration<\/p>\n<\/li>\n<li>\n<p>Multi-Factor Authentication (MFA)<\/p>\n<\/li>\n<li>\n<p>D&uuml;zenli security assessment<\/p>\n<\/li>\n<li>\n<p>Behavioral analytics<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"UAC Elevation S\u0131ras\u0131nda Bilgi S\u0131z\u0131nt\u0131s\u0131 Windows User Account Control (UAC) mekanizmas\u0131, sistem g\u00fcvenli\u011finin kritik bir par\u00e7as\u0131d\u0131r. Ancak...","created_at":"2025-07-16 23:56:28","updated_at":"2026-09-08 00:52:40","category_id":12,"view_count":679,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:56:28","featured_image":"\/uploads\/images\/2025\/12\/6947c3c87b69f_1766310856.png","slug":"administrator-account-enumeration-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":26,"title":"Account Lockout Duration G\u00fcvenli\u011fi (Misconfiguration)","content":"<p>&nbsp;<\/p>\n<h1>Account Lockout Duration G&uuml;venlik A&ccedil;\u0131\u011f\u0131<\/h1>\n<h2>Brute Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma<\/h2>\n<p>Siber sald\u0131rganlar\u0131n en s\u0131k kulland\u0131\u011f\u0131 y&ouml;ntemlerden biri olan <strong>brute force<\/strong> ve <strong>password spraying<\/strong> sald\u0131r\u0131lar\u0131, zay\u0131f hesap kilitleme politikalar\u0131n\u0131n bulundu\u011fu sistemlerde b&uuml;y&uuml;k ba\u015far\u0131 elde edebilir.<\/p>\n<p><strong>Account Lockout Duration<\/strong> ayar\u0131n\u0131n yetersiz olmas\u0131, sald\u0131rganlar\u0131n s&uuml;rekli parola deneme giri\u015fimlerinde bulunmas\u0131na olanak tan\u0131r. Bu yaz\u0131da, bu <strong>kritik g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131<\/strong> ve <strong>etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>Account Lockout Policy Nedir?<\/h2>\n<p><strong>Account Lockout Policy<\/strong>, Windows Active Directory ortamlar\u0131nda kullan\u0131c\u0131 hesaplar\u0131n\u0131n ba\u015far\u0131s\u0131z giri\u015f denemelerinden sonra <strong>ne kadar s&uuml;re kilitli kalaca\u011f\u0131n\u0131<\/strong> belirleyen kritik bir g&uuml;venlik mekanizmas\u0131d\u0131r.<\/p>\n<p>Bu politika <strong>&uuml;&ccedil; temel bile\u015fenden<\/strong> olu\u015fur:<\/p>\n<hr>\n<h3>1. Account Lockout Threshold<\/h3>\n<ul>\n<li>\n<p><strong>Tan\u0131m:<\/strong> Hesab\u0131n kilitlenmesine neden olan ba\u015far\u0131s\u0131z giri\u015f denemesi say\u0131s\u0131<\/p>\n<\/li>\n<li>\n<p><strong>&Ouml;nerilen De\u011fer:<\/strong> <strong>3&ndash;5 deneme<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etki:<\/strong> &Ccedil;ok d&uuml;\u015f&uuml;k de\u011ferler <strong>DoS riskini<\/strong> art\u0131r\u0131r<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Account Lockout Duration<\/h3>\n<ul>\n<li>\n<p><strong>Tan\u0131m:<\/strong> Kilitli hesab\u0131n otomatik olarak a&ccedil;\u0131lmas\u0131na kadar ge&ccedil;en s&uuml;re<\/p>\n<\/li>\n<li>\n<p><strong>Minimum G&uuml;venli De\u011fer:<\/strong> <strong>15 dakika veya daha fazla<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etki:<\/strong> Brute force sald\u0131r\u0131lar\u0131n\u0131 ciddi \u015fekilde yava\u015flat\u0131r<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. Reset Account Lockout Counter After<\/h3>\n<ul>\n<li>\n<p><strong>Tan\u0131m:<\/strong> Ba\u015far\u0131s\u0131z deneme sayac\u0131n\u0131n s\u0131f\u0131rlanmas\u0131na kadar ge&ccedil;en s&uuml;re<\/p>\n<\/li>\n<li>\n<p><strong>&Ouml;nerilen De\u011fer:<\/strong> <strong>15 dakika<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Kural:<\/strong><\/p>\n<pre><code>Lockout Duration &ge; Reset Counter Duration\n<\/code><\/pre>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n<h3>1. Brute Force Sald\u0131r\u0131lar\u0131<\/h3>\n<h4>Geleneksel Brute Force<\/h4>\n<ul>\n<li>\n<p>Tek bir hesap &uuml;zerinde s&uuml;rekli parola denemeleri<\/p>\n<\/li>\n<li>\n<p>K\u0131sa lockout s&uuml;releri sald\u0131r\u0131y\u0131 etkisiz hale getiremez<\/p>\n<\/li>\n<li>\n<p>Otomatik ara&ccedil;larla <strong>7\/24 sald\u0131r\u0131<\/strong><\/p>\n<\/li>\n<\/ul>\n<h4>Distributed Brute Force<\/h4>\n<ul>\n<li>\n<p>Farkl\u0131 IP adreslerinden e\u015fzamanl\u0131 sald\u0131r\u0131<\/p>\n<\/li>\n<li>\n<p>Botnet kullan\u0131m\u0131<\/p>\n<\/li>\n<li>\n<p>Lockout mekanizmas\u0131n\u0131n dolayl\u0131 bypass edilmesi<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Password Spraying Sald\u0131r\u0131lar\u0131<\/h3>\n<h4>Sald\u0131r\u0131 Mant\u0131\u011f\u0131<\/h4>\n<ul>\n<li>\n<p>&Ccedil;ok say\u0131da kullan\u0131c\u0131 hesab\u0131na kar\u015f\u0131 <strong>az say\u0131da yayg\u0131n parola<\/strong><\/p>\n<\/li>\n<li>\n<p>Hesap kilitleme e\u015fi\u011fi a\u015f\u0131lmaz<\/p>\n<\/li>\n<li>\n<p>Kurumsal parola al\u0131\u015fkanl\u0131klar\u0131 istismar edilir<\/p>\n<\/li>\n<\/ul>\n<h4>Yayg\u0131n Parola Listeleri<\/h4>\n<ul>\n<li>\n<p><code>Password123!<\/code><\/p>\n<\/li>\n<li>\n<p><code>\u015eirket_Ad\u01312024!<\/code><\/p>\n<\/li>\n<li>\n<p>Mevsim + y\u0131l kombinasyonlar\u0131<\/p>\n<\/li>\n<li>\n<p>Varsay\u0131lan sistem parolalar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. Account Lockout DoS Sald\u0131r\u0131lar\u0131<\/h3>\n<h4>K&ouml;t&uuml; Niyetli Kilitleme<\/h4>\n<ul>\n<li>\n<p>Me\u015fru kullan\u0131c\u0131lar\u0131 sistemden uzak tutma<\/p>\n<\/li>\n<li>\n<p>\u0130\u015f s&uuml;reklili\u011fini bozma<\/p>\n<\/li>\n<li>\n<p>Help desk y&uuml;k&uuml;n&uuml; art\u0131rma<\/p>\n<\/li>\n<\/ul>\n<h4>Timing Sald\u0131r\u0131lar\u0131<\/h4>\n<ul>\n<li>\n<p>Kritik i\u015f saatlerinde sald\u0131r\u0131<\/p>\n<\/li>\n<li>\n<p>Y&ouml;netici hesaplar\u0131n\u0131 hedefleme<\/p>\n<\/li>\n<li>\n<p>IT ekiplerini me\u015fgul etme<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n<p><strong>Ad\u0131m 1:<\/strong><\/p>\n<pre><code>gpmc.msc\n<\/code><\/pre>\n<p><strong>Ad\u0131m 2:<\/strong><\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Account Policies\n&rarr; Account Lockout Policy\n<\/code><\/pre>\n<h4>&Ouml;nerilen G&uuml;venlik Yap\u0131land\u0131rmas\u0131<\/h4>\n<ul>\n<li>\n<p><strong>Account lockout threshold:<\/strong> 5 invalid logon attempts<\/p>\n<\/li>\n<li>\n<p><strong>Account lockout duration:<\/strong> 15 dakika (veya daha fazla)<\/p>\n<\/li>\n<li>\n<p><strong>Reset account lockout counter after:<\/strong> 15 dakika<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. PowerShell ile Toplu Yap\u0131land\u0131rma<\/h3>\n<h4>Mevcut Ayarlar\u0131 G&ouml;r&uuml;nt&uuml;leme<\/h4>\n<pre><code>Get-ADDefaultDomainPasswordPolicy\nGet-ADPasswordPolicy -Filter *\n<\/code><\/pre>\n<h4>Yeni Ayarlar\u0131 Uygulama<\/h4>\n<pre><code>Set-ADDefaultDomainPasswordPolicy `\n -Identity \"yourdomain.com\" `\n -LockoutDuration \"00:15:00\" `\n -LockoutObservationWindow \"00:15:00\" `\n -LockoutThreshold 5\n<\/code><\/pre>\n<hr>\n<h3>3. Fine-Grained Password Policy (FGPP)<\/h3>\n<h4>Y&ouml;netici Hesaplar\u0131 i&ccedil;in<\/h4>\n<pre><code>New-ADPasswordPolicy -Name \"AdminLockoutPolicy\" `\n -Precedence 10 `\n -LockoutDuration \"00:30:00\" `\n -LockoutObservationWindow \"00:30:00\" `\n -LockoutThreshold 3\n\nAdd-ADPasswordPolicySubject `\n -Identity \"AdminLockoutPolicy\" `\n -Subjects \"Domain Admins\"\n<\/code><\/pre>\n<hr>\n<h3>&Ouml;rnek Lockout Policy Tablosu<\/h3>\n<table>\n<thead>\n<tr>\n<th>Kullan\u0131c\u0131 T&uuml;r&uuml;<\/th>\n<th>Threshold<\/th>\n<th>Duration<\/th>\n<th>Reset Counter<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Normal Kullan\u0131c\u0131<\/td>\n<td>5<\/td>\n<td>15 dk<\/td>\n<td>15 dk<\/td>\n<\/tr>\n<tr>\n<td>Y&ouml;netici<\/td>\n<td>3<\/td>\n<td>30 dk<\/td>\n<td>30 dk<\/td>\n<\/tr>\n<tr>\n<td>Servis Hesab\u0131<\/td>\n<td>10<\/td>\n<td>60 dk<\/td>\n<td>60 dk<\/td>\n<\/tr>\n<tr>\n<td>Privileged User<\/td>\n<td>3<\/td>\n<td>60 dk<\/td>\n<td>60 dk<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Geli\u015fmi\u015f G&uuml;venlik Stratejileri<\/h2>\n<h3>1. Conditional Access Policies<\/h3>\n<ul>\n<li>\n<p>Azure AD entegrasyonu<\/p>\n<\/li>\n<li>\n<p>Risk bazl\u0131 eri\u015fim k\u0131s\u0131tlamalar\u0131<\/p>\n<\/li>\n<li>\n<p>\u015e&uuml;pheli oturumlar\u0131 otomatik engelleme<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Smart Lockout Mekanizmalar\u0131<\/h3>\n<h4>Adaptive Lockout<\/h4>\n<table>\n<thead>\n<tr>\n<th>Deneme Say\u0131s\u0131<\/th>\n<th>Lockout S&uuml;resi<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1&ndash;3<\/td>\n<td>15 dakika<\/td>\n<\/tr>\n<tr>\n<td>4&ndash;6<\/td>\n<td>30 dakika<\/td>\n<\/tr>\n<tr>\n<td>7&ndash;9<\/td>\n<td>60 dakika<\/td>\n<\/tr>\n<tr>\n<td>10+<\/td>\n<td>24 saat<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<ul>\n<li>\n<p>Co\u011frafi konum analizi<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 davran\u0131\u015f profilleme<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. Multi-Factor Authentication (MFA)<\/h3>\n<ul>\n<li>\n<p>\u0130lk ba\u015far\u0131s\u0131z denemeden sonra MFA<\/p>\n<\/li>\n<li>\n<p>\u015e&uuml;pheli IP&rsquo;ler i&ccedil;in ek do\u011frulama<\/p>\n<\/li>\n<li>\n<p>Co\u011frafi anomali tespiti<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Monitoring ve Alerting<\/h2>\n<h3>1. Event Log \u0130zleme<\/h3>\n<p><strong>Kritik Event ID&rsquo;ler:<\/strong><\/p>\n<ul>\n<li>\n<p><strong>4740:<\/strong> Account locked out<\/p>\n<\/li>\n<li>\n<p><strong>4625:<\/strong> Failed logon attempt<\/p>\n<\/li>\n<li>\n<p><strong>4648:<\/strong> Explicit credentials<\/p>\n<\/li>\n<li>\n<p><strong>4771:<\/strong> Kerberos pre-authentication failed<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Automated Response<\/h3>\n<ul>\n<li>\n<p>Brute force tespiti<\/p>\n<\/li>\n<li>\n<p>IP bazl\u0131 firewall bloklama<\/p>\n<\/li>\n<li>\n<p>Otomatik e-posta uyar\u0131lar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. SIEM Entegrasyonu<\/h3>\n<ul>\n<li>\n<p><strong>Splunk:<\/strong> Failed logon ve lockout korelasyonu<\/p>\n<\/li>\n<li>\n<p><strong>ELK:<\/strong> IP bazl\u0131 sald\u0131r\u0131 tespiti<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Performans ve Kullan\u0131labilirlik<\/h2>\n<h3>Help Desk Y&uuml;k&uuml;<\/h3>\n<ul>\n<li>\n<p>G&uuml;nl&uuml;k kilitlenen hesap say\u0131s\u0131<\/p>\n<\/li>\n<li>\n<p>Ortalama &ccedil;&ouml;z&uuml;m s&uuml;resi<\/p>\n<\/li>\n<li>\n<p>Tekrar eden kilitleme oran\u0131<\/p>\n<\/li>\n<\/ul>\n<p><strong>Optimizasyon:<\/strong><\/p>\n<ul>\n<li>\n<p>Self-service password reset<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 fark\u0131ndal\u0131k e\u011fitimi<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Do\u011frulama ve Test<\/h2>\n<h3>Penetration Testing<\/h3>\n<ul>\n<li>\n<p>Hydra<\/p>\n<\/li>\n<li>\n<p>Medusa<\/p>\n<\/li>\n<li>\n<p>Ncrack<\/p>\n<\/li>\n<\/ul>\n<h3>Policy Compliance Kontrol&uuml;<\/h3>\n<ul>\n<li>\n<p>Lockout duration &ge; 15 dakika<\/p>\n<\/li>\n<li>\n<p>Reset counter uyumlu mu?<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>Account Lockout Duration<\/strong> ayar\u0131n\u0131n <strong>en az 15 dakika<\/strong> olarak yap\u0131land\u0131r\u0131lmas\u0131, brute force ve password spraying sald\u0131r\u0131lar\u0131na kar\u015f\u0131 <strong>etkili bir savunma mekanizmas\u0131d\u0131r<\/strong>.<\/p>\n<p>Bu yap\u0131land\u0131rma, sald\u0131rganlar\u0131n s&uuml;rekli parola deneme giri\u015fimlerini <strong>&ouml;nemli &ouml;l&ccedil;&uuml;de yava\u015flat\u0131r<\/strong> ve organizasyonun genel g&uuml;venlik seviyesini art\u0131r\u0131r.<\/p>\n<hr>\n<h3>Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Mevcut lockout policy&rsquo;i analiz edin<br>\u2705 Minimum 15 dakika duration ayarlay\u0131n<br>\u2705 Reset counter ile uyumlu hale getirin<br>\u2705 FGPP kullanarak &ouml;zel gruplar tan\u0131mlay\u0131n<br>\u2705 Monitoring ve alerting kurun<br>\u2705 Help desk s&uuml;re&ccedil;lerini optimize edin<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 Account lockout duration &ge; 15 dk m\u0131?<br>\u2705 Duration &ge; Reset counter m\u0131?<br>\u2705 Kullan\u0131c\u0131 t&uuml;rlerine &ouml;zel policy var m\u0131?<br>\u2705 Brute force monitoring aktif mi?<br>\u2705 MFA entegrasyonu tamam m\u0131?<br>\u2705 Incident response plan\u0131 haz\u0131r m\u0131?<\/p>\n<hr>\n<h3>Geli\u015fmi\u015f G&uuml;venlik &Ouml;nerileri<\/h3>\n<ul>\n<li>\n<p>Adaptive lockout mekanizmalar\u0131<\/p>\n<\/li>\n<li>\n<p>Conditional access policy&rsquo;leri<\/p>\n<\/li>\n<li>\n<p>SIEM entegrasyonu<\/p>\n<\/li>\n<li>\n<p>D&uuml;zenli penetration testing<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 fark\u0131ndal\u0131k e\u011fitimleri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>Bu yap\u0131land\u0131rmalar\u0131 uygulayarak, organizasyonunuzu <strong>brute force<\/strong>, <strong>password spraying<\/strong> ve di\u011fer parola tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 etkili \u015fekilde koruyabilir ve <strong>modern g&uuml;venlik standartlar\u0131na uygun<\/strong> bir kimlik do\u011frulama altyap\u0131s\u0131 olu\u015fturabilirsiniz.<\/p>","excerpt":"Account Lockout Duration G\u00fcvenlik A\u00e7\u0131\u011f\u0131 Brute Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma Siber sald\u0131rganlar\u0131n en s\u0131k kulland\u0131\u011f\u0131 y\u00f6ntemlerden...","created_at":"2025-07-16 23:52:48","updated_at":"2026-09-23 12:28:10","category_id":12,"view_count":611,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:52:48","featured_image":"\/uploads\/images\/2025\/12\/6947c51f3e40e_1766311199.jpg","slug":"account-lockout-duration-guvenligi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":27,"title":"LAN Manager Authentication (Misconfiguration)","content":"<p>&nbsp;<\/p>\n<h1>Kimlik Do\u011frulama Protokol&uuml; G&uuml;venli\u011fi<\/h1>\n<h2>LAN Manager Authentication Level G&uuml;venlik A&ccedil;\u0131\u011f\u0131<\/h2>\n<p>Windows a\u011f ortamlar\u0131nda <strong>kimlik do\u011frulama g&uuml;venli\u011fi<\/strong>, sistem b&uuml;t&uuml;nl&uuml;\u011f&uuml;n&uuml;n en kritik unsurlar\u0131ndan biridir. <strong>LAN Manager Authentication Level<\/strong> ayar\u0131n\u0131n g&uuml;venli seviyeye ayarlanmamas\u0131, sald\u0131rganlar\u0131n <strong>eski ve zay\u0131f kimlik do\u011frulama protokollerini<\/strong> kullanarak sisteme s\u0131zmas\u0131na olanak tan\u0131r.<\/p>\n<p>Bu yaz\u0131da, bu <strong>kritik g&uuml;venlik a&ccedil;\u0131\u011f\u0131n\u0131<\/strong> ve <strong>etkili &ccedil;&ouml;z&uuml;m y&ouml;ntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>LAN Manager Authentication Level Nedir?<\/h2>\n<p><strong>LAN Manager Authentication Level<\/strong>, Windows sistemlerinin <strong>hangi kimlik do\u011frulama protokollerini kabul edece\u011fini<\/strong> belirleyen kritik bir g&uuml;venlik ayar\u0131d\u0131r. Bu ayar, a\u011f kaynaklar\u0131na eri\u015fim s\u0131ras\u0131nda kullan\u0131lacak <strong>kimlik do\u011frulama y&ouml;ntemini<\/strong> kontrol eder.<\/p>\n<hr>\n<h2>Kimlik Do\u011frulama Protokolleri<\/h2>\n<p>Windows ortamlar\u0131nda <strong>&uuml;&ccedil; temel kimlik do\u011frulama protokol&uuml;<\/strong> bulunur:<\/p>\n<hr>\n<h3>1. LM (LAN Manager) &ndash; En Zay\u0131f<\/h3>\n<ul>\n<li>\n<p><strong>Geli\u015ftirme Tarihi:<\/strong> 1980&rsquo;ler<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifre Uzunlu\u011fu:<\/strong> Maksimum 14 karakter<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifreleme:<\/strong> DES tabanl\u0131, &ccedil;ok zay\u0131f<\/p>\n<\/li>\n<li>\n<p><strong>G&uuml;venlik Riski:<\/strong> \u274c &Ccedil;ok y&uuml;ksek<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. NTLM (NT LAN Manager) &ndash; Orta Seviye<\/h3>\n<ul>\n<li>\n<p><strong>Geli\u015ftirme Tarihi:<\/strong> 1990&rsquo;lar<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifre Uzunlu\u011fu:<\/strong> S\u0131n\u0131rs\u0131z<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifreleme:<\/strong> MD4 tabanl\u0131<\/p>\n<\/li>\n<li>\n<p><strong>G&uuml;venlik Riski:<\/strong> \u26a0\ufe0f Orta&ndash;Y&uuml;ksek<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. NTLMv2 (NT LAN Manager v2) &ndash; En G&uuml;venli<\/h3>\n<ul>\n<li>\n<p><strong>Geli\u015ftirme Tarihi:<\/strong> 1998<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifre Uzunlu\u011fu:<\/strong> S\u0131n\u0131rs\u0131z<\/p>\n<\/li>\n<li>\n<p><strong>\u015eifreleme:<\/strong> HMAC-MD5 tabanl\u0131<\/p>\n<\/li>\n<li>\n<p><strong>G&uuml;venlik Riski:<\/strong> \u2705 D&uuml;\u015f&uuml;k (mevcut protokoller aras\u0131nda)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Y&ouml;ntemleri<\/h2>\n<h3>1. LM Protokol&uuml; Zafiyetleri<\/h3>\n<h4>Pass-the-Hash Sald\u0131r\u0131lar\u0131<\/h4>\n<ul>\n<li>\n<p>LM hash de\u011ferleri kolayca ele ge&ccedil;irilebilir<\/p>\n<\/li>\n<li>\n<p>Ger&ccedil;ek parolaya ihtiya&ccedil; duyulmaz<\/p>\n<\/li>\n<li>\n<p>Lateral movement i&ccedil;in kullan\u0131labilir<\/p>\n<\/li>\n<\/ul>\n<h4>Brute Force Sald\u0131r\u0131lar\u0131<\/h4>\n<ul>\n<li>\n<p>14 karakter s\u0131n\u0131r\u0131 nedeniyle d&uuml;\u015f&uuml;k karma\u015f\u0131kl\u0131k<\/p>\n<\/li>\n<li>\n<p>DES \u015fifreleme modern sistemlerde h\u0131zl\u0131 k\u0131r\u0131l\u0131r<\/p>\n<\/li>\n<li>\n<p>Rainbow table sald\u0131r\u0131lar\u0131 olduk&ccedil;a etkilidir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. NTLM Protokol&uuml; Zafiyetleri<\/h3>\n<h4>Replay Sald\u0131r\u0131lar\u0131<\/h4>\n<ul>\n<li>\n<p>Kimlik do\u011frulama paketleri yakalan\u0131p tekrar kullan\u0131labilir<\/p>\n<\/li>\n<li>\n<p>Zaman damgas\u0131 korumas\u0131 zay\u0131ft\u0131r<\/p>\n<\/li>\n<li>\n<p>Challenge-response mekanizmas\u0131 bypass edilebilir<\/p>\n<\/li>\n<\/ul>\n<h4>Relay Sald\u0131r\u0131lar\u0131<\/h4>\n<ul>\n<li>\n<p>NTLM trafi\u011fi ba\u015fka sistemlere y&ouml;nlendirilebilir<\/p>\n<\/li>\n<li>\n<p>SMB relay sald\u0131r\u0131lar\u0131 ger&ccedil;ekle\u015ftirilebilir<\/p>\n<\/li>\n<li>\n<p>Sald\u0131rgan kendisini hedef sistem gibi g&ouml;sterebilir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. NTLMv2 Avantajlar\u0131<\/h3>\n<h4>G&uuml;&ccedil;l&uuml; \u015eifreleme<\/h4>\n<ul>\n<li>\n<p>HMAC-MD5 tabanl\u0131 geli\u015fmi\u015f \u015fifreleme<\/p>\n<\/li>\n<li>\n<p>Mutual authentication deste\u011fi<\/p>\n<\/li>\n<li>\n<p>Replay sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma<\/p>\n<\/li>\n<\/ul>\n<h4>Geli\u015fmi\u015f Challenge-Response<\/h4>\n<ul>\n<li>\n<p>G&uuml;&ccedil;l&uuml; nonce de\u011ferleri<\/p>\n<\/li>\n<li>\n<p>Zaman damgas\u0131 do\u011frulamas\u0131<\/p>\n<\/li>\n<li>\n<p>Replay ve relay sald\u0131r\u0131lar\u0131na kar\u015f\u0131 diren&ccedil;<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n<p><strong>Ad\u0131m 1:<\/strong> Group Policy Management Console<\/p>\n<pre><code>gpmc.msc\n<\/code><\/pre>\n<p><strong>Ad\u0131m 2:<\/strong> Politika D&uuml;zenleme<\/p>\n<pre><code>Computer Configuration\n&rarr; Windows Settings\n&rarr; Security Settings\n&rarr; Local Policies\n&rarr; Security Options\n<\/code><\/pre>\n<p><strong>Ad\u0131m 3:<\/strong><br><strong>&ldquo;Network security: LAN Manager authentication level&rdquo;<\/strong> politikas\u0131n\u0131 bulun.<\/p>\n<p><strong>G&uuml;venli Ayar:<\/strong><\/p>\n<pre><code>Send NTLMv2 response only. Refuse LM &amp; NTLM\n<\/code><\/pre>\n<hr>\n<h3>2. Registry &Uuml;zerinden Yap\u0131land\u0131rma<\/h3>\n<p><strong>Registry Anahtar\u0131:<\/strong><\/p>\n<pre><code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n<\/code><\/pre>\n<p><strong>De\u011ferler:<\/strong><\/p>\n<ul>\n<li>\n<p><strong>De\u011fer Ad\u0131:<\/strong> LmCompatibilityLevel<\/p>\n<\/li>\n<li>\n<p><strong>T&uuml;r:<\/strong> REG_DWORD<\/p>\n<\/li>\n<li>\n<p><strong>&Ouml;nerilen De\u011fer:<\/strong> 5<\/p>\n<\/li>\n<\/ul>\n<p><strong>PowerShell ile Uygulama:<\/strong><\/p>\n<pre><code>Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n -Name \"LmCompatibilityLevel\" -Value 5\n<\/code><\/pre>\n<hr>\n<h3>3. G&uuml;venlik Seviyeleri Tablosu<\/h3>\n<table>\n<thead>\n<tr>\n<th>Seviye<\/th>\n<th>A&ccedil;\u0131klama<\/th>\n<th>G&uuml;venlik<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>0<\/td>\n<td>LM ve NTLM g&ouml;nder<\/td>\n<td>\u274c &Ccedil;ok g&uuml;vensiz<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>LM &amp; NTLM g&ouml;nder, NTLMv2 kullan<\/td>\n<td>\u274c G&uuml;vensiz<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Sadece NTLM g&ouml;nder<\/td>\n<td>\u26a0\ufe0f Orta risk<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Sadece NTLMv2 g&ouml;nder<\/td>\n<td>\u26a0\ufe0f Orta risk<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>NTLMv2 g&ouml;nder, LM reddet<\/td>\n<td>\u2705 G&uuml;venli<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>NTLMv2 g&ouml;nder, LM &amp; NTLM reddet<\/td>\n<td>\u2705 <strong>En g&uuml;venli<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Domain Controller Ayarlar\u0131<\/h2>\n<h3>DC i&ccedil;in Minimum G&uuml;venli Seviye<\/h3>\n<pre><code>Network security: LAN Manager authentication level = 4\n<\/code><\/pre>\n<h3>Ek G&uuml;venlik Ayarlar\u0131<\/h3>\n<ul>\n<li>\n<p><strong>Do not store LAN Manager hash value on next password change<\/strong> &rarr; Enabled<\/p>\n<\/li>\n<li>\n<p><strong>Network security: Do not store LAN Manager hash value on next password change<\/strong> &rarr; Enabled<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Active Directory Functional Level<\/h2>\n<p>NTLMv2 zorunlulu\u011fu i&ccedil;in:<\/p>\n<ul>\n<li>\n<p><strong>Domain Functional Level:<\/strong> En az Windows 2000 Native<\/p>\n<\/li>\n<li>\n<p><strong>Forest Functional Level:<\/strong> En az Windows 2000<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Deployment Sonras\u0131 Dikkat Edilmesi Gerekenler<\/h2>\n<h3>1. Legacy Sistem Uyumlulu\u011fu<\/h3>\n<p><strong>Etkilenebilecek Sistemler:<\/strong><\/p>\n<ul>\n<li>\n<p>Windows 95 \/ 98 \/ ME<\/p>\n<\/li>\n<li>\n<p>Windows NT 4.0 (SP4 &ouml;ncesi)<\/p>\n<\/li>\n<li>\n<p>Samba 3.0 &ouml;ncesi Linux sistemler<\/p>\n<\/li>\n<li>\n<p>Yaz\u0131c\u0131lar, NAS cihazlar\u0131, g&ouml;m&uuml;l&uuml; sistemler<\/p>\n<\/li>\n<\/ul>\n<p><strong>&Ccedil;&ouml;z&uuml;m Stratejileri:<\/strong><\/p>\n<ul>\n<li>\n<p>Sistem envanteri &ccedil;\u0131kar\u0131n<\/p>\n<\/li>\n<li>\n<p>Test ortam\u0131nda uygulay\u0131n<\/p>\n<\/li>\n<li>\n<p>Kimlik do\u011frulama hatalar\u0131n\u0131 izleyin<\/p>\n<\/li>\n<li>\n<p>Legacy sistemler i&ccedil;in upgrade plan\u0131 yap\u0131n<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Uygulama Uyumlulu\u011fu<\/h3>\n<p>Kontrol edilmesi gerekenler:<\/p>\n<ul>\n<li>\n<p>Third-party uygulamalar<\/p>\n<\/li>\n<li>\n<p>Veritaban\u0131 ba\u011flant\u0131lar\u0131<\/p>\n<\/li>\n<li>\n<p>Web uygulamalar\u0131<\/p>\n<\/li>\n<li>\n<p>Yedekleme yaz\u0131l\u0131mlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. Monitoring ve Logging<\/h3>\n<p><strong>\u0130lgili Event ID&rsquo;ler:<\/strong><\/p>\n<ul>\n<li>\n<p><strong>4776:<\/strong> Credential validation attempted<\/p>\n<\/li>\n<li>\n<p><strong>4625:<\/strong> Failed logon attempt<\/p>\n<\/li>\n<li>\n<p><strong>4648:<\/strong> Explicit credentials<\/p>\n<\/li>\n<\/ul>\n<p><strong>PowerShell Monitoring:<\/strong><\/p>\n<pre><code>Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4776} |\n Where-Object {$_.Message -like \"*LM*\" -or $_.Message -like \"*NTLM*\"}\n<\/code><\/pre>\n<hr>\n<h2>G&uuml;venlik Do\u011frulama<\/h2>\n<h3>1. Mevcut Ayarlar\u0131n Kontrol&uuml;<\/h3>\n<p><strong>GPO ile:<\/strong><\/p>\n<pre><code>gpresult \/h gpreport.html\n<\/code><\/pre>\n<p><strong>Registry ile:<\/strong><\/p>\n<pre><code>Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n -Name \"LmCompatibilityLevel\"\n<\/code><\/pre>\n<hr>\n<h3>2. A\u011f Trafi\u011fi Analizi<\/h3>\n<ul>\n<li>\n<p>Wireshark ile NTLM paketlerini yakalay\u0131n<\/p>\n<\/li>\n<li>\n<p>Protokol s&uuml;r&uuml;m&uuml;n&uuml; do\u011frulay\u0131n<\/p>\n<\/li>\n<li>\n<p>Challenge-response mekanizmas\u0131n\u0131 inceleyin<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>3. G&uuml;venlik Tarama<\/h3>\n<p><strong>Nmap ile:<\/strong><\/p>\n<pre><code>nmap --script smb-security-mode\n<\/code><\/pre>\n<p><strong>PowerShell Bulk Kontrol:<\/strong><\/p>\n<pre><code>$computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name\nforeach ($computer in $computers) {\n  try {\n    $lmLevel = Invoke-Command -ComputerName $computer -ScriptBlock {\n      Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n       -Name \"LmCompatibilityLevel\"\n    }\n    Write-Output \"$computer : $($lmLevel.LmCompatibilityLevel)\"\n  } catch {\n    Write-Output \"$computer : Connection failed\"\n  }\n}\n<\/code><\/pre>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>LAN Manager Authentication Level<\/strong> ayar\u0131n\u0131n <strong>Seviye 5<\/strong> olarak yap\u0131land\u0131r\u0131lmas\u0131, Windows a\u011f g&uuml;venli\u011finin <strong>temel gereksinimlerinden biridir<\/strong>.<\/p>\n<p><strong>&ldquo;Send NTLMv2 response only. Refuse LM &amp; NTLM&rdquo;<\/strong> yap\u0131land\u0131rmas\u0131, modern g&uuml;venlik standartlar\u0131na uygun <strong>minimum g&uuml;venli seviye<\/strong> olarak kabul edilir.<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Uygulama Ad\u0131mlar\u0131<\/h3>\n<p>\u2705 Mevcut durumu analiz edin<br>\u2705 Test ortam\u0131nda uygulay\u0131n<br>\u2705 Legacy sistemleri tespit edin<br>\u2705 GPO ile seviye 5&rsquo;e ayarlay\u0131n<br>\u2705 Monitoring sistemini kurun<br>\u2705 A\u015famal\u0131 deployment ger&ccedil;ekle\u015ftirin<\/p>\n<hr>\n<h3>Kritik Kontrol Listesi<\/h3>\n<p>\u2705 <code>LmCompatibilityLevel = 5<\/code> mi?<br>\u2705 Domain GPO&rsquo;da politika aktif mi?<br>\u2705 Legacy sistemler g&uuml;ncellendi mi?<br>\u2705 Monitoring aktif mi?<br>\u2705 Incident response plan\u0131 haz\u0131r m\u0131?<\/p>\n<hr>\n<p>Bu yap\u0131land\u0131rmay\u0131 uygulayarak <strong>pass-the-hash<\/strong>, <strong>replay<\/strong> ve <strong>relay<\/strong> sald\u0131r\u0131lar\u0131na kar\u015f\u0131 sisteminizi &ouml;nemli &ouml;l&ccedil;&uuml;de koruyabilir ve <strong>modern kimlik do\u011frulama standartlar\u0131na uygun<\/strong> bir g&uuml;venlik seviyesi sa\u011flayabilirsiniz.<\/p>","excerpt":"Windows a\u011f ortamlar\u0131nda kimlik do\u011frulama g\u00fcvenli\u011fi, sistem b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fcn en kritik unsurlar\u0131ndan biridir. LAN Manager Authentication Level ayar\u0131n\u0131n g\u00fcvenli seviyeye ayarlanmamas\u0131, sald\u0131rganlar\u0131n eski ve zay\u0131f kimlik do\u011frulama protokollerini kullanarak sisteme s\u0131zmas\u0131na olanak tan\u0131r.","created_at":"2025-07-16 23:49:29","updated_at":"2026-09-23 15:28:56","category_id":12,"view_count":643,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:49:29","featured_image":"\/uploads\/images\/2025\/12\/6947c5a1a2465_1766311329.png","slug":"lan-manager-authentication-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":28,"title":"NetBIOS TCP\/IP g\u00fcvenlik a\u00e7\u0131\u011f\u0131","content":"<p>&nbsp;<\/p>\n<hr>\n<h1>NetBIOS over TCP\/IP G&uuml;venlik A&ccedil;\u0131\u011f\u0131<\/h1>\n<h2>Kritik Bir A\u011f G&uuml;venli\u011fi Riski<\/h2>\n<p>Modern a\u011f g&uuml;venli\u011finde, <strong>eski protokollerin<\/strong> g&uuml;n&uuml;m&uuml;z sistemlerinde yaratt\u0131\u011f\u0131 g&uuml;venlik riskleri ciddi bir endi\u015fe kayna\u011f\u0131d\u0131r. Bu yaz\u0131da, <strong>NetBIOS over TCP\/IP<\/strong> protokol&uuml;n&uuml;n devre d\u0131\u015f\u0131 b\u0131rak\u0131lmamas\u0131n\u0131n neden <strong>kritik bir g&uuml;venlik a&ccedil;\u0131\u011f\u0131<\/strong> olu\u015fturdu\u011funu ve bu sorunu nas\u0131l &ccedil;&ouml;zebilece\u011finizi detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n<hr>\n<h2>NetBIOS over TCP\/IP Nedir?<\/h2>\n<p><strong>NetBIOS (Network Basic Input\/Output System) over TCP\/IP<\/strong>, eski bilgisayar uygulamalar\u0131n\u0131n NetBIOS protokol&uuml;ne dayal\u0131 olarak &ccedil;al\u0131\u015fmas\u0131n\u0131 sa\u011flayan ve modern TCP\/IP a\u011flar\u0131nda kullan\u0131labilen bir a\u011f protokol&uuml;d&uuml;r.<\/p>\n<p>Bu protokol, &ouml;zellikle <strong>Windows ortamlar\u0131nda dosya payla\u015f\u0131m\u0131 ve a\u011f ke\u015ffi<\/strong> i&ccedil;in kullan\u0131lm\u0131\u015ft\u0131r.<\/p>\n<hr>\n<h2>Protokol&uuml;n &Ccedil;al\u0131\u015fma Mant\u0131\u011f\u0131<\/h2>\n<p>NetBIOS over TCP\/IP, <strong>&uuml;&ccedil; temel bile\u015fenden<\/strong> olu\u015fur:<\/p>\n<ul>\n<li>\n<p><strong>NetBIOS Name Service (NBNS)<\/strong> &ndash; Port <strong>137\/UDP<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>NetBIOS Datagram Service (NBDS)<\/strong> &ndash; Port <strong>138\/UDP<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>NetBIOS Session Service (NBSS)<\/strong> &ndash; Port <strong>139\/TCP<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Riskleri ve Sald\u0131r\u0131 Vekt&ouml;rleri<\/h2>\n<h3>1. Bilgi S\u0131z\u0131nt\u0131s\u0131 Riski<\/h3>\n<p>NetBIOS&rsquo;un etkin olmas\u0131, sald\u0131rganlar\u0131n a\u015fa\u011f\u0131daki <strong>hassas bilgilere<\/strong> eri\u015fmesini sa\u011flayabilir:<\/p>\n<ul>\n<li>\n<p>Bilgisayar adlar\u0131 ve domain bilgileri<\/p>\n<\/li>\n<li>\n<p>&Ccedil;al\u0131\u015fma grubu isimleri<\/p>\n<\/li>\n<li>\n<p>Payla\u015f\u0131lan dizinler ve dosyalar<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 listeleri<\/p>\n<\/li>\n<li>\n<p>MAC adresleri<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. NBSTAT Sorgular\u0131 ile Bilgi Toplama<\/h3>\n<p>Sald\u0131rganlar <strong>NBSTAT sorgular\u0131<\/strong> kullanarak hedef sistemlerden ayr\u0131nt\u0131l\u0131 bilgi toplayabilir:<\/p>\n<pre><code>nbtstat -A &lt;IP_Adresi&gt;\n<\/code><\/pre>\n<p>Bu komut, sistem hakk\u0131nda <strong>detayl\u0131 NetBIOS bilgilerini<\/strong> a&ccedil;\u0131\u011fa &ccedil;\u0131karabilir.<\/p>\n<hr>\n<h3>3. DRDoS (Distributed Reflected Denial of Service) Sald\u0131r\u0131lar\u0131<\/h3>\n<p>NetBIOS&rsquo;un <strong>UDP tabanl\u0131<\/strong> &ccedil;al\u0131\u015fmas\u0131, trafik amplifikasyon sald\u0131r\u0131lar\u0131nda k&ouml;t&uuml;ye kullan\u0131lmas\u0131na olanak tan\u0131r:<\/p>\n<ul>\n<li>\n<p>K&uuml;&ccedil;&uuml;k paketler &rarr; b&uuml;y&uuml;k yan\u0131tlar<\/p>\n<\/li>\n<li>\n<p>DRDoS sald\u0131r\u0131lar\u0131nda <strong>amplifikat&ouml;r<\/strong> olarak kullan\u0131m<\/p>\n<\/li>\n<li>\n<p>A\u011f bant geni\u015fli\u011fi ve kaynaklar\u0131n t&uuml;kenmesi<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>4. Lateral Movement (Yan Hareket)<\/h3>\n<p>NetBIOS &uuml;zerinden sald\u0131rganlar:<\/p>\n<ul>\n<li>\n<p>A\u011f i&ccedil;indeki di\u011fer sistemleri ke\u015ffedebilir<\/p>\n<\/li>\n<li>\n<p>Payla\u015f\u0131lan kaynaklar\u0131 tespit edebilir<\/p>\n<\/li>\n<li>\n<p><strong>Privilege escalation<\/strong> sald\u0131r\u0131lar\u0131 ger&ccedil;ekle\u015ftirebilir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>&Ccedil;&ouml;z&uuml;m Y&ouml;ntemleri<\/h2>\n<h3>1. Windows Sistemlerde NetBIOS Devre D\u0131\u015f\u0131 B\u0131rakma<\/h3>\n<h4>A\u011f Adapt&ouml;r&uuml; Ayarlar\u0131 &Uuml;zerinden<\/h4>\n<ol>\n<li>\n<p>Denetim Masas\u0131 &rarr; A\u011f ve Payla\u015f\u0131m Merkezi<\/p>\n<\/li>\n<li>\n<p>Adapt&ouml;r ayarlar\u0131n\u0131 de\u011fi\u015ftir<\/p>\n<\/li>\n<li>\n<p>Ethernet \/ Wi-Fi adapt&ouml;r&uuml;ne sa\u011f t\u0131k &rarr; <strong>&Ouml;zellikler<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Internet Protocol Version 4 (TCP\/IPv4)<\/strong> &rarr; &Ouml;zellikler<\/p>\n<\/li>\n<li>\n<p><strong>Geli\u015fmi\u015f<\/strong> &rarr; <strong>WINS<\/strong> sekmesi<\/p>\n<\/li>\n<li>\n<p><strong>NetBIOS over TCP\/IP&rsquo;yi devre d\u0131\u015f\u0131 b\u0131rak<\/strong> se&ccedil;ene\u011fini i\u015faretleyin<\/p>\n<\/li>\n<\/ol>\n<hr>\n<h4>Kay\u0131t Defteri (Registry) &Uuml;zerinden<\/h4>\n<p><strong>Registry Yolu:<\/strong><\/p>\n<pre><code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\\\n<\/code><\/pre>\n<p>Her a\u011f adapt&ouml;r&uuml; i&ccedil;in:<\/p>\n<ul>\n<li>\n<p><strong>NetbiosOptions = 2<\/strong> olarak ayarlanmal\u0131d\u0131r.<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>2. Group Policy (GPO) ile Toplu Y&ouml;netim<\/h3>\n<p>Kurumsal ortamlarda:<\/p>\n<ol>\n<li>\n<p><strong>Group Policy Management Console<\/strong> a&ccedil;\u0131n<\/p>\n<\/li>\n<li>\n<p>A\u015fa\u011f\u0131daki yolu izleyin:<\/p>\n<\/li>\n<\/ol>\n<pre><code>Computer Configuration\n&rarr; Administrative Templates\n&rarr; Network\n&rarr; DNS Client\n<\/code><\/pre>\n<ol start=\"3\">\n<li>\n<p><strong>&ldquo;Turn off NetBIOS over TCP\/IP&rdquo;<\/strong> politikas\u0131n\u0131 <strong>Enabled<\/strong> olarak ayarlay\u0131n<\/p>\n<\/li>\n<\/ol>\n<hr>\n<h3>3. G&uuml;venlik Duvar\u0131 Kurallar\u0131<\/h3>\n<p>NetBIOS portlar\u0131n\u0131 engelleyin:<\/p>\n<ul>\n<li>\n<p><strong>137\/UDP<\/strong> &ndash; NetBIOS Name Service<\/p>\n<\/li>\n<li>\n<p><strong>138\/UDP<\/strong> &ndash; NetBIOS Datagram Service<\/p>\n<\/li>\n<li>\n<p><strong>139\/TCP<\/strong> &ndash; NetBIOS Session Service<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>4. A\u011f Segmentasyonu<\/h3>\n<ul>\n<li>\n<p>NetBIOS trafi\u011fini yaln\u0131zca <strong>gerekli a\u011f segmentlerine<\/strong> s\u0131n\u0131rland\u0131r\u0131n<\/p>\n<\/li>\n<li>\n<p>VLAN&rsquo;lar aras\u0131 NetBIOS trafi\u011fini engelleyin<\/p>\n<\/li>\n<li>\n<p>G&uuml;venlik duvar\u0131 kurallar\u0131 ile eri\u015fimi k\u0131s\u0131tlay\u0131n<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Deployment Sonras\u0131 Dikkat Edilmesi Gerekenler<\/h2>\n<h3>Legacy Uygulama Uyumlulu\u011fu<\/h3>\n<p>NetBIOS&rsquo;u devre d\u0131\u015f\u0131 b\u0131rakmadan &ouml;nce:<\/p>\n<ul>\n<li>\n<p>Eski uygulamalar\u0131n NetBIOS&rsquo;a ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 kontrol edin<\/p>\n<\/li>\n<li>\n<p>Dosya payla\u015f\u0131m sistemlerini test edin<\/p>\n<\/li>\n<li>\n<p>Yaz\u0131c\u0131 payla\u015f\u0131mlar\u0131n\u0131n etkilenip etkilenmedi\u011fini do\u011frulay\u0131n<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3>Alternatif &Ccedil;&ouml;z&uuml;mler<\/h3>\n<p>NetBIOS gerekli olan sistemler i&ccedil;in:<\/p>\n<ul>\n<li>\n<p><strong>SMB Direct<\/strong> kullan\u0131m\u0131n\u0131 de\u011ferlendirin<\/p>\n<\/li>\n<li>\n<p><strong>WS-Discovery<\/strong> protokol&uuml;ne ge&ccedil;i\u015f yap\u0131n<\/p>\n<\/li>\n<li>\n<p>Modern <strong>DNS tabanl\u0131 &ccedil;&ouml;z&uuml;mleri<\/strong> benimseyin<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>G&uuml;venlik Tarama ve Do\u011frulama<\/h2>\n<h3>Nmap ile NetBIOS Taramas\u0131<\/h3>\n<pre><code>nmap -sU -p 137,138 &lt;IP_Aral\u0131\u011f\u0131&gt;\nnmap -sT -p 139 &lt;IP_Aral\u0131\u011f\u0131&gt;\n<\/code><\/pre>\n<hr>\n<h3>PowerShell ile Durum Kontrol&uuml;<\/h3>\n<pre><code>Get-WmiObject -Class Win32_NetworkAdapterConfiguration |\n Where-Object {$_.TcpipNetbiosOptions -ne $null} |\n Select-Object Description, TcpipNetbiosOptions\n<\/code><\/pre>\n<hr>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p><strong>NetBIOS over TCP\/IP<\/strong> protokol&uuml;n&uuml;n devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, a\u011f g&uuml;venli\u011finizi <strong>&ouml;nemli &ouml;l&ccedil;&uuml;de art\u0131racakt\u0131r<\/strong>. Ancak bu de\u011fi\u015fikli\u011fi uygulamadan &ouml;nce:<\/p>\n<ul>\n<li>\n<p>Mevcut uygulamalar\u0131 analiz edin<\/p>\n<\/li>\n<li>\n<p>Test ortam\u0131nda de\u011fi\u015fiklikleri deneyin<\/p>\n<\/li>\n<li>\n<p>A\u015famal\u0131 bir deployment planlay\u0131n<\/p>\n<\/li>\n<li>\n<p>S&uuml;rekli izleme ve do\u011frulama yap\u0131n<\/p>\n<\/li>\n<\/ul>\n<p>Modern a\u011f ortamlar\u0131nda <strong>NetBIOS genellikle gereksizdir<\/strong> ve ciddi g&uuml;venlik a&ccedil;\u0131klar\u0131 olu\u015fturur. Bu protokol&uuml; devre d\u0131\u015f\u0131 b\u0131rakarak hem <strong>bilgi s\u0131z\u0131nt\u0131s\u0131 riskini azalt\u0131r<\/strong>, hem de <strong>DRDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131<\/strong> altyap\u0131n\u0131z\u0131 g&uuml;&ccedil;lendirirsiniz.<\/p>\n<hr>\n<h3>H\u0131zl\u0131 Kontrol Listesi<\/h3>\n<p>\u2705 NetBIOS over TCP\/IP devre d\u0131\u015f\u0131 b\u0131rak\u0131ld\u0131 m\u0131?<br>\u2705 G&uuml;venlik duvar\u0131 kurallar\u0131 uyguland\u0131 m\u0131?<br>\u2705 Legacy uygulamalar test edildi mi?<br>\u2705 GPO politikalar\u0131 g&uuml;ncellendi mi?<br>\u2705 A\u011f segmentasyonu yap\u0131ld\u0131 m\u0131?<\/p>\n<hr>\n<p>Bu ad\u0131mlar\u0131 takip ederek, <strong>NetBIOS over TCP\/IP kaynakl\u0131 g&uuml;venlik a&ccedil;\u0131klar\u0131ndan<\/strong> korunabilir ve <strong>daha g&uuml;venli, modern bir a\u011f altyap\u0131s\u0131<\/strong> olu\u015fturabilirsiniz.<\/p>","excerpt":"NetBIOS over TCP\/IP G\u00fcvenlik A\u00e7\u0131\u011f\u0131: Kritik Bir A\u011f G\u00fcvenli\u011fi Riski Modern a\u011f g\u00fcvenli\u011finde, eski protokollerin g\u00fcn\u00fcm\u00fcz sistemlerinde","created_at":"2025-07-16 23:45:22","updated_at":"2026-09-23 13:08:35","category_id":12,"view_count":614,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:45:22","featured_image":"\/uploads\/images\/2025\/12\/6947c6257ad23_1766311461.jpg","slug":"netbios-tcp-ip-guvenlik-acigi","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"},{"id":37,"title":"Windows'da SIEM Entegrasyonu","content":"<h3><strong>1. SIEM Nedir ve Neden &Ouml;nemlidir?<\/strong><\/h3>\n<p>SIEM (Security Information and Event Management), g&uuml;venlik olaylar\u0131n\u0131 merkezi olarak toplar, analiz eder ve raporlar. Windows sunuculardan SIEM&rsquo;e log g&ouml;nderimi, g&uuml;venlik takibi ve tehdit tespitinde kritik rol oynar. (<a title=\"SIEM ve SOC Farklar\u0131 Nelerdir?\" href=\"https:\/\/bulutistan.com\/blog\/siem-ve-soc-farklari-nelerdir\/?utm_source=chatgpt.com\">Bulutistan<\/a>)<\/p>\n<hr>\n<h2><strong>2. Gereken Eri\u015fimler<\/strong><\/h2>\n<p>Windows ortam\u0131ndan SIEM&rsquo;e veri toplanabilmesi i&ccedil;in a\u015fa\u011f\u0131daki kaynaklara eri\u015filmelidir:<\/p>\n<ul>\n<li>\n<p><strong>Event Log&rsquo;lar:<\/strong> G&uuml;venlik, Sistem ve Uygulama kay\u0131tlar\u0131. (<a title=\"SIEM Log Collection Explained: Sources, Methods, and ...\" href=\"https:\/\/searchinform.com\/articles\/cybersecurity\/measures\/siem\/analytics\/log-management\/log-collection\/?utm_source=chatgpt.com\">searchinform.com<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>WMI (Windows Management Instrumentation):<\/strong> Sistem verileri ve performans &ouml;l&ccedil;&uuml;mleri. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>WinRM (Remote Management):<\/strong> Uzak y&ouml;netim ve komut y&uuml;r&uuml;tme. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>DCOM:<\/strong> Da\u011f\u0131t\u0131k uygulama eri\u015fimleri i&ccedil;in gerekli sistem komponenti. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<\/ul>\n<p>Bu eri\u015fimlerin her biri i&ccedil;in uygun izinler ve servisler etkin olmal\u0131d\u0131r.<\/p>\n<hr>\n<h2><strong>3. Ad\u0131m Ad\u0131m Yap\u0131land\u0131rma<\/strong><\/h2>\n<h3><strong>3.1. Kullan\u0131c\u0131 Yetkileri<\/strong><\/h3>\n<p>SIEM i&ccedil;in &ouml;zel bir hesap (&ouml;rne\u011fin <code>siem_user<\/code>) olu\u015ftur ve a\u015fa\u011f\u0131daki gruplara ekle:<\/p>\n<pre><code class=\"language-powershell\">$Groups = @(\"Performance Monitor Users\", \"Event Log Readers\", \"Distributed COM Users\")\n\nforeach ($Group in $Groups) {\n    Add-LocalGroupMember -Group $Group -Member \"siem_user\"\n    Write-Host \"$Group grubuna eklendi\"\n}\n<\/code><\/pre>\n<ul>\n<li>\n<p><em>Performance Monitor Users:<\/em> Performans verilerini okumaya izin verir.<\/p>\n<\/li>\n<li>\n<p><em>Event Log Readers:<\/em> Olay g&uuml;nl&uuml;klerini okuma yetene\u011fi sa\u011flar.<\/p>\n<\/li>\n<li>\n<p><em>Distributed COM Users:<\/em> DCOM ve WMI eri\u015fimleri i&ccedil;in gereklidir.<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3><strong>3.2. WMI \u0130zinleri<\/strong><\/h3>\n<p>WMI verilerine eri\u015fim, SIEM sistemlerinin sistem bilgilerini ve servis durumlar\u0131n\u0131 alabilmesi i&ccedil;in gereklidir.<br>Bunu manuel olarak <code>wmimgmt.msc<\/code> arac\u0131ndan yap\u0131land\u0131rabilirsin:<\/p>\n<ol>\n<li>\n<p>&Ccedil;al\u0131\u015ft\u0131r (<code>Win + R<\/code>) &rarr; <code>wmimgmt.msc<\/code><\/p>\n<\/li>\n<li>\n<p>WMI Control &rarr; Properties &rarr; Security&rsquo;e git.<\/p>\n<\/li>\n<li>\n<p>A\u015fa\u011f\u0131daki namespace&rsquo;lere <code>Remote Enable<\/code> gibi gerekli izinleri ver:<\/p>\n<ul>\n<li>\n<p><code>root\\cimv2<\/code><\/p>\n<\/li>\n<li>\n<p><code>root\\default<\/code><\/p>\n<\/li>\n<li>\n<p><code>root\\wmi<\/code><\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<hr>\n<h3><strong>3.3. Event Log Eri\u015fimi<\/strong><\/h3>\n<p>Event log&rsquo;lar\u0131n\u0131 okumak i&ccedil;in kullan\u0131c\u0131ya ilgili log anahtarlar\u0131n\u0131n registry izinleri verilmelidir:<\/p>\n<pre><code class=\"language-powershell\">$EventLogs = @(\"Application\", \"System\", \"Security\")\n\nforeach ($LogName in $EventLogs) {\n    $RegPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\$LogName\"\n    $Acl = Get-Acl $RegPath\n    $AccessRule = New-Object System.Security.AccessControl.RegistryAccessRule(\n        \"COMPUTERNAME\\siem_user\",\n        \"ReadKey\",\n        \"ContainerInherit,ObjectInherit\",\n        \"None\",\n        \"Allow\"\n    )\n    $Acl.SetAccessRule($AccessRule)\n    Set-Acl -Path $RegPath -AclObject $Acl\n}\n<\/code><\/pre>\n<hr>\n<h3><strong>3.4. WinRM (Remote Management)<\/strong><\/h3>\n<p>WinRM&rsquo;i etkinle\u015ftir ve temel yap\u0131land\u0131rmay\u0131 yap:<\/p>\n<pre><code class=\"language-powershell\">winrm quickconfig -quiet\n\nwinrm set winrm\/config\/service '@{AllowUnencrypted=\"true\"}'\nwinrm set winrm\/config\/service\/auth '@{Basic=\"true\"}'\n\nGet-Service WinRM | Start-Service\n<\/code><\/pre>\n<p>Bu, uzaktan y&ouml;netim i&ccedil;in WinRM servisini aktif eder.<\/p>\n<hr>\n<h2><strong>4. Test ve Do\u011frulama<\/strong><\/h2>\n<p>Yap\u0131land\u0131rmadan sonra eri\u015fimin ba\u015far\u0131l\u0131 oldu\u011funu test etmek &ouml;nemlidir:<\/p>\n<p><strong>Grup &uuml;yelik testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-LocalGroupMember -Group \"Event Log Readers\"\n<\/code><\/pre>\n<p><strong>Event Log eri\u015fimi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-WinEvent -LogName System -MaxEvents 5\n<\/code><\/pre>\n<p><strong>WMI testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-WmiObject -Class Win32_ComputerSystem\n<\/code><\/pre>\n<p><strong>WinRM ba\u011flant\u0131 testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Test-NetConnection -ComputerName localhost -Port 5985\n<\/code><\/pre>\n<hr>\n<h2><strong>5. Basit Bir &ldquo;Health Check&rdquo; Script&rsquo;i<\/strong><\/h2>\n<p>T&uuml;m temel kontrolleri tek seferde yapan basit bir test script&rsquo;i:<\/p>\n<pre><code class=\"language-powershell\">$UserName = \"siem_user\"\n\n# Grup Kontrolleri\n$Groups = @(\"Performance Monitor Users\", \"Event Log Readers\", \"Distributed COM Users\")\nforeach ($Group in $Groups) {\n    Write-Host $Group\n    Get-LocalGroupMember -Group $Group\n}\n\n# Event Log Test\nGet-WinEvent -LogName System -MaxEvents 1\n\n# WinRM Servis Durumu\nGet-Service WinRM\n<\/code><\/pre>\n<p>Bu script ile h\u0131zl\u0131 bir &ouml;n kontrol yapabilirsin.<\/p>\n<hr>\n<h2><strong>6. G&uuml;venlik Tavsiyeleri<\/strong><\/h2>\n<ul>\n<li>\n<p>Minimum izin prensibini uygula: Sadece gerekli haklar\u0131 ver.<\/p>\n<\/li>\n<li>\n<p>g&uuml;&ccedil;l&uuml; parolalar ve hesap politikalar\u0131 kullan.<\/p>\n<\/li>\n<li>\n<p>SIEM kullan\u0131c\u0131 hesap aktivitelerini ayr\u0131 olarak izle.<\/p>\n<\/li>\n<li>\n<p>WinRM ba\u011flant\u0131lar\u0131n\u0131 g&uuml;venli protokoller &uuml;zerinden (HTTPS) s\u0131n\u0131rla.<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>K\u0131sa Notlar<\/strong><\/h2>\n<ul>\n<li>\n<p>SIEM, geni\u015f log kaynaklar\u0131n\u0131 analiz eden merkezi bir g&uuml;venlik arac\u0131d\u0131r. (<a title=\"SIEM Integration best practices | ADAudit|Plus\" href=\"https:\/\/www.manageengine.com\/products\/active-directory-audit\/kb\/best-practices\/siem-integration-best-practices.html?utm_source=chatgpt.com\">manageengine.com<\/a>)<\/p>\n<\/li>\n<li>\n<p>Windows Event Log&rsquo;lar SIEM i&ccedil;in zengin g&uuml;venlik bilgileri sa\u011flar. (<a title=\"SIEM Log Collection Explained: Sources, Methods, and ...\" href=\"https:\/\/searchinform.com\/articles\/cybersecurity\/measures\/siem\/analytics\/log-management\/log-collection\/?utm_source=chatgpt.com\">searchinform.com<\/a>)<\/p>\n<\/li>\n<li>\n<p>WMI ve WinRM, uzaktan veri toplama i&ccedil;in kritik servislerdir. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>A\u015fa\u011f\u0131da, daha &ouml;nce bahsetti\u011fimiz t&uuml;m <strong>Windows SIEM entegrasyonu<\/strong> ad\u0131mlar\u0131n\u0131 <strong>tek paket<\/strong>, <strong>mod&uuml;ler<\/strong>, <strong>okunabilir<\/strong>, <strong>bak\u0131m\u0131 kolay<\/strong> ve <strong>kurumsal ortama uygun<\/strong> bir PowerShell yap\u0131s\u0131na d&ouml;n&uuml;\u015ft&uuml;rd&uuml;m.<\/p>\n<p>Bu yap\u0131:<\/p>\n<ul>\n<li>\n<p>Tek dosya olarak da &ccedil;al\u0131\u015f\u0131r<\/p>\n<\/li>\n<li>\n<p>\u0130stersen mod&uuml;l (<code>.psm1<\/code>) haline getirilebilir<\/p>\n<\/li>\n<li>\n<p>Domain \/ Standalone uyumlu<\/p>\n<\/li>\n<li>\n<p>Humanist (a&ccedil;\u0131klamal\u0131), ikon yok, sade dil<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>Windows SIEM Integration &ndash; Mod&uuml;ler PowerShell Paketi<\/h1>\n<h2>&nbsp;<\/h2>\n<ul>\n<li>\n<p>Gerekli <strong>grup &uuml;yeliklerini<\/strong> eklemek<\/p>\n<\/li>\n<li>\n<p><strong>Event Log<\/strong>, <strong>WMI<\/strong>, <strong>WinRM<\/strong> eri\u015fimini sa\u011flamak<\/p>\n<\/li>\n<li>\n<p>H\u0131zl\u0131 <strong>Health Check<\/strong> almak<\/p>\n<\/li>\n<li>\n<p>Tek komutla <strong>kur \/ kontrol et \/ raporla<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Dosya Yap\u0131s\u0131 (&ouml;nerilen)<\/h2>\n<pre><code class=\"language-text\">Windows-SIEM\/\n\u2502\n\u251c\u2500 SIEM-Config.ps1        # Ana &ccedil;al\u0131\u015ft\u0131rma dosyas\u0131\n\u251c\u2500 Modules\/\n\u2502   \u251c\u2500 Groups.ps1         # Grup i\u015flemleri\n\u2502   \u251c\u2500 EventLog.ps1       # Event Log eri\u015fimleri\n\u2502   \u251c\u2500 WMI.ps1            # WMI kontrolleri\n\u2502   \u251c\u2500 WinRM.ps1          # WinRM yap\u0131land\u0131rmas\u0131\n\u2502   \u2514\u2500 HealthCheck.ps1    # Test &amp; do\u011frulama\n\u2502\n\u2514\u2500 Config.psd1            # De\u011fi\u015fkenler\n<\/code><\/pre>\n<blockquote>\n<p>\u0130stersen bunu tek <code>.ps1<\/code> dosyas\u0131nda da birle\u015ftirebilirsin (a\u015fa\u011f\u0131da veriyorum).<\/p>\n<\/blockquote>\n<hr>\n<h2>Config.psd1 (Merkezi Ayarlar)<\/h2>\n<pre><code class=\"language-powershell\">@{\n    SIEMUser = \"siem_user\"\n\n    RequiredGroups = @(\n        \"Performance Monitor Users\",\n        \"Event Log Readers\",\n        \"Distributed COM Users\"\n    )\n\n    EventLogs = @(\n        \"Application\",\n        \"System\",\n        \"Security\"\n    )\n\n    WMINamespaces = @(\n        \"root\\cimv2\",\n        \"root\\wmi\"\n    )\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ Groups.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Add-SIEMGroupMembership {\n    param ($User, $Groups)\n\n    foreach ($Group in $Groups) {\n        if (-not (Get-LocalGroupMember $Group -ErrorAction SilentlyContinue |\n                  Where-Object Name -like \"*$User\")) {\n\n            Add-LocalGroupMember -Group $Group -Member $User\n            Write-Host \"[OK] $User &rarr; $Group eklendi\"\n        }\n        else {\n            Write-Host \"[SKIP] $User zaten $Group &uuml;yesi\"\n        }\n    }\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ EventLog.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Set-SIEMEventLogAccess {\n    param ($User, $Logs)\n\n    foreach ($Log in $Logs) {\n        $Path = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\$Log\"\n        $Acl  = Get-Acl $Path\n\n        $Rule = New-Object System.Security.AccessControl.RegistryAccessRule(\n            $User,\n            \"ReadKey\",\n            \"ContainerInherit,ObjectInherit\",\n            \"None\",\n            \"Allow\"\n        )\n\n        $Acl.SetAccessRule($Rule)\n        Set-Acl -Path $Path -AclObject $Acl\n\n        Write-Host \"[OK] EventLog eri\u015fimi verildi &rarr; $Log\"\n    }\n}\n<\/code><\/pre>\n<hr>\n<h2>&nbsp;Modules \/ WMI.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Test-SIEMWMI {\n    try {\n        Get-WmiObject Win32_OperatingSystem -ErrorAction Stop | Out-Null\n        Write-Host \"[OK] WMI eri\u015fimi mevcut\"\n        return $true\n    }\n    catch {\n        Write-Host \"[FAIL] WMI eri\u015fimi yok\"\n        return $false\n    }\n}\n<\/code><\/pre>\n<blockquote>\n<p>Not: WMI <strong>yetkilendirme i\u015flemi otomatik yap\u0131lmaz<\/strong>, g&uuml;venlik nedeniyle <strong>wmimgmt.msc<\/strong> &uuml;zerinden manuel yap\u0131lmas\u0131 &ouml;nerilir.<\/p>\n<\/blockquote>\n<hr>\n<h2>Modules \/ WinRM.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Enable-SIEMWinRM {\n\n    if ((Get-Service WinRM).Status -ne \"Running\") {\n        winrm quickconfig -quiet\n        Set-Service WinRM -StartupType Automatic\n        Start-Service WinRM\n    }\n\n    Write-Host \"[OK] WinRM aktif\"\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ HealthCheck.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Invoke-SIEMHealthCheck {\n    param ($User, $Groups)\n\n    Write-Host \"`n--- GROUP CHECK ---\"\n    foreach ($Group in $Groups) {\n        Get-LocalGroupMember $Group |\n        Where-Object Name -like \"*$User\" |\n        ForEach-Object { Write-Host \"[OK] $User &rarr; $Group\" }\n    }\n\n    Write-Host \"`n--- EVENT LOG TEST ---\"\n    Get-WinEvent -LogName System -MaxEvents 1 | Out-Null\n    Write-Host \"[OK] Event Log okunabiliyor\"\n\n    Write-Host \"`n--- WMI TEST ---\"\n    Test-SIEMWMI | Out-Null\n\n    Write-Host \"`n--- WINRM TEST ---\"\n    Test-NetConnection localhost -Port 5985 | Out-Null\n    Write-Host \"[OK] WinRM portu a&ccedil;\u0131k\"\n}\n<\/code><\/pre>\n<hr>\n<h2>&nbsp;Ana Dosya &ndash; SIEM-Config.ps1<\/h2>\n<pre><code class=\"language-powershell\">$BasePath = Split-Path $MyInvocation.MyCommand.Path\n\n. \"$BasePath\\Config.psd1\"\n. \"$BasePath\\Modules\\Groups.ps1\"\n. \"$BasePath\\Modules\\EventLog.ps1\"\n. \"$BasePath\\Modules\\WMI.ps1\"\n. \"$BasePath\\Modules\\WinRM.ps1\"\n. \"$BasePath\\Modules\\HealthCheck.ps1\"\n\nWrite-Host \"SIEM Entegrasyonu ba\u015fl\u0131yor...\"\n\nAdd-SIEMGroupMembership -User $SIEMUser -Groups $RequiredGroups\nSet-SIEMEventLogAccess -User $SIEMUser -Logs $EventLogs\nEnable-SIEMWinRM\nInvoke-SIEMHealthCheck -User $SIEMUser -Groups $RequiredGroups\n\nWrite-Host \"SIEM Entegrasyonu tamamland\u0131.\"\n<\/code><\/pre>\n<h2>&nbsp;Kullan\u0131m<\/h2>\n<pre><code class=\"language-powershell\">Set-ExecutionPolicy Bypass -Scope Process\n.\\SIEM-Config.ps1\n<\/code><\/pre>\n<hr>\n<h2>Kurumsal Notlar<\/h2>\n<ul>\n<li>\n<p>Bu yap\u0131 <strong>FortiSIEM, QRadar, Sentinel, Wazuh, Splunk<\/strong> ile uyumludur<\/p>\n<\/li>\n<li>\n<p>Domain ortam\u0131nda <strong>Local yerine Domain Group<\/strong> kullan\u0131labilir<\/p>\n<\/li>\n<\/ul>\n<p>extra<\/p>\n<pre class=\"language-markup\"><code>param(\n    [string]$SiemUser = \"siemuser\"\n)\n\nWrite-Host \"=== FortiSIEM Windows Entegrasyon Scripti ===\" -ForegroundColor Cyan\n\n# Domain mi kontrol et\n$IsDomain = (Get-WmiObject Win32_ComputerSystem).PartOfDomain\nWrite-Host \"Domain Ortam\u0131: $IsDomain\"\n\n# --- Local Group Ekleme ---\n$Groups = @(\n    \"Event Log Readers\",\n    \"Performance Monitor Users\",\n    \"Distributed COM Users\"\n)\n\nforeach ($group in $Groups) {\n    try {\n        Add-LocalGroupMember -Group $group -Member $SiemUser -ErrorAction Stop\n        Write-Host \"[OK] $SiemUser &rarr; $group\" -ForegroundColor Green\n    } catch {\n        Write-Host \"[WARN] $group eklenemedi veya zaten &uuml;ye\" -ForegroundColor Yellow\n    }\n}\n\n# --- WMI Namespace Yetkisi ---\n$namespace = \"root\\cimv2\"\n$account = \"$SiemUser\"\n\n$sd = Get-WmiObject -Namespace $namespace -Class __SystemSecurity\n$acl = $sd.GetSecurityDescriptor().Descriptor\n\nWrite-Host \"[OK] WMI eri\u015fimi mevcut (root\\cimv2)\" -ForegroundColor Green\n\n# --- WinRM A&ccedil; ---\nWrite-Host \"WinRM yap\u0131land\u0131r\u0131l\u0131yor...\"\nwinrm quickconfig -quiet\nSet-Service WinRM -StartupType Automatic\nStart-Service WinRM\n\n# --- Firewall ---\nWrite-Host \"Firewall WinRM kural\u0131 ekleniyor...\"\nEnable-NetFirewallRule -Name \"WINRM-HTTP-In-TCP\"\n\nWrite-Host \"=== Tamamland\u0131 ===\" -ForegroundColor Cyan\n<\/code><\/pre>\n<p>kontrol<\/p>\n<pre class=\"language-markup\"><code>Write-Host \"=== FortiSIEM Health Check ===\" -ForegroundColor Cyan\n\n# Security Log\ntry {\n    Get-WinEvent -LogName Security -MaxEvents 3 | Out-Null\n    Write-Host \"[OK] Security Log eri\u015fimi var\" -ForegroundColor Green\n} catch {\n    Write-Host \"[FAIL] Security Log eri\u015fimi yok\" -ForegroundColor Red\n}\n\n# WMI\ntry {\n    Get-WmiObject Win32_OperatingSystem | Out-Null\n    Write-Host \"[OK] WMI eri\u015fimi var\" -ForegroundColor Green\n} catch {\n    Write-Host \"[FAIL] WMI eri\u015fimi yok\" -ForegroundColor Red\n}\n\n# WinRM\nif ((Get-Service WinRM).Status -eq \"Running\") {\n    Write-Host \"[OK] WinRM &ccedil;al\u0131\u015f\u0131yor\" -ForegroundColor Green\n} else {\n    Write-Host \"[FAIL] WinRM &ccedil;al\u0131\u015fm\u0131yor\" -ForegroundColor Red\n}\n\n# Audit Policy\nauditpol \/get \/subcategory:\"File System\"\n<\/code><\/pre>\n<p>&nbsp;<\/p>","excerpt":"SIEM (Security Information and Event Management), g\u00fcvenlik olaylar\u0131n\u0131 merkezi olarak toplar, analiz eder ve raporlar. Windows sunuculardan SIEM\u2019e log g\u00f6nderimi, g\u00fcvenlik takibi ve tehdit tespitinde kritik rol oynar.","created_at":"2025-06-27 08:32:57","updated_at":"2026-09-23 13:08:05","category_id":6,"view_count":663,"reading_time":7,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-27 08:32:57","featured_image":"resimyok.jpg","slug":"windows-da-siem-entegrasyonu","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":48,"title":"Kurulum Sonras\u0131 Hemen De\u011fi\u015ftirmeniz Gereken 7 Windows Server Varsay\u0131lan Ayarlar\u0131","content":"<p>Windows Server kurulumu tamamland\u0131ktan sonra, sunucunuzu &uuml;retime almadan &ouml;nce mutlaka de\u011fi\u015ftirmeniz gereken kritik varsay\u0131lan ayarlar vard\u0131r. Microsoft, kullan\u0131\u015fl\u0131l\u0131k ve eri\u015filebilirlik a&ccedil;\u0131s\u0131ndan Windows Server'\u0131 belirli bir dengeyle yap\u0131land\u0131rm\u0131\u015ft\u0131r, ancak bu varsay\u0131lan ayarlar genellikle maksimum g&uuml;venlik sa\u011flamaz. Bu yaz\u0131da, 15+ y\u0131ll\u0131k sistem y&ouml;neticili\u011fi deneyimim boyunca her Windows Server kurulumunda mutlaka de\u011fi\u015ftirdi\u011fim 7 kritik ayar\u0131 ve bunlar\u0131n neden &ouml;nemli oldu\u011funu anlataca\u011f\u0131m.<\/p>\r\n<h2>Neden Windows Server Varsay\u0131lan Ayarlar\u0131 De\u011fi\u015ftirmek Gerekli?<\/h2>\r\n<p>Windows Server, \"out-of-the-box\" g&uuml;venli olacak \u015fekilde tasarlanm\u0131\u015f olsa da, bir&ccedil;ok organizasyon g&uuml;venlik konfig&uuml;rasyonlar\u0131 &uuml;zerinde daha ayr\u0131nt\u0131l\u0131 kontrol istemektedir. Microsoft'un g&uuml;venlik uzmanlar\u0131 \u015funu s&ouml;yl&uuml;yor: Microsoft 3,000'den fazla grup policy ayar\u0131 sunar ve bunlardan sadece bir k\u0131sm\u0131 g&uuml;venlik ile ilgilidir. Bu nedenle, do\u011fru konfig&uuml;rasyonlar\u0131 uygulamak kritiktir. <strong>Temel Prensipler:<\/strong><\/p>\r\n<ul>\r\n<li>Varsay\u0131lan ayarlar genellikle kullan\u0131c\u0131 dostu ama g&uuml;venlik odakl\u0131 de\u011fildir<\/li>\r\n<li>Her sunucu rol&uuml; farkl\u0131 g&uuml;venlik gereksinimleri gerektirir<\/li>\r\n<li>G&uuml;venlik katmanlar\u0131 (defense in depth) yakla\u015f\u0131m\u0131 benimsenmelidir<\/li>\r\n<li>Sald\u0131r\u0131 y&uuml;zeyini minimize etmek temel hedeftir<\/li>\r\n<\/ul>\r\n<h2>1. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131rma ve G&uuml;&ccedil;lendirme<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server kurulumu s\u0131ras\u0131nda olu\u015fturulan yerle\u015fik \"Administrator\" hesab\u0131, t&uuml;m d&uuml;nyada bilinen standart bir hesap ad\u0131d\u0131r. Bu, brute-force sald\u0131r\u0131lar\u0131 i&ccedil;in birincil hedeftir.<\/p>\r\n<h3>Yap\u0131lmas\u0131 Gerekenler<\/h3>\r\n<h4>A. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131rma<\/h4>\r\n<p><strong>GUI Y&ouml;ntemi:<\/strong><\/p>\r\n<pre><code>1. Computer Management &gt; Local Users and Groups &gt; Users 2. Administrator hesab\u0131na sa\u011f t\u0131k &gt; Rename 3. Benzersiz bir isim verin (&ouml;rn: SysAdmin2024, ServerManager, vb.) <\/code><\/pre>\r\n<p><strong>PowerShell Y&ouml;ntemi:<\/strong><\/p>\r\n<pre><code># Administrator hesab\u0131n\u0131 yeniden adland\u0131r Rename-LocalUser -Name \"Administrator\" -NewName \"SystemManager\" # Hesap durumunu kontrol et Get-LocalUser -Name \"SystemManager\" <\/code><\/pre>\r\n<p><strong>Group Policy ile Toplu De\u011fi\u015fiklik:<\/strong><\/p>\r\n<pre><code>Computer Configuration &gt; Windows Settings &gt; Security Settings &gt; Local Policies &gt; Security Options &gt; \"Accounts: Rename administrator account\" <\/code><\/pre>\r\n<h4>B. G&uuml;&ccedil;l&uuml; Parola Politikas\u0131 Uygulama<\/h4>\r\n<pre><code># G&uuml;&ccedil;l&uuml; parola belirleme $SecurePassword = ConvertTo-SecureString \"Karma\u015f\u0131kParola123!@#\" -AsPlainText -Force Set-LocalUser -Name \"SystemManager\" -Password $SecurePassword # Parola s&uuml;resiz yap (opsiyonel) Set-LocalUser -Name \"SystemManager\" -PasswordNeverExpires $true <\/code><\/pre>\r\n<h4>C. Hesap Kilitleme Politikas\u0131<\/h4>\r\n<p><strong>Local Security Policy ile:<\/strong><\/p>\r\n<pre><code>Security Settings &gt; Account Policies &gt; Account Lockout Policy Account lockout threshold: 3 Account lockout duration: 30 minutes Reset account lockout counter after: 15 minutes <\/code><\/pre>\r\n<p><strong>PowerShell ile:<\/strong><\/p>\r\n<pre><code># Hesap kilitleme politikas\u0131 ayarlama secedit \/export \/cfg c:\\temp\\secpol.cfg # Dosyay\u0131 d&uuml;zenle ve tekrar import et secedit \/configure \/db c:\\windows\\security\\local.sdb \/cfg c:\\temp\\secpol.cfg <\/code><\/pre>\r\n<h2>2. User Account Control (UAC) Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server'da UAC varsay\u0131lan olarak aktiftir ancak optimum g&uuml;venlik seviyesinde de\u011fildir. Ayr\u0131ca, built-in Administrator hesab\u0131 i&ccedil;in UAC varsay\u0131lan olarak devre d\u0131\u015f\u0131d\u0131r.<\/p>\r\n<h3>UAC Seviyelerini Anlama<\/h3>\r\n<p><strong>UAC Seviyeleri:<\/strong><\/p>\r\n<ol>\r\n<li><strong>Never notify<\/strong> (En d&uuml;\u015f&uuml;k g&uuml;venlik)<\/li>\r\n<li><strong>Notify me only when apps try to make changes<\/strong> (Varsay\u0131lan)<\/li>\r\n<li><strong>Always notify<\/strong> (En y&uuml;ksek g&uuml;venlik)<\/li>\r\n<\/ol>\r\n<h3>Optimal UAC Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Registry ile UAC Ayarlama<\/h4>\r\n<pre><code># UAC'\u0131 maksimum seviyeye ayarla Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" -Value 1 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" -Value 2 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"PromptOnSecureDesktop\" -Value 1 # Built-in Administrator i&ccedil;in UAC aktif et Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"FilterAdministratorToken\" -Value 1 <\/code><\/pre>\r\n<h4>B. Group Policy ile UAC Konfig&uuml;rasyonu<\/h4>\r\n<pre><code>Computer Configuration &gt; Windows Settings &gt; Security Settings &gt; Local Policies &gt; Security Options - User Account Control: Admin Approval Mode for Built-in Administrator = Enabled - User Account Control: Behavior of elevation prompt for administrators = Prompt for consent on secure desktop - User Account Control: Run all administrators in Admin Approval Mode = Enabled - User Account Control: Switch to secure desktop when prompting = Enabled <\/code><\/pre>\r\n<h4>C. UAC Monitoring Script'i<\/h4>\r\n<pre><code># UAC durumunu kontrol eden script function Check-UACStatus { $UACEnabled = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" $AdminBehavior = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" Write-Host \"UAC Status:\" Write-Host \"EnableLUA: $($UACEnabled.EnableLUA)\" Write-Host \"Admin Prompt Behavior: $($AdminBehavior.ConsentPromptBehaviorAdmin)\" if ($UACEnabled.EnableLUA -eq 1 -and $AdminBehavior.ConsentPromptBehaviorAdmin -eq 2) { Write-Host \"UAC is properly configured!\" -ForegroundColor Green } else { Write-Host \"UAC needs configuration!\" -ForegroundColor Red } } Check-UACStatus <\/code><\/pre>\r\n<h2>3. Windows Firewall Yap\u0131land\u0131rmas\u0131 ve Sertle\u015ftirme<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Firewall aktiftir ancak bir&ccedil;ok gereksiz kural ve servis a&ccedil;\u0131kt\u0131r. Ayr\u0131ca logging genellikle etkin de\u011fildir.<\/p>\r\n<h3>Optimal Firewall Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Temel Firewall Sertle\u015ftirme<\/h4>\r\n<pre><code># T&uuml;m profiller i&ccedil;in varsay\u0131lan politikalar\u0131 ayarla Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultOutboundAction Allow # Logging'i aktif et Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True -LogMaxSizeKilobytes 32767 Set-NetFirewallProfile -Profile Domain,Public,Private -LogFileName \"%SystemRoot%\\System32\\LogFiles\\Firewall\\pfirewall.log\" # Firewall bildirimlerini aktif et Set-NetFirewallProfile -Profile Domain,Public,Private -NotifyOnListen True <\/code><\/pre>\r\n<h4>B. Gereksiz Kurallar\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma<\/h4>\r\n<pre><code># Yayg\u0131n olarak gereksiz olan kurallar\u0131 devre d\u0131\u015f\u0131 b\u0131rak $DisableRules = @( \"*AllJoyn*\", \"*Cast to Device*\", \"*mDNS*\", \"*Wireless Display*\", \"*WLAN Service*\", \"*Windows Media Player*\" ) foreach ($rule in $DisableRules) { Disable-NetFirewallRule -DisplayName $rule -ErrorAction SilentlyContinue Write-Host \"Disabled: $rule\" } <\/code><\/pre>\r\n<h4>C. Remote Desktop Port De\u011fi\u015ftirme<\/h4>\r\n<pre><code># RDP portunu varsay\u0131lan 3389'dan de\u011fi\u015ftir $NewRDPPort = 6689 # Registry'de RDP portunu de\u011fi\u015ftir Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"PortNumber\" -Value $NewRDPPort # Firewall kural\u0131n\u0131 g&uuml;ncelle New-NetFirewallRule -DisplayName \"Remote Desktop - Custom Port\" -Direction Inbound -Protocol TCP -LocalPort $NewRDPPort -Action Allow # Eski RDP kural\u0131n\u0131 devre d\u0131\u015f\u0131 b\u0131rak Disable-NetFirewallRule -DisplayName \"Remote Desktop*\" Write-Host \"RDP port changed to: $NewRDPPort\" Write-Host \"Remember to add this port to your RDP client!\" <\/code><\/pre>\r\n<h4>D. Network Level Authentication Zorla<\/h4>\r\n<pre><code># Network Level Authentication'\u0131 aktif et Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"SecurityLayer\" -Value 1 Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" -Name \"UserAuthentication\" -Value 1 # RDP servisini yeniden ba\u015flat Restart-Service TermService -Force <\/code><\/pre>\r\n<h2>4. Otomatik Windows Update Konfig&uuml;rasyonu<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server varsay\u0131lan olarak manuel g&uuml;ncelleme modundad\u0131r. Bu g&uuml;venlik a&ccedil;\u0131klar\u0131n\u0131n kapat\u0131lmamas\u0131na neden olabilir.<\/p>\r\n<h3>Optimal Update Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. Otomatik G&uuml;ncelleme Ayarlama<\/h4>\r\n<pre><code># Windows Update servisini aktif et Set-Service -Name wuauserv -StartupType Automatic Start-Service wuauserv # Otomatik g&uuml;ncellemeleri aktif et $AUSettings = (New-Object -com \"Microsoft.Update.AutoUpdate\").Settings $AUSettings.NotificationLevel = 4 # Automatically download and install $AUSettings.ScheduledInstallationDay = 0 # Every day $AUSettings.ScheduledInstallationTime = 3 # 3 AM $AUSettings.IncludeRecommendedUpdates = $true $AUSettings.Save() <\/code><\/pre>\r\n<h4>B. Registry ile Update Politikas\u0131<\/h4>\r\n<pre><code># Windows Update registry ayarlar\u0131 $UpdatePath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" if (!(Test-Path $UpdatePath)) { New-Item -Path $UpdatePath -Force } Set-ItemProperty -Path $UpdatePath -Name \"AUOptions\" -Value 4 # Auto download and install Set-ItemProperty -Path $UpdatePath -Name \"ScheduledInstallDay\" -Value 0 # Every day Set-ItemProperty -Path $UpdatePath -Name \"ScheduledInstallTime\" -Value 3 # 3 AM Set-ItemProperty -Path $UpdatePath -Name \"AutoInstallMinorUpdates\" -Value 1 # Install minor updates Set-ItemProperty -Path $UpdatePath -Name \"IncludeRecommendedUpdates\" -Value 1 # Include recommended updates <\/code><\/pre>\r\n<h4>C. WSUS Konfig&uuml;rasyonu (Kurumsal Ortamlar \u0130&ccedil;in)<\/h4>\r\n<pre><code># WSUS sunucu konfig&uuml;rasyonu $WSUSServer = \"http:\/\/wsus.yourdomain.com:8530\" Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\" -Name \"WUServer\" -Value $WSUSServer Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\" -Name \"WUStatusServer\" -Value $WSUSServer Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" -Name \"UseWUServer\" -Value 1 # G&uuml;ncelleme servisini yeniden ba\u015flat Restart-Service wuauserv <\/code><\/pre>\r\n<h4>D. Update Status Monitoring Script'i<\/h4>\r\n<pre><code># Windows Update durumunu kontrol eden script function Get-WindowsUpdateStatus { $Session = New-Object -ComObject Microsoft.Update.Session $Searcher = $Session.CreateupdateSearcher() try { $Updates = $Searcher.Search(\"IsInstalled=0\") $PendingUpdates = $Updates.Updates.Count Write-Host \"Windows Update Status:\" -ForegroundColor Cyan Write-Host \"Pending Updates: $PendingUpdates\" -ForegroundColor $(if($PendingUpdates -gt 0){\"Red\"}else{\"Green\"}) if ($PendingUpdates -gt 0) { foreach ($Update in $Updates.Updates) { Write-Host \"- $($Update.Title)\" -ForegroundColor Yellow } } # Son y&uuml;klenen g&uuml;ncellemeleri g&ouml;ster $LastInstalled = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 Write-Host \"`nLast 5 Installed Updates:\" -ForegroundColor Cyan $LastInstalled | Format-Table HotFixID, Description, InstalledOn -AutoSize } catch { Write-Host \"Error checking updates: $($_.Exception.Message)\" -ForegroundColor Red } } Get-WindowsUpdateStatus <\/code><\/pre>\r\n<h2>5. Gereksiz Windows Servislerini Devre D\u0131\u015f\u0131 B\u0131rakma<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Windows Server bir&ccedil;ok servisle gelir ve bunlar\u0131n &ccedil;o\u011fu tipik sunucu operasyonlar\u0131 i&ccedil;in gerekli de\u011fildir. Microsoft, g&uuml;venlik odakl\u0131 da\u011f\u0131t\u0131mlar i&ccedil;in bu ayarlar\u0131n de\u011fi\u015ftirilmesini &ouml;nermektedir.<\/p>\r\n<h3>G&uuml;venli \u015eekilde Devre D\u0131\u015f\u0131 B\u0131rak\u0131labilecek Servisler<\/h3>\r\n<h4>A. Print Spooler Servisi<\/h4>\r\n<pre><code># Print Spooler - En yayg\u0131n sald\u0131r\u0131 vekt&ouml;rlerinden biri Stop-Service -Name Spooler -Force Set-Service -Name Spooler -StartupType Disabled Write-Host \"Print Spooler disabled - Major security improvement!\" <\/code><\/pre>\r\n<h4>B. Remote Registry Servisi<\/h4>\r\n<pre><code># Remote Registry - Uzaktan registry eri\u015fimini engelle Stop-Service -Name RemoteRegistry -Force Set-Service -Name RemoteRegistry -StartupType Disabled Write-Host \"Remote Registry disabled!\" <\/code><\/pre>\r\n<h4>C. Di\u011fer G&uuml;venlik Riski Olu\u015fturan Servisler<\/h4>\r\n<pre><code># Devre d\u0131\u015f\u0131 b\u0131rak\u0131labilecek servisler listesi $ServicesToDisable = @( \"Fax\", # Fax Service \"TrkWks\", # Distributed Link Tracking Client \"MSiSCSI\", # Microsoft iSCSI Initiator Service \"WbioSrvc\", # Windows Biometric Service \"WerSvc\", # Windows Error Reporting Service \"WSearch\", # Windows Search (dosya sunucusu de\u011filse) \"SSDPSRV\", # SSDP Discovery \"upnphost\", # UPnP Device Host \"Browser\", # Computer Browser \"LanmanServer\" # Server (dosya payla\u015f\u0131m\u0131 gerekmiyorsa) ) foreach ($service in $ServicesToDisable) { $svc = Get-Service -Name $service -ErrorAction SilentlyContinue if ($svc) { if ($svc.Status -eq 'Running') { Stop-Service -Name $service -Force } Set-Service -Name $service -StartupType Disabled Write-Host \"Disabled service: $service\" -ForegroundColor Green } } <\/code><\/pre>\r\n<h4>D. Servis Durumu Raporu<\/h4>\r\n<pre><code>function Get-SecurityServiceReport { $CriticalServices = @( \"Spooler\", \"RemoteRegistry\", \"Fax\", \"TrkWks\", \"MSiSCSI\", \"WbioSrvc\", \"WerSvc\", \"SSDPSRV\", \"upnphost\" ) Write-Host \"Security Service Status Report:\" -ForegroundColor Cyan Write-Host \"==============================\" -ForegroundColor Cyan foreach ($serviceName in $CriticalServices) { $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue if ($service) { $status = if ($service.StartType -eq 'Disabled') { \"SECURE\" } else { \"RISK\" } $color = if ($status -eq \"SECURE\") { \"Green\" } else { \"Red\" } Write-Host \"$serviceName : $($service.Status) \/ $($service.StartType) - $status\" -ForegroundColor $color } } } Get-SecurityServiceReport <\/code><\/pre>\r\n<h2>6. Zaman ve Saat Konfig&uuml;rasyonu (NTP G&uuml;venli\u011fi)<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>Do\u011fru zaman senkronizasyonu g&uuml;venlik log'lar\u0131 i&ccedil;in kritiktir. Varsay\u0131lan Windows Time servisi her zaman en g&uuml;venli yap\u0131land\u0131rmaya sahip de\u011fildir.<\/p>\r\n<h3>G&uuml;venli NTP Konfig&uuml;rasyonu<\/h3>\r\n<h4>A. G&uuml;venilir NTP Sunucular\u0131 Ayarlama<\/h4>\r\n<pre><code># G&uuml;venilir NTP sunucular\u0131n\u0131 ayarla $NTPServers = \"time.windows.com,time.nist.gov,pool.ntp.org\" # NTP client'\u0131 durdur Stop-Service w32time # NTP konfig&uuml;rasyonu w32tm \/config \/manualpeerlist:$NTPServers \/syncfromflags:manual \/reliable:yes \/update # Hizmeti ba\u015flat Start-Service w32time # Zaman senkronizasyonunu zorla w32tm \/resync \/force Write-Host \"NTP configuration completed with servers: $NTPServers\" <\/code><\/pre>\r\n<h4>B. Zaman Servisi G&uuml;venlik Ayarlar\u0131<\/h4>\r\n<pre><code># Windows Time Service g&uuml;venlik ayarlar\u0131 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"AnnounceFlags\" -Value 5 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"MaxNegPhaseCorrection\" -Value 3600 Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\" -Name \"MaxPosPhaseCorrection\" -Value 3600 # NTP authentication (kurumsal ortamlar i&ccedil;in) Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\NtpClient\" -Name \"RequireSecureTimeSyncRequests\" -Value 1 <\/code><\/pre>\r\n<h4>C. Zaman Senkronizasyonu Monitoring<\/h4>\r\n<pre><code>function Test-TimeSynchronization { Write-Host \"Time Synchronization Status:\" -ForegroundColor Cyan # W32Time servis durumu $w32timeService = Get-Service w32time Write-Host \"W32Time Service: $($w32timeService.Status)\" -ForegroundColor $(if($w32timeService.Status -eq 'Running'){\"Green\"}else{\"Red\"}) # Zaman senkronizasyon durumu $timeSync = w32tm \/query \/status Write-Host \"`nTime Sync Status:\" $timeSync | Select-String \"Last Successful Sync Time\", \"Source\", \"Stratum\" # Zaman fark\u0131n\u0131 kontrol et $ntpQuery = w32tm \/stripchart \/computer:time.windows.com \/samples:1 \/dataonly Write-Host \"`nTime Difference Check:\" $ntpQuery # Local time vs UTC $localTime = Get-Date $utcTime = Get-Date -UFormat \"%Y-%m-%d %H:%M:%S UTC\" Write-Host \"`nLocal Time: $localTime\" Write-Host \"UTC Time: $utcTime\" } Test-TimeSynchronization <\/code><\/pre>\r\n<h2>7. PowerShell Execution Policy ve G&uuml;venlik Ayarlar\u0131<\/h2>\r\n<h3>Varsay\u0131lan Durum Problemi<\/h3>\r\n<p>PowerShell varsay\u0131lan olarak script execution'a izin verir, bu da g&uuml;venlik riski olu\u015fturabilir. Ayr\u0131ca PowerShell v2.0 g&uuml;venlik a&ccedil;\u0131klar\u0131na sahiptir.<\/p>\r\n<h3>PowerShell G&uuml;venlik Sertle\u015ftirme<\/h3>\r\n<h4>A. Execution Policy Ayarlama<\/h4>\r\n<pre><code># G&uuml;venli execution policy ayarla Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force # T&uuml;m kullan\u0131c\u0131lar i&ccedil;in policy kontrol&uuml; Get-ExecutionPolicy -List # PowerShell mod&uuml;l logging'i aktif et $PSModuleLoggingPath = \"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" if (!(Test-Path $PSModuleLoggingPath)) { New-Item -Path $PSModuleLoggingPath -Force } Set-ItemProperty -Path $PSModuleLoggingPath -Name \"EnableModuleLogging\" -Value 1 # Script block logging aktif et $PSScriptBlockPath = \"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" if (!(Test-Path $PSScriptBlockPath)) { New-Item -Path $PSScriptBlockPath -Force } Set-ItemProperty -Path $PSScriptBlockPath -Name \"EnableScriptBlockLogging\" -Value 1 <\/code><\/pre>\r\n<h4>B. PowerShell v2.0 Kald\u0131rma<\/h4>\r\n<pre><code># PowerShell v2.0 feature'\u0131n\u0131 kald\u0131r (g&uuml;venlik a&ccedil;\u0131klar\u0131 nedeniyle) Disable-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellV2Root\" -All # ISE kald\u0131rma (sunucu ortam\u0131nda gerekli de\u011fil) Disable-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellISE\" -All Write-Host \"PowerShell v2.0 and ISE removed for security!\" <\/code><\/pre>\r\n<h4>C. PowerShell Constrained Language Mode<\/h4>\r\n<pre><code># Constrained Language Mode ayarlama (y&uuml;ksek g&uuml;venlik ortamlar\u0131 i&ccedil;in) $env:__PSLockdownPolicy = \"4\" # Sistem &ccedil;ap\u0131nda constrained mode i&ccedil;in ::SetEnvironmentVariable(\"__PSLockdownPolicy\", \"4\", \"Machine\") Write-Host \"PowerShell Constrained Language Mode enabled!\" <\/code><\/pre>\r\n<h4>D. PowerShell G&uuml;venlik Monitoring<\/h4>\r\n<pre><code>function Test-PowerShellSecurity { Write-Host \"PowerShell Security Assessment:\" -ForegroundColor Cyan Write-Host \"================================\" -ForegroundColor Cyan # Execution Policy kontrol $policy = Get-ExecutionPolicy $policyColor = switch ($policy) { \"Restricted\" { \"Green\" } \"RemoteSigned\" { \"Yellow\" } \"AllSigned\" { \"Green\" } default { \"Red\" } } Write-Host \"Execution Policy: $policy\" -ForegroundColor $policyColor # PowerShell v2.0 kontrol $ps2Feature = Get-WindowsOptionalFeature -Online -FeatureName \"MicrosoftWindowsPowerShellV2Root\" $ps2Status = if ($ps2Feature.State -eq \"Disabled\") { \"SECURE\" } else { \"RISK\" } $ps2Color = if ($ps2Status -eq \"SECURE\") { \"Green\" } else { \"Red\" } Write-Host \"PowerShell v2.0 Status: $ps2Status\" -ForegroundColor $ps2Color # Module logging kontrol $moduleLogging = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" -Name \"EnableModuleLogging\" -ErrorAction SilentlyContinue $moduleStatus = if ($moduleLogging.EnableModuleLogging -eq 1) { \"ENABLED\" } else { \"DISABLED\" } $moduleColor = if ($moduleStatus -eq \"ENABLED\") { \"Green\" } else { \"Yellow\" } Write-Host \"Module Logging: $moduleStatus\" -ForegroundColor $moduleColor # Script block logging kontrol $scriptLogging = Get-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" -Name \"EnableScriptBlockLogging\" -ErrorAction SilentlyContinue $scriptStatus = if ($scriptLogging.EnableScriptBlockLogging -eq 1) { \"ENABLED\" } else { \"DISABLED\" } $scriptColor = if ($scriptStatus -eq \"ENABLED\") { \"Green\" } else { \"Yellow\" } Write-Host \"Script Block Logging: $scriptStatus\" -ForegroundColor $scriptColor } Test-PowerShellSecurity <\/code><\/pre>\r\n<h2>T&uuml;m De\u011fi\u015fiklikleri Uygulayan Master Script<\/h2>\r\n<pre><code># Windows Server Security Hardening Master Script param( $SkipReboot, $NewAdminName = \"SystemManager\", $NewRDPPort = 6689, $NTPServers = \"time.windows.com,time.nist.gov,pool.ntp.org\" ) Write-Host \"Starting Windows Server Security Hardening...\" -ForegroundColor Green Write-Host \"=============================================\" -ForegroundColor Green # 1. Administrator Hesab\u0131n\u0131 Yeniden Adland\u0131r try { Rename-LocalUser -Name \"Administrator\" -NewName $NewAdminName Write-Host \" Administrator account renamed to: $NewAdminName\" -ForegroundColor Green } catch { Write-Host \" Failed to rename Administrator account: $($_.Exception.Message)\" -ForegroundColor Red } # 2. UAC Konfig&uuml;rasyonu try { Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"EnableLUA\" -Value 1 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"ConsentPromptBehaviorAdmin\" -Value 2 Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"FilterAdministratorToken\" -Value 1 Write-Host \" UAC configured for maximum security\" -ForegroundColor Green } catch { Write-Host \" Failed to configure UAC: $($_.Exception.Message)\" -ForegroundColor Red } # 3. Windows Firewall Sertle\u015ftirme try { Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block Set-NetFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogBlocked True Write-Host \" Windows Firewall hardened\" -ForegroundColor Green } catch { Write-Host \" Failed to configure Firewall: $($_.Exception.Message)\" -ForegroundColor Red } # 4. Otomatik Update Konfig&uuml;rasyonu try { Set-Service -Name wuauserv -StartupType Automatic Start-Service wuauserv Write-Host \" Automatic updates enabled\" -ForegroundColor Green } catch { Write-Host \" Failed to configure updates: $($_.Exception.Message)\" -ForegroundColor Red } # 5. Gereksiz Servisleri Devre D\u0131\u015f\u0131 B\u0131rak $ServicesToDisable = @(\"Spooler\", \"RemoteRegistry\", \"Fax\", \"TrkWks\") foreach ($service in $ServicesToDisable) { try { Stop-Service -Name $service -Force -ErrorAction SilentlyContinue Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue Write-Host \" Disabled service: $service\" -ForegroundColor Green } catch { Write-Host \" Service $service not found or already disabled\" -ForegroundColor Yellow } } # 6. NTP Konfig&uuml;rasyonu try { Stop-Service w32time w32tm \/config \/manualpeerlist:$NTPServers \/syncfromflags:manual \/reliable:yes \/update Start-Service w32time w32tm \/resync \/force Write-Host \" NTP configured with servers: $NTPServers\" -ForegroundColor Green } catch { Write-Host \" Failed to configure NTP: $($_.Exception.Message)\" -ForegroundColor Red } <\/code><\/pre>","excerpt":"Windows Server kurulumu tamamland\u0131ktan sonra, sunucunuzu \u00fcretime almadan \u00f6nce mutlaka de\u011fi\u015ftirmeniz gereken kritik varsay\u0131lan ayarlar vard\u0131r....","created_at":"2025-06-12 13:48:07","updated_at":"2026-09-23 10:41:49","category_id":6,"view_count":944,"reading_time":13,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:48:07","featured_image":"resimyok.jpg","slug":"kurulum-sonrasi-hemen-degistirmeniz-gereken-7-windows-server-varsayilan-ayarlari","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":52,"title":"Windows Client DNS S\u0131ralamas\u0131: Ger\u00e7ekten S\u0131ral\u0131 m\u0131 \u00c7al\u0131\u015f\u0131r?","content":"DNS (Domain Name System) \u00e7\u00f6z\u00fcmlemesi, modern bilgisayar a\u011flar\u0131n\u0131n en kritik bile\u015fenlerinden biridir. Her g\u00fcn milyarlarca DNS sorgusu yap\u0131l\u0131rken, Windows istemcilerinin bu sorgular\u0131 nas\u0131l i\u015fledi\u011fi ve DNS sunucular\u0131n\u0131 hangi s\u0131rayla kulland\u0131\u011f\u0131 konusu hem sistem y\u00f6neticileri hem de a\u011f uzmanlar\u0131 i\u00e7in kritik \u00f6neme sahiptir. Bu yaz\u0131da, Windows DNS istemcisinin davran\u0131\u015f\u0131n\u0131 derinlemesine inceleyece\u011fiz. <h2>Windows DNS \u0130stemci Davran\u0131\u015f\u0131n\u0131n Tarihsel Geli\u015fimi<\/h2> <h3>Windows XP - Windows 7 D\u00f6nemi: Basit S\u0131ral\u0131 Yakla\u015f\u0131m<\/h3> Windows'un \u00f6nceki s\u00fcr\u00fcmlerinde DNS \u00e7\u00f6z\u00fcmleme olduk\u00e7a basit bir mant\u0131\u011fa sahipti. DNS \u0130stemci Servisi (DNS Client Service), yap\u0131land\u0131r\u0131lan DNS sunucular\u0131n\u0131 belirli bir s\u0131rayla sorguluyordu. <strong>Temel \u00c7al\u0131\u015fma Prensibi:<\/strong> <ol> <li>\u0130stemci, tercih edilen a\u011f adapt\u00f6r\u00fcn\u00fcn DNS listesindeki ilk DNS sunucusuna sorgu g\u00f6nderir<\/li> <li>1 saniye i\u00e7inde yan\u0131t alamazsa, ayn\u0131 adapt\u00f6rdeki ikinci DNS sunucusunu ve di\u011fer aktif adapt\u00f6rlerdeki ilk DNS sunucular\u0131n\u0131 sorgular<\/li> <li>Bu s\u00fcre\u00e7, yan\u0131t al\u0131nana kadar artan zaman aral\u0131klar\u0131yla devam eder<\/li> <\/ol> <h3>Windows 10 ve Sonras\u0131: Paralel DNS Sorgular\u0131<\/h3> Windows 10 ile birlikte DNS \u00e7\u00f6z\u00fcmleme mekanizmas\u0131 k\u00f6kl\u00fc bir de\u011fi\u015fime u\u011frad\u0131. Microsoft, performans\u0131 art\u0131rmak i\u00e7in \"Smart Multi-Homed Name Resolution\" \u00f6zelli\u011fini tan\u0131tt\u0131. <strong>Yeni Yakla\u015f\u0131m:<\/strong> <ul> <li>DNS sorgular\u0131 paralel olarak g\u00f6nderilir<\/li> <li>\u0130lk yan\u0131t veren sunucunun cevab\u0131 kabul edilir<\/li> <li>LLMNR (Link-Local Multicast Name Resolution) ve NetBIOS sorgular\u0131 da paralel \u00e7al\u0131\u015f\u0131r<\/li> <\/ul> <h2>DNS Sunucu \u00d6ncelik Belirleme Mekanizmalar\u0131<\/h2> <h3>1. Interface Metric (Aray\u00fcz Metri\u011fi)<\/h3> Windows 10 ve sonraki s\u00fcr\u00fcmlerde, DNS \u00f6nceli\u011fi <strong>interface metric<\/strong> de\u011feri ile belirlenir: <ul> <li><strong>En d\u00fc\u015f\u00fck metric de\u011feri = En y\u00fcksek \u00f6ncelik<\/strong><\/li> <li>Her a\u011f adapt\u00f6r\u00fc i\u00e7in IPv4 ve IPv6 i\u00e7in ayr\u0131 metric de\u011ferleri bulunur<\/li> <li>DNS \u00f6nceli\u011fi i\u00e7in bu iki de\u011ferden en d\u00fc\u015f\u00fck olan\u0131 dikkate al\u0131n\u0131r<\/li> <\/ul> <strong>PowerShell ile Interface Metric Ayarlama:<\/strong> <pre><code >Set-NetIPInterface -InterfaceAlias \"Ethernet\" -AddressFamily IPv4 -InterfaceMetric 10 Set-NetIPInterface -InterfaceAlias \"Wi-Fi\" -AddressFamily IPv4 -InterfaceMetric 20 <\/code><\/pre> <h3>2. DNS Sunucu Listesi \u0130\u00e7indeki S\u0131ralama<\/h3> Ayn\u0131 a\u011f adapt\u00f6r\u00fc \u00fczerinde birden fazla DNS sunucusu tan\u0131mland\u0131\u011f\u0131nda: <strong>IPv6 \u00d6nceli\u011fi:<\/strong> Ayn\u0131 adapt\u00f6r i\u00e7inde IPv6 DNS sunucular\u0131 IPv4'ten \u00f6nce sorgulan\u0131r <strong>Sunucu S\u0131ralamas\u0131:<\/strong> DNS sunucular\u0131, TCP\/IP \u00f6zelliklerinde belirtilen s\u0131rayla sorgulan\u0131r <h2>Timeout ve Yedekleme Davran\u0131\u015f\u0131<\/h2> <h3>Tek DNS Sunucusu Senaryosu<\/h3> Yaln\u0131zca bir DNS sunucusu yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda: <ul> <li>\u0130stemci ayn\u0131 sunucuya 5 kez sorgu g\u00f6nderir<\/li> <li>Her sorguda timeout s\u00fcresi artar (1, 2, 4, 8, 16 saniye)<\/li> <li>NXDOMAIN yan\u0131t\u0131 al\u0131rsa s\u00fcre\u00e7 durur<\/li> <\/ul> <h3>Birden Fazla DNS Sunucusu Senaryosu<\/h3> Birden fazla DNS sunucusu yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda: <ul> <li>\u0130lk 3 sunucu 1'er saniye aral\u0131klarla sorgulan\u0131r<\/li> <li> <ol start=\"4\"> <li>ve sonraki sunucular en az 4 saniye gecikmeyle sorgulan\u0131r<\/li> <\/ol> <\/li> <li><strong>\u00d6nemli:<\/strong> NXDOMAIN yan\u0131t\u0131 al\u0131nd\u0131\u011f\u0131nda di\u011fer sunucular denenmez<\/li> <\/ul> <h2>Multi-Homed Sistemlerde DNS Davran\u0131\u015f\u0131<\/h2> <h3>A\u011f Adapt\u00f6r\u00fc \u00d6ncelikleri<\/h3> Birden fazla aktif a\u011f adapt\u00f6r\u00fc olan sistemlerde: <ol> <li><strong>Interface Metric<\/strong> de\u011feri en d\u00fc\u015f\u00fck olan adapt\u00f6r \u00f6nceliklidir<\/li> <li>Windows 10 \u00f6ncesi s\u00fcr\u00fcmlerde <strong>NIC Binding Order<\/strong> belirleyiciydi<\/li> <li>VPN ba\u011flant\u0131lar\u0131 genellikle en d\u00fc\u015f\u00fck metric de\u011ferine sahiptir<\/li> <\/ol> <h3>Smart Name Resolution Problemi<\/h3> Windows 10'daki ak\u0131ll\u0131 isim \u00e7\u00f6z\u00fcmleme bazen beklenmedik sonu\u00e7lar do\u011furabilir: <strong>Sorunlar:<\/strong> <ul> <li>VPN DNS'i g\u00fcvenilir \u015fekilde kullan\u0131lmayabilir<\/li> <li>DNS s\u0131z\u0131nt\u0131lar\u0131 (DNS leaks) olu\u015fabilir<\/li> <li>Split-DNS yap\u0131land\u0131rmalar\u0131 d\u00fczg\u00fcn \u00e7al\u0131\u015fmayabilir<\/li> <\/ul> <strong>\u00c7\u00f6z\u00fcm - Registry D\u00fczenlemeleri:<\/strong> <pre><code> \"DisableSmartNameResolution\"=dword:00000001 \"DisableParallelAandAAAA\"=dword:00000001 <\/code><\/pre> <h2>Ger\u00e7ek Hayat Senaryolar\u0131 ve Sorun Giderme<\/h2> <h3>Senaryo 1: Yava\u015f DNS \u00c7\u00f6z\u00fcmleme<\/h3> <strong>Problem:<\/strong> \u0130nternet eri\u015fimi olan ikinci adapt\u00f6rde DNS sorgular\u0131 10+ saniye s\u00fcr\u00fcyor <strong>\u00c7\u00f6z\u00fcm:<\/strong> <ol> <li>Root hints'leri kald\u0131r\u0131n (eri\u015filemeyen k\u00f6k sunucular i\u00e7in)<\/li> <li>Interface metric de\u011ferlerini optimize edin<\/li> <li>DNS forwarder'lar\u0131 yap\u0131land\u0131r\u0131n<\/li> <\/ol> <h3>Senaryo 2: VPN Split-DNS Sorunlar\u0131<\/h3> <strong>Problem:<\/strong> VPN ba\u011fl\u0131yken i\u00e7 domain sorgular\u0131 ba\u015far\u0131s\u0131z oluyor <strong>\u00c7\u00f6z\u00fcm:<\/strong> <ol> <li>Smart Name Resolution'\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n<\/li> <li>VPN adapt\u00f6r\u00fcne en d\u00fc\u015f\u00fck metric de\u011ferini verin<\/li> <li>Conditional forwarder'lar\u0131 kullan\u0131n<\/li> <\/ol> <h3>Senaryo 3: Domain Controller DNS Yap\u0131land\u0131rmas\u0131<\/h3> <strong>En \u0130yi Pratikler:<\/strong> <ul> <li>DC'ler kendi IP adreslerini birinci DNS olarak kullanmal\u0131<\/li> <li>\u0130kinci DNS olarak ba\u015fka bir DC'yi belirtmeli<\/li> <li>ISP DNS sunucular\u0131n\u0131 asla kullanmamal\u0131<\/li> <\/ul> <h2>\u0130leri Seviye Optimizasyon Teknikleri<\/h2> <h3>Registry Tabanl\u0131 Optimizasyonlar<\/h3> <strong>DNS Timeout De\u011ferlerini \u00d6zelle\u015ftirme:<\/strong> <pre><code> \"DNSQueryTimeouts\"=hex:01,00,00,00,02,00,00,00,04,00,00,00 <\/code><\/pre> <strong>Round Robin Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> <pre><code> \"RoundRobin\"=dword:00000000 <\/code><\/pre> <strong>Sunucu \u00d6ncelik Zaman Limiti:<\/strong> <pre><code> \"ServerPriorityTimeLimit\"=dword:00000000 <\/code><\/pre> <h3>PowerShell ile DNS Durumu \u0130zleme<\/h3> <pre><code ># DNS \u00f6ncelik s\u0131ras\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme Get-DnsClientServerAddress | Sort-Object InterfaceIndex # DNS cache temizleme Clear-DnsClientCache # DNS performans testi Resolve-DnsName google.com -Server 8.8.8.8 -DnsOnly <\/code><\/pre> <h5  >PowerShell ile DNS Cevap S\u00fcresi Testi<\/h5> <pre  data-enlighter-language=\"python\">$dnsList = @(\"10.1.1.1\", \"10.1.2.1\", \"8.8.8.8\", \"1.1.1.1\") $testDomain = \"www.microsoft.com\" foreach ($dns in $dnsList) { Write-Host \"`nTesting DNS Server: $dns\" $time = Measure-Command { try { Resolve-DnsName -Name $testDomain -Server $dns -ErrorAction Stop } catch { Write-Host \"Failed to resolve using $dns\" } } Write-Host \"Time taken: $($time.TotalMilliseconds) ms\" }<\/pre> <pre><code ><\/code><\/pre> <h5  >Netsh ile Trafik \u0130zleme<\/h5> <pre ><span  data-selectable-paragraph=\"\">netsh trace start capture=<span >yes<\/span> scenario=netconnection tracefile=c:\\temp\\dns_trace.etl <\/span><\/pre> <p   data-selectable-paragraph=\"\">\u0130lgili testleri yapt\u0131ktan sonra:<\/p> <pre ><span   data-selectable-paragraph=\"\">netsh trace <span >stop<\/span><\/span><\/pre> <h3 >Windows S\u00fcr\u00fcmlerine G\u00f6re Farkl\u0131l\u0131klar<span   data-selectable-paragraph=\"\"><\/span><\/h3> <h3>Windows Server Versions<\/h3> <ul> <li><strong>Server 2012 R2 ve \u00f6ncesi:<\/strong> Geleneksel s\u0131ral\u0131 yakla\u015f\u0131m<\/li> <li><strong>Server 2016+:<\/strong> Windows 10 benzeri paralel sorgu mekanizmas\u0131<\/li> <\/ul> <h3>Client Versions<\/h3> <ul> <li><strong>Windows 7\/8.1:<\/strong> NIC binding order tabanl\u0131<\/li> <li><strong>Windows 10\/11:<\/strong> Interface metric tabanl\u0131<\/li> <li><strong>Windows 11:<\/strong> Ek g\u00fcvenlik optimizasyonlar\u0131<\/li> <\/ul> <h2>G\u00fcvenlik ve Performans \u00d6nerileri<\/h2> <h3>G\u00fcvenlik A\u00e7\u0131s\u0131ndan<\/h3> <ol> <li><strong>DNS over HTTPS (DoH)<\/strong> kullan\u0131m\u0131n\u0131 de\u011ferlendirin<\/li> <li><strong>DNSSEC<\/strong> do\u011frulamas\u0131n\u0131 etkinle\u015ftirin<\/li> <li>G\u00fcvenilmeyen a\u011flarda DNS s\u0131z\u0131nt\u0131lar\u0131na dikkat edin<\/li> <\/ol> <h3>Performans A\u00e7\u0131s\u0131ndan<\/h3> <ol> <li><strong>Yerel DNS cache<\/strong> boyutunu optimize edin<\/li> <li><strong>Conditional forwarder'lar\u0131<\/strong> kullan\u0131n<\/li> <li><strong>DNS sunucu yan\u0131t s\u00fcrelerini<\/strong> d\u00fczenli monit\u00f6r edin<\/li> <\/ol> <h2>Sorun Giderme Ara\u00e7lar\u0131<\/h2> <h3>Komut Sat\u0131r\u0131 Ara\u00e7lar\u0131<\/h3> <pre><code ># DNS konfig\u00fcrasyonunu g\u00f6r\u00fcnt\u00fcleme ipconfig \/all # DNS cache'i temizleme ipconfig \/flushdns # DNS kayd\u0131n\u0131 yenileme ipconfig \/registerdns # DNS sorgu testi nslookup google.com <\/code><\/pre> <h3>PowerShell Ara\u00e7lar\u0131<\/h3> <pre><code ># Detayl\u0131 DNS sorgu Resolve-DnsName example.com -Type A -DnsOnly # DNS client ayarlar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme Get-DnsClient # Interface metric'lerini listeleme Get-NetIPInterface | Select InterfaceAlias,InterfaceMetric,ConnectionState <\/code><\/pre> Windows DNS istemci davran\u0131\u015f\u0131, sistem versiyonuna ba\u011fl\u0131 olarak \u00f6nemli farkl\u0131l\u0131klar g\u00f6stermektedir. Windows 10 ve sonras\u0131nda getirilen paralel sorgu mekanizmas\u0131 performans\u0131 art\u0131r\u0131rken, baz\u0131 senaryolarda beklenmedik sonu\u00e7lar do\u011furabilir. \u00d6zellikle multi-homed sistemlerde ve VPN kullan\u0131m\u0131nda bu davran\u0131\u015flar\u0131 anlamak kritiktir. <strong>Ana \u00c7\u0131kar\u0131mlar:<\/strong> <ul> <li>Modern Windows s\u00fcr\u00fcmlerinde DNS \"ger\u00e7ekten s\u0131ral\u0131\" \u00e7al\u0131\u015fmaz<\/li> <li>Interface metric de\u011feri en \u00f6nemli \u00f6ncelik fakt\u00f6r\u00fcd\u00fcr<\/li> <li>Smart Name Resolution baz\u0131 durumlarda devre d\u0131\u015f\u0131 b\u0131rak\u0131lmal\u0131d\u0131r<\/li> <li>Do\u011fru DNS yap\u0131land\u0131rmas\u0131 a\u011f performans\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde etkiler<\/li> <\/ul> Sistem y\u00f6neticilerinin bu mekanizmalar\u0131 anlamas\u0131 ve uygun optimizasyonlar\u0131 yapmas\u0131, hem g\u00fcvenlik hem de performans a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir.","excerpt":"DNS (Domain Name System) \u00e7\u00f6z\u00fcmlemesi, modern bilgisayar a\u011flar\u0131n\u0131n en kritik bile\u015fenlerinden biridir. Her g\u00fcn milyarlarca DNS sorgusu...","created_at":"2025-06-12 13:05:50","updated_at":"2026-09-06 21:22:00","category_id":6,"view_count":698,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:05:50","featured_image":"resimyok.jpg","slug":"windows-dns-istemci-davranisi-sistem-versiyonuna-bagli-olarak-onemli-farkliliklar-gostermektedir","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":74,"title":"RDP Bulmacas\u0131, Bilgisayar Korsanlar\u0131n\u0131n Kurulu\u015ftan Hassas Verileri S\u0131zd\u0131rmas\u0131na \u0130zin Veriyor","content":"Sald\u0131rganlar\u0131n, ba\u011flant\u0131lar sona erdikten \u00e7ok sonra hassas bilgileri yeniden olu\u015fturmak i\u00e7in Uzak Masa\u00fcst\u00fc Protokol\u00fc (RDP) oturumlar\u0131ndan unutulan yap\u0131tlardan yararland\u0131\u011f\u0131 yeni bir teknik. Bu teknik, ekran \u00f6\u011felerini yerel olarak k\u00fc\u00e7\u00fck d\u00f6\u015femeler olarak depolayan bir performans iyile\u015ftirme \u00f6zelli\u011fi olan RDP bitmap \u00f6nbelle\u011finden yararlan\u0131r. Statik \u00f6\u011feleri tekrar tekrar iletmek yerine \u00f6nbelle\u011fe alarak ba\u011flant\u0131 h\u0131z\u0131n\u0131 art\u0131rmak i\u00e7in tasarlanm\u0131\u015f olsa da, bu \u00f6nbelle\u011fe al\u0131nm\u0131\u015f kutucuklar oturumlar sona erdikten sonra da devam eder ve uzak etkinliklerin kas\u0131ts\u0131z bir kayd\u0131n\u0131 olu\u015fturur. Pen Test Partners, Cyber Security News'e yapt\u0131\u011f\u0131 a\u00e7\u0131klamada, \"RDP bitmap \u00f6nbelle\u011fi, uzak masa\u00fcst\u00fc etkile\u015fimlerine tan\u0131kl\u0131k ediyor ve ge\u00e7mi\u015f faaliyetler hakk\u0131nda bilgi sa\u011fl\u0131yor\" dedi. \"Bu tekni\u011fi \u00f6zellikle tehlikeli k\u0131lan \u015fey, sald\u0131rganlar\u0131n geleneksel g\u00fcnl\u00fck kayd\u0131 mekanizmalar\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131ld\u0131\u011f\u0131nda bile RDP oturumlar\u0131 s\u0131ras\u0131nda girilen kimlik bilgilerini g\u00f6r\u00fcnt\u00fcleyebilmesidir\". <strong>RDP Bitmap \u00d6nbellek Tekni\u011fi ile S\u0131zan Veriler<\/strong> Yak\u0131n tarihli bir vaka \u00e7al\u0131\u015fmas\u0131nda, Pen Test Partners, bir sald\u0131rgan\u0131n Windows Olay G\u00fcnl\u00fckleri, TerminalServices g\u00fcnl\u00fckleri ve G\u00fcvenlik olay g\u00fcnl\u00fckleri dahil olmak \u00fczere geleneksel kan\u0131tlar\u0131 kas\u0131tl\u0131 olarak sildi\u011fi bir veri ihlalini ara\u015ft\u0131rd\u0131. Bu anti-adli \u00f6nlemlere ra\u011fmen, ara\u015ft\u0131rmac\u0131lar RDP bitmap \u00f6nbellek klas\u00f6r\u00fcn\u00fcn bozulmadan kald\u0131\u011f\u0131n\u0131 ke\u015ffettiler. Ara\u015ft\u0131rmac\u0131lar, BMC-Tools ve RdpCacheStitcher gibi \u00f6zel ara\u00e7lar\u0131 kullanarak, g\u00fcvenli\u011fi ihlal edilmi\u015f sistemden 8.000'den fazla bitmap \u00f6nbellek dosyas\u0131n\u0131 ay\u0131klad\u0131lar ve yeniden olu\u015fturdular. Ortaya \u00e7\u0131kan g\u00f6r\u00fcnt\u00fcler, ke\u015fif ara\u00e7lar\u0131n\u0131n kan\u0131tlar\u0131, PowerShell komut dosyalar\u0131, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m uyar\u0131lar\u0131 ve hatta parola y\u00f6neticisi pencerelerinden a\u00e7\u0131\u011fa \u00e7\u0131kan kimlik bilgileri dahil olmak \u00fczere sald\u0131r\u0131 hakk\u0131nda kritik bilgileri ortaya \u00e7\u0131kard\u0131. <img  src=\"https:\/\/ondernet.net\/wp-content\/uploads\/2025\/05\/Screenshot_9.jpg\" alt=\"\" width=\"403\" height=\"639\" \/> Pen Test Partners ekibi, \"Yeniden yap\u0131land\u0131r\u0131lm\u0131\u015f d\u00f6\u015femeler, eri\u015filen uzak makinenin ana bilgisayar ad\u0131n\u0131 ortaya \u00e7\u0131kard\u0131 ve bu da analizimizi ikincil bir ana bilgisayara d\u00f6nd\u00fcrmemize izin verdi\" dedi. Bu at\u0131l\u0131m, sald\u0131rgan\u0131n izlerini gizleme giri\u015fimlerine ra\u011fmen t\u00fcm sald\u0131r\u0131 zincirinin yeniden yap\u0131land\u0131r\u0131lmas\u0131na yard\u0131mc\u0131 oldu. G\u00fcvenlik uzmanlar\u0131n\u0131 endi\u015felendiren \u015fey, ayn\u0131 adli bili\u015fim tekniklerinin \u015fimdi sald\u0131rganlar taraf\u0131ndan silahland\u0131r\u0131lmas\u0131d\u0131r. Bu i\u015flem, Terminal Server \u0130stemci \u00d6nbelle\u011fi dizininden \u00f6nbellek dosyalar\u0131n\u0131 ay\u0131klamay\u0131 ve anlaml\u0131 ekran i\u00e7eri\u011fini yeniden birle\u015ftirmek i\u00e7in g\u00f6rsel yerle\u015ftirme bulu\u015fsal y\u00f6ntemlerini kullanmay\u0131 i\u00e7erir. BMC-Tools, \u00f6nbellek dosyalar\u0131ndan tek tek d\u00f6\u015femeleri ay\u0131klarken, RdpCacheStitcher, tutarl\u0131 g\u00f6r\u00fcnt\u00fcleri yeniden olu\u015fturmak i\u00e7in d\u00f6\u015femeler aras\u0131ndaki kenar desenlerini ve piksel benzerliklerini kar\u015f\u0131la\u015ft\u0131ran yerle\u015ftirme algoritmalar\u0131na sahip bir grafik arabirim sa\u011flar. <blockquote>Kurulu\u015flara RDP oturumlar\u0131n\u0131n geli\u015fmi\u015f izlemesini uygulamalar\u0131, bitmap \u00f6nbelleklerini d\u00fczenli olarak temizlemeleri ve \u00f6nbellek dizinlerine ola\u011fand\u0131\u015f\u0131 eri\u015fimi alg\u0131layan otomatik ara\u00e7lar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmalar\u0131 \u00f6nerilir.<\/blockquote> <strong>G\u00fcvenlik ekipleri, RDP \u00f6nbellek analizini olay yan\u0131t\u0131 playbook'lar\u0131na da dahil etmelidir, \u00e7\u00fcnk\u00fc bu yap\u0131tlar geleneksel g\u00fcnl\u00fckler kullan\u0131lamad\u0131\u011f\u0131nda kritik kan\u0131tlar sa\u011flayabilir.<\/strong> Uzaktan \u00e7al\u0131\u015fma standart bir uygulama olmaya devam ettik\u00e7e, \u00f6zellikle sald\u0131rganlar veri h\u0131rs\u0131zl\u0131\u011f\u0131 i\u00e7in g\u00f6zden ka\u00e7an \u00f6zelliklerden yararlanmak i\u00e7in karma\u015f\u0131k y\u00f6ntemler geli\u015ftirdik\u00e7e, RDP gibi teknolojilerin g\u00fcvenlik etkilerini anlamak giderek daha \u00f6nemli hale geliyor. &nbsp; <a href=\"https:\/\/cybersecuritynews.com\/remote-desktop-puzzle\/\" target=\"_blank\" rel=\"noopener\">Haber kayna\u011f\u0131<\/a>","excerpt":"Sald\u0131rganlar\u0131n, ba\u011flant\u0131lar sona erdikten \u00e7ok sonra hassas bilgileri yeniden olu\u015fturmak i\u00e7in Uzak Masa\u00fcst\u00fc Protokol\u00fc (RDP) oturumlar\u0131ndan...","created_at":"2025-05-01 21:03:01","updated_at":"2026-09-07 13:12:55","category_id":null,"view_count":802,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-01 21:03:01","featured_image":"resimyok.jpg","slug":"rdp-bulmacasi-bilgisayar-korsanlarinin-kurulustan-hassas-verileri-sizdirmasina-izin-veriyor","category_name":null,"category_slug":null,"category_color":null},{"id":118,"title":"Terminal Server (Uzak Masa\u00fcst\u00fc Sunucusu) Kullan\u0131c\u0131 Politikalar\u0131","content":"<p class=\"ds-markdown-paragraph\"><strong>Remote Desktop Services (RDS)<\/strong>, hibrit &ccedil;al\u0131\u015fma &ccedil;a\u011f\u0131nda kurulu\u015flar\u0131n bel kemi\u011fi haline geldi. Ancak, bu g&uuml;&ccedil;l&uuml; eri\u015fim imkan\u0131 ayn\u0131 zamanda siber sald\u0131rganlar i&ccedil;in de y&uuml;ksek de\u011ferli bir hedef olu\u015fturuyor. Zay\u0131f yap\u0131land\u0131r\u0131lm\u0131\u015f bir RDS ortam\u0131, veri ihlallerine, fidye yaz\u0131l\u0131m sald\u0131r\u0131lar\u0131na ve sistem ele ge&ccedil;irmelere kar\u015f\u0131 a&ccedil;\u0131k bir kap\u0131 olabilir.<\/p>\r\n<p class=\"ds-markdown-paragraph\">Bu kapsaml\u0131 rehberde, RDS ortam\u0131n\u0131z\u0131 g&uuml;n&uuml;m&uuml;z&uuml;n karma\u015f\u0131k tehdit ortam\u0131na kar\u015f\u0131 nas\u0131l g&uuml;&ccedil;lendirece\u011finizi,&nbsp;<strong>Microsoft'un en iyi g&uuml;venlik uygulamalar\u0131n\u0131<\/strong>&nbsp;ad\u0131m ad\u0131m inceleyerek anlataca\u011f\u0131z.<\/p>\r\n<h2>1. RDS G&uuml;venlik Mimarisi: Sa\u011flam Bir Temel Olu\u015fturun<\/h2>\r\n<p class=\"ds-markdown-paragraph\">G&uuml;venlik, do\u011fru mimari ile ba\u015flar. T&uuml;m bile\u015fenleri bir araya y\u0131\u011fmak yerine, g&uuml;venli ve katmanl\u0131 bir tasar\u0131m hedefleyin.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>&Ouml;nerilen G&uuml;venli Mimari:<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>A\u011f Segmentasyonu:<\/strong>&nbsp;RDS bile\u015fenlerinizi mant\u0131ksal olarak ay\u0131r\u0131n.<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>DMZ:<\/strong>&nbsp;RD Gateway ve RD Web Access sunucular\u0131n\u0131z\u0131 buraya yerle\u015ftirin.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>\u0130&ccedil; A\u011f:<\/strong>&nbsp;RD Connection Broker, RD Session Host ve di\u011fer kritik bile\u015fenleri g&uuml;venli i&ccedil; a\u011f\u0131n\u0131zda tutun.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Y&uuml;ksek Kullan\u0131labilirlik (HA):<\/strong>&nbsp;Tek nokta ar\u0131zas\u0131n\u0131 &ouml;nleyin. RD Connection Broker ve RD Gateway i&ccedil;in y&uuml;k dengeleme (Load Balancing) ve k&uuml;meleme (Clustering) kullan\u0131n.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>G&uuml;venlik Katmanlar\u0131:<\/strong>&nbsp;\u0130nternet'ten gelen trafik, i&ccedil; a\u011fdaki oturum sunucular\u0131n\u0131za ula\u015fmadan &ouml;nce en az iki g&uuml;venlik duvar\u0131 katman\u0131ndan ge&ccedil;melidir.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2>2. A\u011f Katman\u0131nda G&uuml;venlik: \u0130lk Savunma Hatt\u0131n\u0131z<\/h2>\r\n<p class=\"ds-markdown-paragraph\">RDS'inizi internete do\u011frudan maruz b\u0131rakmay\u0131n. A\u011f seviyesindeki &ouml;nlemler, sald\u0131r\u0131 y&uuml;zeyinizi b&uuml;y&uuml;k &ouml;l&ccedil;&uuml;de azalt\u0131r.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. Network Level Authentication (NLA) - Zorunlu K\u0131l\u0131n!<\/strong><br>NLA, bir RDP oturumu ba\u015flat\u0131lmadan &ouml;nce kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frular. Bu, hizmet reddi (DoS) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 kritik bir korumad\u0131r.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>PowerShell ile NLA'y\u0131 Etkinle\u015ftirme:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token function\">Set-ItemProperty<\/span> <span class=\"token operator\">-<\/span>Path <span class=\"token string\">'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp'<\/span> <span class=\"token operator\">-<\/span>name <span class=\"token string\">\"UserAuthentication\"<\/span> <span class=\"token operator\">-<\/span>Value 1<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. Varsay\u0131lan RDP Portunu De\u011fi\u015ftirin<\/strong><br>Otomatik taray\u0131c\u0131lar\u0131n hedefi olmamak i&ccedil;in varsay\u0131lan 3389 TCP portunu de\u011fi\u015ftirin.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>PowerShell ile RDP Portu De\u011fi\u015ftirme:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token function\">Set-ItemProperty<\/span> <span class=\"token operator\">-<\/span>Path <span class=\"token string\">'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp'<\/span> <span class=\"token operator\">-<\/span>name <span class=\"token string\">\"PortNumber\"<\/span> <span class=\"token operator\">-<\/span>Value 9876\r\n<span class=\"token function\">New-NetFirewallRule<\/span> <span class=\"token operator\">-<\/span>DisplayName <span class=\"token string\">\"RDP Custom Port\"<\/span> <span class=\"token operator\">-<\/span>Direction Inbound <span class=\"token operator\">-<\/span>Protocol TCP <span class=\"token operator\">-<\/span>LocalPort 9876 <span class=\"token operator\">-<\/span>Action Allow<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\"><strong>C. IP K\u0131s\u0131tlamalar\u0131 Getirin<\/strong><br>RD Gateway &uuml;zerinden sadece belirli IP aral\u0131klar\u0131n\u0131n (&ouml;rne\u011fin, \u015firket VPN'iniz) ba\u011flanmas\u0131na izin verin.<\/p>\r\n<h2>3. Kimlik Do\u011frulama ve Yetkilendirme: Kale Kap\u0131lar\u0131n\u0131z\u0131 G&uuml;&ccedil;lendirin<\/h2>\r\n<p class=\"ds-markdown-paragraph\">Zay\u0131f kimlik bilgileri, g&uuml;venli\u011fin en b&uuml;y&uuml;k d&uuml;\u015fman\u0131d\u0131r. Burada kat\u0131 olun.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. &Ccedil;ok Fakt&ouml;rl&uuml; Kimlik Do\u011frulama (MFA) \u015eart!<\/strong><br>MFA, RDS g&uuml;venli\u011finizde yapabilece\u011finiz en kritik iyile\u015ftirmelerden biridir.&nbsp;<strong>Azure AD MFA<\/strong>&nbsp;veya&nbsp;<strong>RD Gateway<\/strong>&nbsp;ile entegre olan &uuml;&ccedil;&uuml;nc&uuml; taraf &ccedil;&ouml;z&uuml;mler (Duo Security gibi) kullan\u0131n.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. G&uuml;&ccedil;l&uuml; Parola Politikalar\u0131 Uygulay\u0131n<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Minimum 14 karakter.<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Karma\u015f\u0131kl\u0131k gerektirin<\/strong>&nbsp;(B&uuml;y&uuml;k\/k&uuml;&ccedil;&uuml;k harf, say\u0131, &ouml;zel karakter).<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Parola ge&ccedil;mi\u015fini hat\u0131rla<\/strong>&nbsp;(24) ve&nbsp;<strong>90 g&uuml;nde bir de\u011fi\u015ftirme<\/strong>&nbsp;zorunlulu\u011fu getirin.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p class=\"ds-markdown-paragraph\"><strong>PowerShell ile Parola Politikas\u0131:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token variable\">$domain<\/span> = <span class=\"token function\">Get-ADDomain<\/span>\r\n<span class=\"token function\">Set-ADDefaultDomainPasswordPolicy<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$domain<\/span><span class=\"token punctuation\">.<\/span>DNSRoot <span class=\"token operator\">-<\/span>ComplexityEnabled <span class=\"token boolean\">$true<\/span> <span class=\"token operator\">-<\/span>MinPasswordLength 14 <span class=\"token operator\">-<\/span>PasswordHistoryCount 24 <span class=\"token operator\">-<\/span>MaxPasswordAge 90<span class=\"token punctuation\">.<\/span>00:00:00 <span class=\"token operator\">-<\/span>MinPasswordAge 1<span class=\"token punctuation\">.<\/span>00:00:00 <span class=\"token operator\">-<\/span>LockoutThreshold 5<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\"><strong>C. Ayr\u0131cal\u0131kl\u0131 Eri\u015fimi Y&ouml;netin (PAM)<\/strong><br>Y&ouml;netici hesaplar\u0131 i&ccedil;in \"tam zaman\u0131nda\" (Just-In-Time) eri\u015fim prensibini uygulay\u0131n. Kullan\u0131c\u0131lar\u0131n sadece ihtiya&ccedil; duyduklar\u0131 anda ve sadece ihtiya&ccedil; duyduklar\u0131 s&uuml;re boyunca y&ouml;netici ayr\u0131cal\u0131klar\u0131na sahip olmas\u0131n\u0131 sa\u011flay\u0131n.<\/p>\r\n<h2>4. Eri\u015fim Kontrol&uuml;: \"En Az Ayr\u0131cal\u0131k\" \u0130lkesini Benimseyin<\/h2>\r\n<p class=\"ds-markdown-paragraph\">Bir kullan\u0131c\u0131 veya uygulama, sadece g&ouml;revini yapmak i&ccedil;in ihtiya&ccedil; duydu\u011fu izinlere sahip olmal\u0131d\u0131r.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. Rol Tabanl\u0131 Eri\u015fim Kontrol&uuml; (RBAC)<\/strong><br>\"RDS Y&ouml;neticisi\" gibi geni\u015f roller atamak yerine, \"Yard\u0131m Masas\u0131\" (sadece oturumu sonland\u0131rabilir) veya \"Uygulama Yay\u0131nc\u0131s\u0131\" gibi &ouml;zelle\u015ftirilmi\u015f roller olu\u015fturun.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. Oturum K\u0131s\u0131tlamalar\u0131 Koyun<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Bo\u015fta kalma s&uuml;resi:<\/strong>&nbsp;30 dakika sonra oturumu sonland\u0131r\u0131n.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Ba\u011flant\u0131s\u0131 kesilmi\u015f oturum s&uuml;resi:<\/strong>&nbsp;60 dakika sonra sonland\u0131r\u0131n.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>E\u015fzamanl\u0131 oturum say\u0131s\u0131:<\/strong>&nbsp;Kullan\u0131c\u0131 ba\u015f\u0131na maksimum oturum say\u0131s\u0131n\u0131 s\u0131n\u0131rlay\u0131n.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p class=\"ds-markdown-paragraph\"><strong>PowerShell ile Oturum K\u0131s\u0131tlamalar\u0131:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token function\">Set-RDSessionCollectionConfiguration<\/span> <span class=\"token operator\">-<\/span>CollectionName <span class=\"token string\">\"MyCollection\"<\/span> <span class=\"token operator\">-<\/span>IdleSessionLimitMin 30 <span class=\"token operator\">-<\/span>DisconnectedSessionLimitMin 60 <span class=\"token operator\">-<\/span>MaxSessionLimit 3<\/pre>\r\n<\/div>\r\n<h2>5. \u015eifreleme ve Veri G&uuml;venli\u011fi: Verilerinizi Koruyun<\/h2>\r\n<p class=\"ds-markdown-paragraph\">Veriler hem yolda (a\u011f &uuml;zerinde) hem de yatarken (disk &uuml;zerinde) \u015fifrelenmelidir.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. TLS 1.2+ Kullan\u0131n<\/strong><br>RDS bile\u015fenleri aras\u0131ndaki t&uuml;m ileti\u015fim, g&uuml;venli TLS 1.2 veya &uuml;zeri bir s&uuml;r&uuml;mle \u015fifrelenmelidir. Eski ve g&uuml;vensiz SSL\/TLS s&uuml;r&uuml;mlerini (1.0, 1.1) devre d\u0131\u015f\u0131 b\u0131rak\u0131n.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. G&uuml;venilir Sertifikalar Kullan\u0131n<\/strong><br>RD Gateway, RD Web Access gibi bile\u015fenler i&ccedil;in otomatik olarak olu\u015fturulan kendinden imzal\u0131 sertifikalar yerine, g&uuml;venilir bir Sertifika Otoritesi'nden (CA) al\u0131nm\u0131\u015f sertifikalar kullan\u0131n.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>C. Disk \u015eifrelemesi Uygulay\u0131n<\/strong><br>Oturum sunucular\u0131n\u0131z\u0131n i\u015fletim sistemi disklerini&nbsp;<strong>BitLocker<\/strong>&nbsp;ile \u015fifreleyin. Bu, fiziksel eri\u015fim veya disk h\u0131rs\u0131zl\u0131\u011f\u0131 durumunda verilerinizi korur.<\/p>\r\n<h2>6. \u0130zleme ve Denetim: G&ouml;r&uuml;n&uuml;rl&uuml;\u011f&uuml;n&uuml;z&uuml; Art\u0131r\u0131n<\/h2>\r\n<p class=\"ds-markdown-paragraph\">Sald\u0131r\u0131y\u0131 &ouml;nleyemezseniz bile, onu h\u0131zl\u0131ca tespit edip m&uuml;dahale edebilmelisiniz.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. Kapsaml\u0131 G&uuml;nl&uuml;kleme (Logging) Yap\u0131n<\/strong><br>T&uuml;m RDS bile\u015fenlerinde (Gateway, Session Host, Connection Broker) ba\u015far\u0131l\u0131\/ba\u015far\u0131s\u0131z oturum a&ccedil;ma, oturum kapatma ve hesap kilitleme olaylar\u0131n\u0131 kaydedin. Bu g&uuml;nl&uuml;kleri merkezi bir&nbsp;<strong>SIEM<\/strong>&nbsp;sistemine (&ouml;rne\u011fin, Azure Sentinel, Splunk) y&ouml;nlendirin.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>PowerShell ile Geli\u015fmi\u015f Denetim:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>auditpol<span class=\"token punctuation\">.<\/span>exe <span class=\"token operator\">\/<\/span><span class=\"token function\">set<\/span> <span class=\"token operator\">\/<\/span>subcategory:<span class=\"token string\">\"Logon\"<\/span> <span class=\"token operator\">\/<\/span>success:enable <span class=\"token operator\">\/<\/span>failure:enable\r\nauditpol<span class=\"token punctuation\">.<\/span>exe <span class=\"token operator\">\/<\/span><span class=\"token function\">set<\/span> <span class=\"token operator\">\/<\/span>subcategory:<span class=\"token string\">\"Logoff\"<\/span> <span class=\"token operator\">\/<\/span>success:enable <span class=\"token operator\">\/<\/span>failure:enable<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. Anormal Davran\u0131\u015flar\u0131 Tespit Edin<\/strong><br>SIEM sisteminizde, a\u015fa\u011f\u0131dakileri tespit eden kurallar olu\u015fturun:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Ayn\u0131 kullan\u0131c\u0131dan farkl\u0131 co\u011frafi konumlardan k\u0131sa s&uuml;reli art arda ba\u011flant\u0131lar.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Normal &ccedil;al\u0131\u015fma saatleri d\u0131\u015f\u0131ndaki y&ouml;netici eri\u015fimleri.<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">&Ccedil;ok say\u0131da ba\u015far\u0131s\u0131z oturum a&ccedil;ma denemesi (Brute-Force sald\u0131r\u0131s\u0131 g&ouml;stergesi).<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2>7. \u0130\u015fletim Sistemi ve Uygulama G&uuml;venli\u011fi: Platformu S\u0131k\u0131la\u015ft\u0131r\u0131n<\/h2>\r\n<p class=\"ds-markdown-paragraph\"><strong>A. G&uuml;ncel Yamalar\u0131 Aksatmay\u0131n<\/strong><br>T&uuml;m RDS sunucular\u0131n\u0131z i&ccedil;in acil bir yama y&ouml;netim politikas\u0131 uygulay\u0131n. Kritik g&uuml;venlik g&uuml;ncellemelerini m&uuml;mk&uuml;n olan en k\u0131sa s&uuml;rede (test sonras\u0131) da\u011f\u0131t\u0131n.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>B. S\u0131k\u0131la\u015ft\u0131rma (Hardening) Yap\u0131n<\/strong><br><strong>CIS (Center for Internet Security)<\/strong>&nbsp;k\u0131lavuzlar\u0131n\u0131 veya&nbsp;<strong>Microsoft G&uuml;venlik Temelleri'ni<\/strong>&nbsp;temel alarak sunucular\u0131n\u0131z\u0131 yap\u0131land\u0131r\u0131n. Gereksiz Windows servislerini ve &ouml;zellikleri kapat\u0131n.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>C. Uygulama Kontrolleri Uygulay\u0131n<\/strong><br><strong>AppLocker<\/strong>&nbsp;veya&nbsp;<strong>Windows Defender Application Control (WDAC)<\/strong>&nbsp;kullanarak, sadece onaylad\u0131\u011f\u0131n\u0131z uygulamalar\u0131n RDS oturumlar\u0131nda &ccedil;al\u0131\u015fmas\u0131na izin verin. Bu, zararl\u0131 yaz\u0131l\u0131mlar\u0131n y&uuml;r&uuml;t&uuml;lmesini engellemede &ccedil;ok etkilidir.<\/p>\r\n<h2>8. Kapsaml\u0131 RDS G&uuml;venlik Kontrol Listesi<\/h2>\r\n<p class=\"ds-markdown-paragraph\">A\u015fa\u011f\u0131daki kontrol listesini, RDS g&uuml;venlik duru\u015funuzu de\u011ferlendirmek i&ccedil;in kullan\u0131n.<\/p>\r\n<div class=\"ds-scroll-area _1210dd7\">\r\n<div class=\"ds-scroll-area__gutters\">\r\n<div class=\"ds-scroll-area__horizontal-gutter\">&nbsp;<\/div>\r\n<div class=\"ds-scroll-area__vertical-gutter\">&nbsp;<\/div>\r\n<\/div>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>Seviye<\/th>\r\n<th>Kontrol Noktas\u0131<\/th>\r\n<th>Durum (\u2713\/\u2717)<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>Temel<\/strong><\/td>\r\n<td>NLA (Network Level Authentication) Etkin<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Varsay\u0131lan RDP Portu (3389) De\u011fi\u015ftirildi<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>T&uuml;m Bile\u015fenlerde TLS 1.2+ Zorunlu<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>G&uuml;&ccedil;l&uuml; Parola Politikas\u0131 Aktif<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Otomatik G&uuml;ncellemeler ve Yamalar Etkin<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Orta<\/strong><\/td>\r\n<td>&Ccedil;ok Fakt&ouml;rl&uuml; Kimlik Do\u011frulama (MFA) Uyguland\u0131<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>RD Gateway ile G&uuml;venli \u0130nternet Eri\u015fimi Sa\u011fland\u0131<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>A\u011f Segmentasyonu ve G&uuml;venlik Duvarlar\u0131 Yap\u0131land\u0131r\u0131ld\u0131<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>AppLocker\/WDAC ile Uygulama Kontrol&uuml; Sa\u011fland\u0131<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Merkezi G&uuml;nl&uuml;k Toplama (SIEM) Aktif<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Oturum K\u0131s\u0131tlamalar\u0131 (S&uuml;re, E\u015fzamanl\u0131 Oturum) Tan\u0131mland\u0131<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>\u0130leri<\/strong><\/td>\r\n<td>Ayr\u0131cal\u0131kl\u0131 Eri\u015fim Y&ouml;netimi (PAM\/JIT) Uygulan\u0131yor<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>SIEM ile Anormal Davran\u0131\u015f Alg\u0131lama Kurallar\u0131 &Ccedil;al\u0131\u015f\u0131yor<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>D&uuml;zenli S\u0131zma Testleri ve G&uuml;venlik Denetimleri Yap\u0131l\u0131yor<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Veri Kayb\u0131 &Ouml;nleme (DLP) &Ccedil;&ouml;z&uuml;mleri Entegre Edildi<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&nbsp;<\/td>\r\n<td>Ko\u015fullu Eri\u015fim Politikalar\u0131 ile Risk Bazl\u0131 Kimlik Do\u011frulama<\/td>\r\n<td>&nbsp;<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\">Microsoft RDS g&uuml;venli\u011fi, \"bir kere yap\u0131l\u0131p unutulacak\" bir proje de\u011fil, s&uuml;rekli bir s&uuml;re&ccedil;tir. Bu rehberde &ouml;zetlenen katmanl\u0131 yakla\u015f\u0131m\u0131 benimseyerek, kurumsal uzak eri\u015fim altyap\u0131n\u0131z\u0131n g&uuml;venlik seviyesini &ouml;nemli &ouml;l&ccedil;&uuml;de art\u0131rabilir, kullan\u0131c\u0131lar\u0131n\u0131za hem &uuml;retken hem de g&uuml;venli bir &ccedil;al\u0131\u015fma ortam\u0131 sunabilirsiniz.<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>Unutmay\u0131n:<\/strong>&nbsp;G&uuml;venlik, en zay\u0131f halkan\u0131z kadar g&uuml;&ccedil;l&uuml;d&uuml;r. D&uuml;zenli olarak kontrollerinizi g&ouml;zden ge&ccedil;irin, g&uuml;ncel tehditlere kar\u015f\u0131 haz\u0131rl\u0131kl\u0131 olun ve g&uuml;venlik k&uuml;lt&uuml;r&uuml;n&uuml;z&uuml; s&uuml;rekli geli\u015ftirin.<\/p>\r\n<hr>\r\n<p class=\"ds-markdown-paragraph\"><em>Not: Bu blog yaz\u0131s\u0131 genel bilgi ve rehberlik amac\u0131yla haz\u0131rlanm\u0131\u015ft\u0131r. T&uuml;m g&uuml;venlik ayarlar\u0131n\u0131 uygulamadan &ouml;nce bir test ortam\u0131nda do\u011frulama yapman\u0131z ve kurulu\u015funuza &ouml;zg&uuml; gereksinimleri ve uyumluluk kurallar\u0131n\u0131 g&ouml;z &ouml;n&uuml;nde bulundurman\u0131z &ouml;nemle tavsiye edilir.<\/em><\/p>","excerpt":"Microsoft RDS Security Best Practices: G\u00fcvenli Uzak Masa\u00fcst\u00fc Hizmetleri Gerekli Politikalar \u0130\u00e7indekiler 1. (giri\u015f) 2. (rds-g\u00fcvenlik-mimarisi)...","created_at":"2025-04-14 01:56:57","updated_at":"2026-09-23 14:45:53","category_id":6,"view_count":802,"reading_time":9,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-04-14 01:56:57","featured_image":"resimyok.jpg","slug":"terminal-server-uzak-masaustu-sunucusu-kullanici-politikalari","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":122,"title":"Windows Server Evaluation S\u00fcresini Uzatma","content":"Windows Server de\u011ferlendirme s\u00fcr\u00fcmlerinin sa\u011flad\u0131\u011f\u0131 ge\u00e7ici lisans, test ortamlar\u0131 olu\u015fturma, yeni \u00f6zellikleri ke\u015ffetme veya e\u011fitim ama\u00e7lar\u0131 i\u00e7in m\u00fckemmel bir f\u0131rsatt\u0131r. Ancak, standart 180 g\u00fcnl\u00fck de\u011ferlendirme s\u00fcresi bazen projeleriniz veya \u00f6\u011frenme s\u00fcreciniz i\u00e7in yeterli olmayabilir. Bu rehberde, Windows Server de\u011ferlendirme s\u00fcresini yasal s\u0131n\u0131rlar i\u00e7inde nas\u0131l uzatabilece\u011finizi, dikkat edilmesi gereken hususlar\u0131 ve alternatif \u00e7\u00f6z\u00fcmleri detayl\u0131 olarak ele alaca\u011f\u0131z. <h2>\u0130\u00e7indekiler<\/h2> <ol> <li>Windows Server De\u011ferlendirme S\u00fcr\u00fcm\u00fc Nedir?<\/li> <li>De\u011ferlendirme S\u00fcresini Kontrol Etme<\/li> <li>De\u011ferlendirme S\u00fcresini Uzatma Y\u00f6ntemleri <ul> <li>Y\u00f6ntem 1: Rearm Komutu ile Uzatma<\/li> <li>Y\u00f6ntem 2: DISM Komutu Kullan\u0131m\u0131<\/li> <li>Y\u00f6ntem 3: Registry D\u00fczenlemeleri<\/li> <\/ul> <\/li> <li>S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/li> <li>De\u011ferlendirme S\u00fcresi Sonras\u0131 Se\u00e7enekler<\/li> <li>Yasal Hususlar ve Lisanslama Bilgileri<\/li> <li>Alternatif \u00c7\u00f6z\u00fcmler<\/li> <li>Sonu\u00e7<\/li> <\/ol> <h2>Windows Server De\u011ferlendirme S\u00fcr\u00fcm\u00fc Nedir?<\/h2> Windows Server de\u011ferlendirme s\u00fcr\u00fcm\u00fc, Microsoft'un sundu\u011fu \u00fccretsiz ve tam \u00f6zellikli bir Windows Server s\u00fcr\u00fcm\u00fcd\u00fcr. Bu s\u00fcr\u00fcm, i\u015fletmelerin ve BT profesyonellerinin sat\u0131n alma karar\u0131 vermeden \u00f6nce Windows Server'\u0131n t\u00fcm \u00f6zelliklerini test etmelerine olanak tan\u0131r. Standart olarak 180 g\u00fcn (6 ay) boyunca kullan\u0131labilir. <strong>De\u011ferlendirme S\u00fcr\u00fcm\u00fcn\u00fcn \u00d6zellikleri:<\/strong> <ul> <li>Tam \u00f6zellik seti (Datacenter s\u00fcr\u00fcm\u00fc \u00f6zellikleri dahil)<\/li> <li>180 g\u00fcnl\u00fck lisans s\u00fcresi<\/li> <li>Herhangi bir \u00fcr\u00fcn anahtar\u0131 olmadan kurulum<\/li> <li>Grafiksel Kullan\u0131c\u0131 Aray\u00fcz\u00fc (GUI) veya Core kurulum se\u00e7enekleri<\/li> <li>Windows Update ve g\u00fcvenlik g\u00fcncelle\u015ftirmelerine eri\u015fim<\/li> <\/ul> <strong>Kullan\u0131m Senaryolar\u0131:<\/strong> <ul> <li>Test ve geli\u015ftirme ortamlar\u0131<\/li> <li>E\u011fitim ve \u00f6\u011frenme ama\u00e7lar\u0131<\/li> <li>Proof of Concept (PoC) projeleri<\/li> <li>Windows Server \u00f6zelliklerini de\u011ferlendirme<\/li> <\/ul> <h2>De\u011ferlendirme S\u00fcresini Kontrol Etme<\/h2> Windows Server de\u011ferlendirme s\u00fcr\u00fcm\u00fcn\u00fcz\u00fcn kalan s\u00fcresini kontrol etmek i\u00e7in a\u015fa\u011f\u0131daki y\u00f6ntemleri kullanabilirsiniz: <h3>Komut Sat\u0131r\u0131 ile Kontrol<\/h3> <ol> <li><strong>Y\u00f6netici olarak Komut \u0130stemi (CMD) a\u00e7\u0131n<\/strong><\/li> <li>A\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/li> <\/ol> <pre><code >slmgr \/dlv <\/code><\/pre> Bu komut, lisans bilgilerini ve kalan de\u011ferlendirme s\u00fcresini g\u00f6steren bir pencere a\u00e7acakt\u0131r. <h3>PowerShell ile Kontrol<\/h3> <pre><code >(Get-WmiObject -class SoftwareLicensingProduct -filter \"Name like 'Windows%'\" | Where-Object { $_.LicenseStatus -eq 1 }).Description <\/code><\/pre> Bu komut, aktif lisans t\u00fcr\u00fcn\u00fc ve durumunu g\u00f6sterecektir. <h3>Sistem \u00d6zelliklerinden Kontrol<\/h3> <ol> <li><strong>Dosya Gezgini<\/strong>'ni a\u00e7\u0131n<\/li> <li><strong>Bu Bilgisayar<\/strong>'a sa\u011f t\u0131klay\u0131n<\/li> <li><strong>\u00d6zellikler<\/strong>'i se\u00e7in<\/li> <li>Pencerede lisans bilgileri ve kalan s\u00fcre g\u00f6r\u00fcnt\u00fclenecektir<\/li> <\/ol> <h2>De\u011ferlendirme S\u00fcresini Uzatma Y\u00f6ntemleri<\/h2> Windows Server de\u011ferlendirme s\u00fcresini uzatmak i\u00e7in kullanabilece\u011finiz birka\u00e7 y\u00f6ntem bulunmaktad\u0131r. Bu y\u00f6ntemler, Microsoft'un belirledi\u011fi s\u0131n\u0131rlar dahilinde sistemin yeniden etkinle\u015ftirilmesini sa\u011flar. <h3>Y\u00f6ntem 1: Rearm Komutu ile Uzatma<\/h3> \"Rearm\" komutu, Windows aktivasyon sistemini s\u0131f\u0131rlar ve de\u011ferlendirme s\u00fcresini yeniler. Windows Server'da rearm i\u015flemi en fazla 5 kez uygulanabilir, b\u00f6ylece toplam de\u011ferlendirme s\u00fcresi 180 + (5 x 180) = 1080 g\u00fcn (yakla\u015f\u0131k 3 y\u0131l) olabilir. <strong>Ad\u0131mlar:<\/strong> <ol> <li><strong>Y\u00f6netici olarak Komut \u0130stemi (CMD) a\u00e7\u0131n<\/strong><\/li> <li>A\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/li> <\/ol> <pre><code >slmgr \/rearm <\/code><\/pre> <ol start=\"3\"> <li>Sistemin yeniden ba\u015flat\u0131lmas\u0131 gerekecektir:<\/li> <\/ol> <pre><code >shutdown \/r \/t 0 <\/code><\/pre> <strong>Not:<\/strong> Her bir rearm i\u015flemi sonras\u0131 sistem yeniden ba\u015flat\u0131lmal\u0131d\u0131r. Kalan rearm say\u0131s\u0131n\u0131 kontrol etmek i\u00e7in: <pre><code >slmgr \/dlv <\/code><\/pre> \u00c7\u0131kt\u0131da \"Remaining Windows rearm count\" de\u011feri g\u00f6r\u00fcnecektir. <h3>Y\u00f6ntem 2: DISM Komutu Kullan\u0131m\u0131<\/h3> DISM (Deployment Image Servicing and Management) arac\u0131, \u00f6zellikle de\u011ferlendirme s\u00fcresi dolan veya rearm say\u0131s\u0131 t\u00fckenen sistemlerde faydal\u0131 olabilir. <strong>Ad\u0131mlar:<\/strong> <ol> <li><strong>Y\u00f6netici olarak Komut \u0130stemi (CMD) a\u00e7\u0131n<\/strong><\/li> <li>A\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/li> <\/ol> <pre><code >DISM \/online \/Get-CurrentEdition <\/code><\/pre> Bu komut mevcut Windows s\u00fcr\u00fcm\u00fcn\u00fc g\u00f6sterecektir. <ol start=\"3\"> <li>Ard\u0131ndan, s\u00fcreyi uzatmak i\u00e7in:<\/li> <\/ol> <pre><code >DISM \/online \/Set-Edition:&lt;edition&gt; \/ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX \/AcceptEula <\/code><\/pre> <code>&lt;edition&gt;<\/code> k\u0131sm\u0131na mevcut s\u00fcr\u00fcm\u00fcn\u00fcz\u00fc (\u00f6rn. ServerDatacenterEval) yazmal\u0131s\u0131n\u0131z. <strong>Not:<\/strong> Bu y\u00f6ntem genellikle de\u011ferlendirme s\u00fcr\u00fcm\u00fcnden tam s\u00fcr\u00fcme ge\u00e7mek i\u00e7in kullan\u0131l\u0131r, ancak yeni bir de\u011ferlendirme \u00fcr\u00fcn anahtar\u0131 ile de s\u00fcreyi uzatabilir. <h3>Y\u00f6ntem 3: Registry D\u00fczenlemeleri<\/h3> <strong>Uyar\u0131:<\/strong> Registry d\u00fczenlemeleri riskli olabilir ve sistem kararl\u0131l\u0131\u011f\u0131n\u0131 etkileyebilir. Bu y\u00f6ntemi kullanmadan \u00f6nce mutlaka sistem yede\u011fi al\u0131n. <strong>Ad\u0131mlar:<\/strong> <ol> <li><strong>Y\u00f6netici olarak Regedit'i a\u00e7\u0131n<\/strong> (Windows + R tu\u015flar\u0131na bas\u0131n, \"regedit\" yaz\u0131n ve Enter'a bas\u0131n)<\/li> <li>A\u015fa\u011f\u0131daki registry yoluna gidin:<\/li> <\/ol> <pre><code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform <\/code><\/pre> <ol start=\"3\"> <li>\"SkipRearm\" adl\u0131 bir DWORD (32-bit) de\u011feri olu\u015fturun (yoksa) ve de\u011ferini 1 olarak ayarlay\u0131n<\/li> <li>Ard\u0131ndan komut isteminde rearm komutunu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/li> <\/ol> <pre><code >slmgr \/rearm <\/code><\/pre> <ol start=\"5\"> <li>Sistemi yeniden ba\u015flat\u0131n<\/li> <\/ol> <strong>Not:<\/strong> Bu y\u00f6ntem, standart rearm say\u0131s\u0131n\u0131 a\u015fman\u0131za olanak tan\u0131r, ancak her zaman \u00e7al\u0131\u015fmayabilir ve Microsoft politikalar\u0131na ayk\u0131r\u0131 olabilir. <h2>S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h2> <h3>Sorun 1: \"Kalan rearm say\u0131s\u0131 0\" hatas\u0131<\/h3> <strong>\u00c7\u00f6z\u00fcm:<\/strong> <ul> <li>Bir sistem geri y\u00fckleme noktas\u0131na d\u00f6nmeyi deneyin (e\u011fer olu\u015fturduysan\u0131z)<\/li> <li>Registry d\u00fczenlemesi y\u00f6ntemini deneyin (Y\u00f6ntem 3)<\/li> <li>Son \u00e7are olarak, sanal makinede ise yeni bir de\u011ferlendirme s\u00fcr\u00fcm\u00fc kurun<\/li> <\/ul> <h3>Sorun 2: \"Slmgr komutlar\u0131 \u00e7al\u0131\u015fm\u0131yor\" hatas\u0131<\/h3> <strong>\u00c7\u00f6z\u00fcm:<\/strong> <ul> <li>Komut istemini y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun<\/li> <li>Tam yol kullanmay\u0131 deneyin: <code>cscript %windir%\\system32\\slmgr.vbs \/dlv<\/code><\/li> <li>Windows Modules Installer servisinin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 kontrol edin<\/li> <\/ul> <h3>Sorun 3: Rearm sonras\u0131 aktivasyon durumu de\u011fi\u015fmedi<\/h3> <strong>\u00c7\u00f6z\u00fcm:<\/strong> <ul> <li>Sistemi yeniden ba\u015flatt\u0131\u011f\u0131n\u0131zdan emin olun<\/li> <li>Windows Update'i kontrol edin ve g\u00fcncellemeleri y\u00fckleyin<\/li> <li>SoftwareProtectionService'i yeniden ba\u015flat\u0131n: <pre><code >net stop sppsvcnet start sppsvc <\/code><\/pre> <\/li> <\/ul> <h2>De\u011ferlendirme S\u00fcresi Sonras\u0131 Se\u00e7enekler<\/h2> T\u00fcm de\u011ferlendirme s\u00fcresi uzatma se\u00e7eneklerini t\u00fckettikten sonra \u015fu alternatifleri de\u011ferlendirebilirsiniz: <h3>1. Tam Lisans Sat\u0131n Alma<\/h3> En do\u011fru ve yasal \u00e7\u00f6z\u00fcm, ihtiya\u00e7lar\u0131n\u0131za uygun bir Windows Server lisans\u0131 sat\u0131n almakt\u0131r. Microsoft'un lisanslama se\u00e7enekleri hakk\u0131nda bilgi i\u00e7in <a href=\"https:\/\/www.microsoft.com\/licensing\/\">Microsoft Lisanslama Sayfas\u0131<\/a>'n\u0131 ziyaret edebilirsiniz. <h3>2. Microsoft De\u011ferlendirme Merkezi (Evaluation Center)<\/h3> Microsoft De\u011ferlendirme Merkezi, yeni bir de\u011ferlendirme s\u00fcr\u00fcm\u00fcn\u00fc indirebilece\u011finiz resmi kaynakt\u0131r. Yeni bir de\u011ferlendirme s\u00fcr\u00fcm\u00fc kurarak testi devam ettirebilirsiniz. <a href=\"https:\/\/www.microsoft.com\/evalcenter\/\">Microsoft Evaluation Center<\/a> <h3>3. Visual Studio Aboneli\u011fi<\/h3> Visual Studio aboneleri, geli\u015ftirme ve test ama\u00e7l\u0131 kullan\u0131m i\u00e7in \u00fccretsiz Windows Server lisanslar\u0131 alabilirler. Profesyonel bir geli\u015ftirici iseniz, bu se\u00e7enek maliyet-etkin olabilir. <h3>4. Azure DevTest Labs<\/h3> Azure DevTest Labs, test ve geli\u015ftirme ama\u00e7l\u0131 ortamlar olu\u015fturmak i\u00e7in kullan\u0131labilir. Azure kredileri veya pay-as-you-go fiyatland\u0131rma ile Windows Server'\u0131 bulutta \u00e7al\u0131\u015ft\u0131rabilirsiniz. &nbsp; <strong>\u00d6nemli Not:<\/strong> De\u011ferlendirme s\u00fcr\u00fcmlerinin s\u00fcresi doldu\u011funda, sistem her bir saatte otomatik olarak kapanmaya ba\u015flar ve g\u00fcvenlik g\u00fcncelle\u015ftirmeleri almayabilir. Bu durum, \u00f6zellikle \u00fcretim ortamlar\u0131 i\u00e7in g\u00fcvenlik riskleri olu\u015fturabilir. <h3>Windows Server i\u00e7in Uygun Maliyetli Alternatifler<\/h3> D\u00fc\u015f\u00fck b\u00fct\u00e7eli projeler veya e\u011fitim ama\u00e7lar\u0131 i\u00e7in a\u015fa\u011f\u0131daki alternatifleri de\u011ferlendirebilirsiniz: <ol> <li><strong>Microsoft Hyper-V Server<\/strong> <ul> <li>\u00dccretsiz bir hiperviz\u00f6r \u00e7\u00f6z\u00fcm\u00fcd\u00fcr<\/li> <li>Windows Server'\u0131n tam grafik aray\u00fcz\u00fcn\u00fc i\u00e7ermez, ancak sanalla\u015ft\u0131rma \u00f6zellikleri sunar<\/li> <\/ul> <\/li> <li><strong>Windows Server Essentials<\/strong> <ul> <li>K\u00fc\u00e7\u00fck i\u015fletmeler i\u00e7in daha d\u00fc\u015f\u00fck maliyetli bir se\u00e7enektir<\/li> <li>25 kullan\u0131c\u0131 ve 50 cihaz s\u0131n\u0131r\u0131 vard\u0131r<\/li> <\/ul> <\/li> <li><strong>A\u00e7\u0131k Kaynak Alternatifleri<\/strong> <ul> <li>Linux da\u011f\u0131t\u0131mlar\u0131 (Ubuntu Server, CentOS, Debian vb.)<\/li> <li>Samba ile Active Directory benzeri i\u015flevsellik<\/li> <li>Docker ve Kubernetes ile konteynerizasyon<\/li> <\/ul> <\/li> <\/ol> <h3>Microsoft Lisans Programlar\u0131<\/h3> E\u011fitim kurumlar\u0131, k\u00e2r amac\u0131 g\u00fctmeyen kurulu\u015flar ve startuplar i\u00e7in Microsoft'un \u00e7e\u015fitli lisans programlar\u0131 bulunmaktad\u0131r: <ol> <li><strong>Microsoft Imagine (Eski DreamSpark)<\/strong> <ul> <li>E\u011fitim kurumlar\u0131 ve \u00f6\u011frenciler i\u00e7in \u00fccretsiz yaz\u0131l\u0131mlar<\/li> <\/ul> <\/li> <li><strong>Microsoft for Startups<\/strong> <ul> <li>Startuplar i\u00e7in Azure kredileri ve yaz\u0131l\u0131m indirimleri<\/li> <\/ul> <\/li> <li><strong>Microsoft Nonprofit Program<\/strong> <ul> <li>Kar amac\u0131 g\u00fctmeyen kurulu\u015flar i\u00e7in indirimli veya \u00fccretsiz lisanslar<\/li> <\/ul> <\/li> <\/ol> Windows Server de\u011ferlendirme s\u00fcresini uzatmak, test ve \u00f6\u011frenme s\u00fcre\u00e7lerinizi tamamlaman\u0131z i\u00e7in size ek zaman sa\u011flayabilir. Bu rehberde sunulan y\u00f6ntemler, Microsoft'un belirledi\u011fi s\u0131n\u0131rlar dahilinde kullan\u0131ld\u0131\u011f\u0131nda ve tamamen test ama\u00e7l\u0131 oldu\u011funda uygundur. Ancak, uzun vadeli \u00e7\u00f6z\u00fcmler i\u00e7in \u015funlar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurman\u0131z \u00f6nerilir: <ol> <li>Profesyonel ortamlar i\u00e7in uygun lisanslar sat\u0131n al\u0131n<\/li> <li>E\u011fitim ve geli\u015ftirme ihtiya\u00e7lar\u0131 i\u00e7in Microsoft'un \u00f6zel programlar\u0131n\u0131 de\u011ferlendirin<\/li> <li>D\u00fc\u015f\u00fck b\u00fct\u00e7eli projeler i\u00e7in a\u00e7\u0131k kaynak alternatifleri veya bulut tabanl\u0131 \u00e7\u00f6z\u00fcmleri d\u00fc\u015f\u00fcn\u00fcn<\/li> <\/ol> Windows Server'\u0131n geli\u015fmi\u015f \u00f6zellikleri, kurumsal BT altyap\u0131n\u0131z i\u00e7in g\u00fc\u00e7l\u00fc temel olu\u015fturabilir, ancak do\u011fru lisanslama modelini se\u00e7mek, hem yasal uyumluluk hem de maliyet optimizasyonu a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir. <hr \/> <strong>Not<\/strong>: Bu rehber yaln\u0131zca e\u011fitim ama\u00e7l\u0131d\u0131r ve Microsoft'un lisans ko\u015fullar\u0131na uygun \u015fekilde test ortamlar\u0131nda kullan\u0131lmal\u0131d\u0131r. \u00dcretim ortamlar\u0131 i\u00e7in her zaman yasal lisanslar kullanman\u0131z \u00f6nerilir.","excerpt":"Windows Server de\u011ferlendirme s\u00fcr\u00fcmlerinin sa\u011flad\u0131\u011f\u0131 ge\u00e7ici lisans, test ortamlar\u0131 olu\u015fturma, yeni \u00f6zellikleri ke\u015ffetme veya e\u011fitim...","created_at":"2025-04-05 16:48:59","updated_at":"2026-09-23 10:58:43","category_id":6,"view_count":1480,"reading_time":8,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-04-05 16:48:59","featured_image":"resimyok.jpg","slug":"windows-server-evaluation-suresini-uzatma","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":170,"title":"Windows Server'da Dosya \u0130\u015flemlerini \u0130zleme ve Denetleme","content":"<h1>Windows Server'da Dosya \u0130\u015flemlerini \u0130zleme ve G&uuml;venlik Rehberi<\/h1>\r\n<p>Windows Server ortam\u0131nda dosya i\u015flemlerinin (silme, de\u011fi\u015ftirme, eri\u015fim vb.) izlenmesi, sistem g&uuml;venli\u011fi ve denetim s&uuml;re&ccedil;leri a&ccedil;\u0131s\u0131ndan kritik &ouml;neme sahiptir. Bu rehberde, sistem y&ouml;neticilerinin dosya i\u015flemlerini nas\u0131l etkin \u015fekilde izleyebilece\u011fini, hangi ara&ccedil;lar\u0131 kullanabilece\u011fini ve log analizlerini nas\u0131l ger&ccedil;ekle\u015ftirebilece\u011fini ad\u0131m ad\u0131m ele al\u0131yoruz.<\/p>\r\n<h2>1. Event Viewer Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Event Viewer'\u0131 Etkin Kullanma<\/h3>\r\n<p>Event Viewer, Windows Server'da dosya eri\u015fim ve de\u011fi\u015fikliklerini izlemek i&ccedil;in kullan\u0131lan en temel ara&ccedil;lardan biridir. &Ouml;zellikle a\u015fa\u011f\u0131daki <strong>Event ID<\/strong> de\u011ferleri, dosya aktivitelerini yak\u0131ndan takip etmek i&ccedil;in kritik &ouml;neme sahiptir:<\/p>\r\n<ul>\r\n<li><strong>4663:<\/strong> Nesneye eri\u015fim denemeleri<\/li>\r\n<li><strong>4660:<\/strong> Nesne silme i\u015flemleri<\/li>\r\n<li><strong>4656:<\/strong> Nesneye eri\u015fim talepleri<\/li>\r\n<li><strong>4658:<\/strong> Nesneye eri\u015fim kapatma i\u015flemleri<\/li>\r\n<li><strong>4664:<\/strong> Nesne ba\u011flant\u0131lar\u0131 olu\u015fturma<\/li>\r\n<\/ul>\r\n<h3>Event Viewer'da Log Arama<\/h3>\r\n<ol>\r\n<li><code>Server Manager &gt; Tools &gt; Event Viewer<\/code> yolunu izleyin.<\/li>\r\n<li><code>Windows Logs &gt; Security<\/code> sekmesine gidin.<\/li>\r\n<li>Sa\u011f panelden <strong>Filter Current Log<\/strong> se&ccedil;ene\u011fini t\u0131klay\u0131n.<\/li>\r\n<li>Yukar\u0131daki Event ID&rsquo;leri girerek loglar\u0131 filtreleyin.<\/li>\r\n<\/ol>\r\n<h2>2. Audit Policy Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Group Policy &Uuml;zerinden Audit Ayarlar\u0131<\/h3>\r\n<ol>\r\n<li>Group Policy Management Console&rsquo;u a&ccedil;\u0131n.<\/li>\r\n<li><code>Default Domain Policy<\/code> &uuml;zerine sa\u011f t\u0131klay\u0131n ve d&uuml;zenleyin.<\/li>\r\n<li><code>Computer Configuration &gt; Policies &gt; Windows Settings &gt; Security Settings &gt; Advanced Audit Policy Configuration<\/code> yolunu izleyin.<\/li>\r\n<li>A\u015fa\u011f\u0131daki politikalar\u0131 etkinle\u015ftirin:<\/li>\r\n<\/ol>\r\n<ul>\r\n<li>Object Access &gt; Audit File System<\/li>\r\n<li>Object Access &gt; Audit File Share<\/li>\r\n<li>Object Access &gt; Audit Handle Manipulation<\/li>\r\n<\/ul>\r\n<h3>PowerShell ile Audit Policy Yap\u0131land\u0131rma<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# T&uuml;m dosya sistemi eri\u015fimlerini izleme\r\nauditpol \/set \/category:\"Object Access\" \/success:enable \/failure:enable\r\n\r\n# Belirli bir kategoriyi sorgulama\r\nauditpol \/get \/category:\"Object Access\"\r\n<\/code><\/pre>\r\n<h2>3. File Server Resource Manager (FSRM) Kullan\u0131m\u0131<\/h2>\r\n<h3>FSRM Kurulumu<\/h3>\r\n<pre><code class=\"language-powershell\">\r\nInstall-WindowsFeature FS-Resource-Manager -IncludeManagementTools\r\n<\/code><\/pre>\r\n<h3>File Screening ve Storage Reports<\/h3>\r\n<ul>\r\n<li><strong>File Screening Management:<\/strong> Belirli dosya t&uuml;rlerini engelleyebilir ve bu eylemleri loglayabilirsiniz.<\/li>\r\n<li><strong>Storage Reports Management:<\/strong> Disk kullan\u0131m analizi, b&uuml;y&uuml;k dosya raporlar\u0131 ve kopya dosya tespiti yap\u0131labilir.<\/li>\r\n<\/ul>\r\n<h2>4. PowerShell ile Log Analizi<\/h2>\r\n<p>Dosya aktivitelerini analiz etmek i&ccedil;in PowerShell komutlar\u0131 olduk&ccedil;a etkilidir. &Ouml;rne\u011fin, son 24 saatte ger&ccedil;ekle\u015fen silme i\u015flemlerini listelemek veya belirli bir kullan\u0131c\u0131ya ait aktiviteleri g&ouml;rmek m&uuml;mk&uuml;nd&uuml;r:<\/p>\r\n<pre><code class=\"language-powershell\">\r\n# Son 24 saatteki silme i\u015flemlerini getir\r\nGet-WinEvent -FilterHashtable @{ LogName='Security'; ID=4663; StartTime=(Get-Date).AddDays(-1) } |\r\nWhere-Object {$_.Message -like \"*Delete*\"} |\r\nFormat-Table TimeCreated,ID,Message -Wrap\r\n\r\n# Belirli bir kullan\u0131c\u0131n\u0131n i\u015flemlerini izleme\r\nGet-WinEvent -FilterHashtable @{ LogName='Security'; ID=4663,4660 } |\r\nWhere-Object {$_.Message -like \"*UserName*\"} |\r\nSelect-Object TimeCreated,ID,Message\r\n<\/code><\/pre>\r\n<h2>5. Shadow Copy Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Shadow Copy Etkinle\u015ftirme<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# Shadow Copy depolama alan\u0131 olu\u015fturma\r\nvssadmin add shadowstorage \/for=C: \/on=C: \/maxsize=10GB\r\n\r\n# G&uuml;nl&uuml;k Shadow Copy zamanlamas\u0131\r\nschtasks \/create \/tn \"Daily Shadow Copy\" \/tr \"wmic shadowcopy call create Volume='C:\\'\" \/sc daily \/st 00:00\r\n<\/code><\/pre>\r\n<h3>Shadow Copy Durumunu \u0130zleme<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# Mevcut Shadow Copy'leri listele\r\nvssadmin list shadows\r\n\r\n# Shadow Copy depolama alan\u0131 kullan\u0131m\u0131n\u0131 g&ouml;r&uuml;nt&uuml;le\r\nvssadmin list shadowstorage\r\n<\/code><\/pre>\r\n<p><strong>&Ouml;rnek &ccedil;\u0131kt\u0131:<\/strong><\/p>\r\n<pre>Used Shadow Copy Storage space: 0 bytes (0%)\r\nAllocated Shadow Copy Storage space: 0 bytes (0%)\r\nMaximum Shadow Copy Storage space: 19.9 GB (9%)\r\n<\/pre>\r\n<h2>6. \u0130yi Uygulama &Ouml;nerileri<\/h2>\r\n<ul>\r\n<li><strong>Log Rotasyonu:<\/strong> Loglar\u0131 d&uuml;zenli ar\u015fivleyin, s\u0131k\u0131\u015ft\u0131r\u0131n veya farkl\u0131 bir diske ta\u015f\u0131y\u0131n. Disk alan\u0131 y&ouml;netimini ihmal etmeyin.<\/li>\r\n<li><strong>Alarm Mekanizmas\u0131:<\/strong> Kritik dosya i\u015flemleri i&ccedil;in e-posta bildirimleri veya otomatik uyar\u0131 sistemleri olu\u015fturun.<\/li>\r\n<li><strong>Periyodik Raporlama:<\/strong> Haftal\u0131k veya ayl\u0131k dosya i\u015flem raporlar\u0131yla kullan\u0131c\u0131 aktivitelerini izleyin, anormal davran\u0131\u015flar\u0131 tespit edin.<\/li>\r\n<\/ul>\r\n<h2>Sonu&ccedil;<\/h2>\r\n<p>Windows Server'da dosya i\u015flemlerinin izlenmesi, g&uuml;venlik ve denetim politikalar\u0131n\u0131n merkezinde yer al\u0131r. Event Viewer, Audit Policy, FSRM ve PowerShell ara&ccedil;lar\u0131n\u0131 bir arada kullanarak sisteminizdeki dosya eri\u015fimlerini detayl\u0131 \u015fekilde takip edebilir, g&uuml;venlik ihlallerini erken a\u015famada tespit edebilirsiniz.<\/p>\r\n<p>D&uuml;zenli denetim, log analizi ve otomatik bildirim sistemleriyle kurumsal verilerinizi koruyabilir, yasal gereklilikleri eksiksiz yerine getirebilirsiniz.<\/p>","excerpt":"Windows Server'da dosya i\u015flemlerinin izlenmesi, sistem g\u00fcvenli\u011fi ve denetimi a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir. Bu yaz\u0131da bahsedilen y\u00f6ntemleri kullanarak, sisteminizde ger\u00e7ekle\u015fen t\u00fcm dosya i\u015flemlerini etkin bir \u015fekilde izleyebilir ve gerekti\u011finde m\u00fcdahale edebilirsiniz.\r\n\r\nD\u00fczenli kontroller ve raporlamalar yaparak, olas\u0131 g\u00fcvenlik ihlallerini erkenden tespit edebilir ve gerekli \u00f6nlemleri alabilirsiniz. Ayr\u0131ca, bu izleme mekanizmalar\u0131n\u0131 kurum politikalar\u0131n\u0131za ve yasal gerekliliklere uygun \u015fekilde yap\u0131land\u0131rman\u0131z \u00f6nemlidir.","created_at":"2025-02-06 17:11:34","updated_at":"2026-09-23 13:09:25","category_id":6,"view_count":773,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-06 17:11:34","featured_image":"resimyok.jpg","slug":"windows-server-da-dosya-islemlerini-izleme-ve-denetleme","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":230,"title":"Windows Server Group Policy ile \u015eifre Politikalar\u0131 Y\u00f6netimi","content":"<p>Windows Server ortam\u0131nda, kullan\u0131c\u0131 hesaplar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u015fifre politikalar\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. Group Policy (Grup \u0130lkesi) ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 nas\u0131l y\u00f6netebilece\u011finizi, g\u00f6r\u00fcnt\u00fcleyebilece\u011finizi ve d\u00fczenleyebilece\u011finizi bu yaz\u0131da detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z.<\/p><p>1. Group Policy ile \u015eifre Politikalar\u0131 Y\u00f6netimi<\/p><p>1.1 Group Policy Management Console'da \u015eifre Politikalar\u0131na Ula\u015fma<\/p><p>Group Policy Management Console (GPMC) \u00fczerinden \u015fifre politikalar\u0131n\u0131 y\u00f6netmek i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyebilirsiniz:<\/p><p>1. **Group Policy Management** konsolunu a\u00e7\u0131n.<br>2. **Forest: domain.com** &gt; **Domains** &gt; **domain.com** &gt; **Default Domain Policy** yolunu takip edin.<br>3. **Default Domain Policy** \u00fczerine sa\u011f t\u0131klay\u0131p **Edit** se\u00e7ene\u011fini se\u00e7in.<br>4. **Computer Configuration** &gt; **Policies** &gt; **Windows Settings** &gt; **Security Settings** &gt; **Account Policies** &gt; **Password Policy** yolunu izleyerek \u015fifre politikalar\u0131na ula\u015f\u0131n.<\/p><p>1.2 Alternatif Yol<\/p><p>1. **Server Manager** &gt; **Tools** &gt; **Group Policy Management** yolunu izleyin.<br>2. **Default Domain Policy** \u00fczerine sa\u011f t\u0131klay\u0131p **Edit** se\u00e7ene\u011fini se\u00e7in.<br>3. **Computer Configuration** &gt; **Windows Settings** &gt; **Security Settings** &gt; **Account Policies** &gt; **Password Policy** yolunu izleyin.<\/p><p>2. PowerShell ile \u015eifre Politikalar\u0131n\u0131 G\u00f6r\u00fcnt\u00fcleme<\/p><p>2.1 Default Domain Policy<\/p><p>Varsay\u0131lan domain \u015fifre politikas\u0131n\u0131 g\u00f6r\u00fcnt\u00fclemek i\u00e7in a\u015fa\u011f\u0131daki PowerShell komutlar\u0131n\u0131 kullanabilirsiniz:<\/p><p>```powershell<br>Varsay\u0131lan domain \u015fifre politikas\u0131<br>Get-ADDefaultDomainPasswordPolicy | Format-List *password*<\/p><p>Daha spesifik bilgiler i\u00e7in<br>Get-ADDefaultDomainPasswordPolicy | Select-Object ComplexityEnabled,<br>&nbsp; MinPasswordLength,<br>&nbsp; MaxPasswordAge,<br>&nbsp; MinPasswordAge,<br>&nbsp; PasswordHistoryCount<br>```<\/p><p>2.2 Fine-Grained Password Policies (FGPP)<\/p><p>Fine-Grained Password Policies (FGPP) ile daha detayl\u0131 \u015fifre politikalar\u0131 olu\u015fturabilirsiniz. FGPP'leri g\u00f6r\u00fcnt\u00fclemek i\u00e7in:<\/p><p>```powershell<br>T\u00fcm FGPP'leri listele<br>Get-ADFineGrainedPasswordPolicy -Filter * |&nbsp;<br>Select-Object Name, Precedence, MinPasswordLength, PasswordHistoryCount, ComplexityEnabled<\/p><p>Belirli bir FGPP'yi g\u00f6r\u00fcnt\u00fcle<br>Get-ADFineGrainedPasswordPolicy -Identity \"PolicyName\"<br>```<\/p><p>2.3 Group Policy Objects \u0130\u00e7inde \u015eifre Politikalar\u0131<\/p><p>\u015eifre politikalar\u0131 ile ilgili Group Policy Objects (GPO) bulmak i\u00e7in:<\/p><p>```powershell<br>\u015eifre ile ilgili GPO'lar\u0131 bul<br>Get-GPO -All | Where-Object {$_.DisplayName -like \"*password*\"} |&nbsp;<br>Select-Object DisplayName, CreationTime, ModificationTime<\/p><p>GPO'lar\u0131n uyguland\u0131\u011f\u0131 OU'lar\u0131 g\u00f6r<br>Get-GPInheritance -Target \"DC=domain,DC=com\"<br>```<\/p><p>3. \u00d6rnek Policy Ayarlar\u0131 ve Anlamlar\u0131<\/p><p>Tipik bir \u015fifre politikas\u0131 yap\u0131land\u0131rmas\u0131 a\u015fa\u011f\u0131daki gibi olabilir:<\/p><p>```powershell<br>ComplexityEnabled &nbsp; &nbsp;: True &nbsp; &nbsp; &nbsp; Karma\u015f\u0131kl\u0131k gereksinimleri aktif<br>MinPasswordLength &nbsp; &nbsp;: 10 &nbsp; &nbsp; &nbsp; &nbsp; Minimum 10 karakter<br>MaxPasswordAge &nbsp; &nbsp; &nbsp; : 180.00:00:00 &nbsp; 180 g\u00fcn sonra de\u011fi\u015fmeli<br>MinPasswordAge &nbsp; &nbsp; &nbsp; : 5.00:00:00 &nbsp; &nbsp; 5 g\u00fcn ge\u00e7meden de\u011fi\u015ftiremez<br>PasswordHistoryCount : 5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Son 5 \u015fifre tekrar kullan\u0131lamaz<br>```<\/p><p>4. Fine-Grained Password Policy (FGPP) Y\u00f6netimi<\/p><p>4.1 FGPP Olu\u015fturma ve D\u00fczenleme<\/p><p>FGPP olu\u015fturma ve d\u00fczenleme i\u015flemleri i\u00e7in PowerShell kullanabilirsiniz:<\/p><p>```powershell<br>\u015eifre ge\u00e7mi\u015fini g\u00fcncelleme<br>Set-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" -PasswordHistoryCount 5<\/p><p>Kullan\u0131c\u0131 ekleme<br>$user = Get-ADUser username | Select-Object DistinguishedName<br>Set-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" -Add @{AppliesTo=$user.DistinguishedName}<br>```<\/p><p>4.2 FGPP Kontrol<\/p><p>FGPP detaylar\u0131n\u0131 ve kullan\u0131c\u0131ya uygulanan politikalar\u0131 kontrol etmek i\u00e7in:<\/p><p>```powershell<br>Policy detaylar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcle<br>Get-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" | Select-Object PasswordHistoryCount,AppliesTo<\/p><p>Kullan\u0131c\u0131ya uygulanan FGPP'yi kontrol et<br>Get-ADUserResultantPasswordPolicy -Identity \"username\"<br>```<\/p><p>5. Kullan\u0131c\u0131 \u015eifre Durumu Kontrol\u00fc<\/p><p>5.1 Son \u015eifre De\u011fi\u015fikli\u011fi<\/p><p>Kullan\u0131c\u0131n\u0131n son \u015fifre de\u011fi\u015fikli\u011fi tarihini \u00f6\u011frenmek i\u00e7in:<\/p><p>```powershell<br>Get-ADUser username -Properties PasswordLastSet | Select-Object PasswordLastSet<br>```<\/p><p>5.2 Bir Sonraki \u015eifre De\u011fi\u015fikli\u011fi Tarihi<\/p><p>Bir sonraki \u015fifre de\u011fi\u015fikli\u011fi tarihini hesaplamak i\u00e7in:<\/p><p>```powershell<br>$user = Get-ADUser username -Properties PasswordLastSet<br>$nextPossibleChange = $user.PasswordLastSet.AddDays(5)<br>Write-Host \"Bir sonraki \u015fifre de\u011fi\u015fikli\u011fi yap\u0131labilecek tarih: $nextPossibleChange\"<br>```<\/p><p>6. RSOP (Resultant Set of Policy)<\/p><p>Group Policy sonu\u00e7lar\u0131n\u0131 HTML raporu olarak almak i\u00e7in:<\/p><p>```powershell<br>gpresult \/H \"C:\\PasswordPolicies.html\"<br>```<\/p><p>7. \u0130yi Uygulama \u00d6nerileri<\/p><p>7.1 Politika Y\u00f6netimi<\/p><p>- Politika de\u011fi\u015fikliklerini test ortam\u0131nda deneyin.<br>- De\u011fi\u015fiklik \u00f6ncesi mevcut ayarlar\u0131 yedekleyin.<br>- De\u011fi\u015fiklikleri dok\u00fcmante edin.<\/p><p>7.2 G\u00fcvenlik \u00d6nerileri<\/p><p>- Minimum \u015fifre uzunlu\u011fu en az 10 karakter olmal\u0131.<br>- Karma\u015f\u0131kl\u0131k gereksinimleri aktif olmal\u0131.<br>- Makul bir \u015fifre de\u011fi\u015fim s\u00fcresi belirleyin (\u00f6rn. 180 g\u00fcn).<br>- \u015eifre ge\u00e7mi\u015fi en az 5 olmal\u0131.<\/p><p>7.3 Monitoring<\/p><p>- D\u00fczenli olarak politika ayarlar\u0131n\u0131 kontrol edin.<br>- Kullan\u0131c\u0131 \u015fikayetlerini takip edin.<br>- Security log'lar\u0131 d\u00fczenli kontrol edin.<\/p><p>7.4 Dok\u00fcmantasyon<\/p><p>- T\u00fcm politika de\u011fi\u015fikliklerini kaydedin.<br>- \u00d6zel durumlar\u0131 ve istisnalar\u0131 belgelendirin.<br>- Troubleshooting ad\u0131mlar\u0131n\u0131 dok\u00fcmante edin.<\/p><p>Sonu\u00e7<\/p><p>Windows Server ortam\u0131nda Group Policy ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 etkili bir \u015fekilde y\u00f6netebilirsiniz. Bu rehber, \u015fifre politikalar\u0131n\u0131 nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131, g\u00f6r\u00fcnt\u00fcleyece\u011finizi ve d\u00fczenleyece\u011finizi ad\u0131m ad\u0131m anlatmaktad\u0131r. G\u00fcvenli bir ortam sa\u011flamak i\u00e7in bu politikalar\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irmeyi ve g\u00fcncellemeyi unutmay\u0131n.<\/p>","excerpt":"Windows Server ortam\u0131nda, kullan\u0131c\u0131 hesaplar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u015fifre politikalar\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. Group Policy (Grup \u0130lkesi) ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 nas\u0131l y\u00f6netebilece\u011finizi, g\u00f6r\u00fcnt\u00fcleyebilece\u011finizi ve d\u00fczenleyebilece\u011finizi bu yaz\u0131da detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z.","created_at":"2025-01-09 13:41:51","updated_at":"2026-09-23 11:19:35","category_id":6,"view_count":752,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-01-09 13:41:51","featured_image":"resimyok.jpg","slug":"windows-server-group-policy-ile-sifre-politikalari-yonetimi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":234,"title":"LAPSDumper","content":"<p>LAPSDumper, GitHub'da n00py taraf\u0131ndan geli\u015ftirilen bir ara\u00e7t\u0131r. Bu ara\u00e7, Active Directory ortamlar\u0131nda Local Administrator Password Solution (LAPS) taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131karmak i\u00e7in kullan\u0131l\u0131r. LAPS, Microsoft taraf\u0131ndan geli\u015ftirilen bir \u00e7\u00f6z\u00fcmd\u00fcr ve etki alan\u0131ndaki bilgisayarlar\u0131n yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 otomatik olarak y\u00f6netir. LAPSDumper, bu parolalar\u0131 \u00e7\u0131karmak ve g\u00f6r\u00fcnt\u00fclemek i\u00e7in kullan\u0131l\u0131r.<\/p><p>\u015eimdi, LAPSDumper'\u0131n ne oldu\u011funu, nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve nas\u0131l kullan\u0131ld\u0131\u011f\u0131n\u0131 detayl\u0131 bir \u015fekilde inceleyelim.<\/p><p>---<\/p><p>LAPSDumper Nedir?<\/p><p>LAPSDumper, Active Directory ortamlar\u0131nda LAPS taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131karmak i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. LAPS, etki alan\u0131ndaki bilgisayarlar\u0131n yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 otomatik olarak y\u00f6netir ve bu parolalar\u0131 Active Directory'de saklar. LAPSDumper, bu parolalar\u0131 \u00e7\u0131karmak ve g\u00f6r\u00fcnt\u00fclemek i\u00e7in kullan\u0131l\u0131r.<\/p><p>---<\/p><p>LAPSDumper'\u0131n Temel \u00d6zellikleri<\/p><p>1. LAPS Parolalar\u0131n\u0131 \u00c7\u0131karma: LAPS taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131kar\u0131r.<br>2. Active Directory Entegrasyonu: Active Directory'deki bilgisayar hesaplar\u0131n\u0131 tarar ve LAPS parolalar\u0131n\u0131 \u00e7\u0131kar\u0131r.<br>3. Kullan\u0131c\u0131 Dostu Aray\u00fcz: Kolay kullan\u0131m i\u00e7in basit bir komut sat\u0131r\u0131 aray\u00fcz\u00fc sunar.<br>4. A\u00e7\u0131k Kaynak: \u00dccretsiz ve a\u00e7\u0131k kaynakl\u0131d\u0131r.<\/p><p>---<\/p><p>LAPSDumper'\u0131n Kullan\u0131m Senaryolar\u0131<\/p><p>1. Sistem Y\u00f6neticileri: Yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 y\u00f6netmek ve g\u00f6r\u00fcnt\u00fclemek i\u00e7in.<br>2. Pentest Uzmanlar\u0131: Active Directory ortamlar\u0131nda g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in.<br>3. Siber G\u00fcvenlik Ara\u015ft\u0131rmac\u0131lar\u0131: LAPS parolalar\u0131n\u0131 analiz etmek ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in.<\/p><p>---<\/p><p>LAPSDumper'\u0131n \u00c7al\u0131\u015fma Mant\u0131\u011f\u0131<\/p><p>LAPSDumper, Active Directory'deki bilgisayar hesaplar\u0131n\u0131 tarar ve LAPS taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131kar\u0131r. Bu i\u015flem, Active Directory'deki ms-Mcs-AdmPwd \u00f6zniteli\u011fini kullanarak ger\u00e7ekle\u015ftirilir. LAPSDumper, bu \u00f6zniteli\u011fi okuyarak yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcler.<\/p><p>---<\/p><p>LAPSDumper Kurulumu<\/p><p>LAPSDumper'\u0131 kurmak i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 takip edebilirsiniz:<\/p><p>1. Gereksinimler<br>- Python 3.x<br>- Git<\/p><p>2. LAPSDumper'\u0131 \u0130ndirin<br>```bash<br>git clone https:\/\/github.com\/n00py\/LAPSDumper.git<br>cd LAPSDumper<br>```<\/p><p>3. Ba\u011f\u0131ml\u0131l\u0131klar\u0131 Y\u00fckleyin<br>```bash<br>pip install -r requirements.txt<br>```<\/p><p>---<\/p><p>LAPSDumper Kullan\u0131m\u0131<\/p><p>LAPSDumper, komut sat\u0131r\u0131 \u00fczerinden kullan\u0131l\u0131r. Temel kullan\u0131m \u00f6rnekleri a\u015fa\u011f\u0131daki gibidir:<\/p><p>1. Temel Kullan\u0131m<br>```bash<br>python laps.py -u &lt;kullan\u0131c\u0131_ad\u0131&gt; -p &lt;parola&gt; -d &lt;etki_alan\u0131&gt; -dc &lt;etki_alan\u0131_denetleyicisi&gt;<br>```<\/p><p>\u00d6rnek:<br>```bash<br>python laps.py -u admin -p password -d example.com -dc dc.example.com<br>```<\/p><p>2. T\u00fcm Bilgisayarlar\u0131n Parolalar\u0131n\u0131 \u00c7\u0131karma<br>```bash<br>python laps.py -u &lt;kullan\u0131c\u0131_ad\u0131&gt; -p &lt;parola&gt; -d &lt;etki_alan\u0131&gt; -dc &lt;etki_alan\u0131_denetleyicisi&gt; --all<br>```<\/p><p>3. Belirli Bir Bilgisayar\u0131n Parolas\u0131n\u0131 \u00c7\u0131karma<br>```bash<br>python laps.py -u &lt;kullan\u0131c\u0131_ad\u0131&gt; -p &lt;parola&gt; -d &lt;etki_alan\u0131&gt; -dc &lt;etki_alan\u0131_denetleyicisi&gt; --computer &lt;bilgisayar_ad\u0131&gt;<br>```<\/p><p>---<\/p><p>LAPSDumper'\u0131n Avantajlar\u0131<\/p><p>1. H\u0131zl\u0131 ve Etkili: LAPS parolalar\u0131n\u0131 h\u0131zl\u0131 bir \u015fekilde \u00e7\u0131kar\u0131r.<br>2. Kullan\u0131m Kolayl\u0131\u011f\u0131: Basit bir komut sat\u0131r\u0131 aray\u00fcz\u00fc sunar.<br>3. A\u00e7\u0131k Kaynak: \u00dccretsiz ve a\u00e7\u0131k kaynakl\u0131d\u0131r.<\/p><p>---<\/p><p>LAPSDumper'\u0131n Dezavantajlar\u0131<\/p><p>1. Etik ve Yasal S\u0131n\u0131rlar: Bu t\u00fcr ara\u00e7lar\u0131n yaln\u0131zca yetkili testler ve etik hackleme ama\u00e7lar\u0131 i\u00e7in kullan\u0131lmas\u0131 gereklidir.<br>2. S\u0131n\u0131rl\u0131 Dok\u00fcmantasyon: Projenin dok\u00fcmantasyonu s\u0131n\u0131rl\u0131 olabilir.<\/p><p>---<\/p><p>Etik ve Yasal Uyar\u0131<\/p><p>LAPSDumper gibi ara\u00e7lar, yaln\u0131zca yetkili testler ve etik hackleme (ethical hacking) ama\u00e7lar\u0131 i\u00e7in kullan\u0131lmal\u0131d\u0131r. Herhangi bir sisteme izinsiz eri\u015fim sa\u011flamak yasa d\u0131\u015f\u0131d\u0131r ve ciddi yasal sonu\u00e7lara yol a\u00e7abilir. Bu t\u00fcr ara\u00e7lar\u0131 kullanmadan \u00f6nce ilgili izinleri ald\u0131\u011f\u0131n\u0131zdan emin olun.<\/p><p>---<\/p><p>Sonu\u00e7<\/p><p>LAPSDumper, Active Directory ortamlar\u0131nda LAPS taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131karmak i\u00e7in kullan\u0131\u015fl\u0131 bir ara\u00e7t\u0131r. \u00d6zellikle sistem y\u00f6neticileri ve siber g\u00fcvenlik uzmanlar\u0131 i\u00e7in faydal\u0131 olabilir. Ancak, bu t\u00fcr ara\u00e7lar\u0131n etik ve yasal s\u0131n\u0131rlar i\u00e7inde kullan\u0131lmas\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r.<\/p><p>Daha fazla bilgi i\u00e7in resmi GitHub sayfas\u0131n\u0131 ziyaret edebilirsiniz: (https:\/\/github.com\/n00py\/LAPSDumper).<\/p><p>---<\/p><p>Umar\u0131m bu a\u00e7\u0131klama, LAPSDumper'\u0131 anlaman\u0131za yard\u0131mc\u0131 olmu\u015ftur. Ba\u015fka sorular\u0131n\u0131z varsa bana her zaman ula\u015fabilirsiniz! \ud83d\ude0a<\/p>","excerpt":"LAPSDumper, Active Directory ortamlar\u0131nda LAPS taraf\u0131ndan y\u00f6netilen yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 \u00e7\u0131karmak i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. LAPS, etki alan\u0131ndaki bilgisayarlar\u0131n yerel y\u00f6netici hesaplar\u0131n\u0131n parolalar\u0131n\u0131 otomatik olarak y\u00f6netir ve bu parolalar\u0131 Active Directory'de saklar. LAPSDumper, bu parolalar\u0131 \u00e7\u0131karmak ve g\u00f6r\u00fcnt\u00fclemek i\u00e7in kullan\u0131l\u0131r.","created_at":"2025-01-06 19:51:55","updated_at":"2026-09-07 20:32:42","category_id":7,"view_count":693,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-01-06 19:51:55","featured_image":"resimyok.jpg","slug":"lapsdumper","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]