[{"id":415,"title":" Active Directory FSMO Rolleri ","content":"
\n
Karma\u015f\u0131k bir sistemin kesintisiz i\u015flemesini sa\u011flayan \u015fey sadece kablolar, kod sat\u0131rlar\u0131 veya sunucu makineleri midir? Yoksa görünmeyen ama her an i\u015fleyen görev da\u011f\u0131l\u0131mlar\u0131, sorumluluklar ve uyum mu?<\/div>\n
\n
Bili\u015fim dünyas\u0131nda Active Directory (AD)<\/strong>, devasa bir organizasyonun dijital omurgas\u0131n\u0131 olu\u015fturur. Bu omurgan\u0131n dengede kalmas\u0131n\u0131 sa\u011flayan, arka planda sessizce ama hayati görevler üstlenen özel yap\u0131lara ise FSMO (Flexible Single Master Operation) Rolleri<\/strong> diyoruz.<\/div>\n
\n
\u0130lk bak\u0131\u015fta so\u011fuk ve teknik görünen bu roller, asl\u0131nda insan topluluklar\u0131n\u0131n ve sosyal hayat\u0131n i\u015fleyi\u015f biçimiyle inan\u0131lmaz bir benzerlik ta\u015f\u0131r. Gelip birlikte bakal\u0131m: Sistemlerimizdeki bu gizli kahramanlar, insan ili\u015fkilerinde ve organizasyonlarda neye kar\u015f\u0131l\u0131k geliyor?<\/div>\n
\n

1. Forest Seviyesi Roller: Toplulu\u011fun Anayasas\u0131 ve S\u0131n\u0131rlar\u0131<\/h3>\n
Tüm yap\u0131y\u0131 kapsayan, en geni\u015f çaptaki kurallar\u0131 ve bütünlü\u011fü koruyan rollerdir.<\/div>\n
\n
    \n
  • \n
    Schema Master (\u015eema Yöneticisi):<\/strong><\/div>\n
    \n
      \n
    • \n
      Teknik Rol:<\/em> \u015eema de\u011fi\u015fikliklerini yönetir, sisteme dâhil edilecek yeni nesnelerin kurallar\u0131n\u0131 belirler (Örn: Exchange Server kurulumu).<\/div>\n<\/li>\n
    • \n
      Hümanist Kar\u015f\u0131l\u0131\u011f\u0131:<\/em> Toplulu\u011fun Anayasas\u0131 ve \u0130lkeleri.<\/strong> Bir toplumda veya ailede temel de\u011ferlerin nas\u0131l tan\u0131mland\u0131\u011f\u0131n\u0131 belirleyen rehber zihindir. Kendi kimli\u011fimizi bozmadan yeniliklere nas\u0131l adapte olaca\u011f\u0131m\u0131z\u0131n mimar\u0131d\u0131r.<\/div>\n<\/li>\n<\/ul>\n<\/li>\n
    • \n
      Domain Naming Master (Domain \u0130simlendirme Yöneticisi):<\/strong><\/div>\n
      \n
        \n
      • \n
        Teknik Rol:<\/em> Yeni alan adlar\u0131n\u0131n (Domain ve Tree) eklenmesini veya kald\u0131r\u0131lmas\u0131n\u0131 denetler.<\/div>\n<\/li>\n
      • \n
        Hümanist Kar\u015f\u0131l\u0131\u011f\u0131:<\/em> Aaidiyet ve S\u0131n\u0131r Koyuclar.<\/strong> Kimin bu ekibin, ailenin veya toplulu\u011fun bir parças\u0131 oldu\u011funu; yeni kat\u0131l\u0131mlar\u0131n hangi \u015fartlarda gerçekle\u015fece\u011fini belirleyen kapsay\u0131c\u0131 iradedir.<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

        2. Domain Seviyesi Roller: Günlük Hayat\u0131n ve \u0130leti\u015fimin Temelleri<\/h3>\n
        Daha yerel, günlük ak\u0131\u015f\u0131 düzenleyen ve bireysel etkile\u015fimleri yöneten rollerdir.<\/div>\n
        \n
          \n
        • \n
          RID Master (Relative ID Yöneticisi):<\/strong><\/div>\n
          \n
            \n
          • \n
            Teknik Rol:<\/em> Yeni kimlikler (SID) olu\u015fturmak için benzersiz havuzlar da\u011f\u0131t\u0131r.<\/div>\n<\/li>\n
          • \n
            Hümanist Kar\u015f\u0131l\u0131\u011f\u0131:<\/em> Özgünlük ve Bireysellik.<\/strong> Her bireye kendi e\u015fsiz kimli\u011fini kazand\u0131ran, kimsenin bir ba\u015fkas\u0131n\u0131n gölgesinde kalmamas\u0131n\u0131 sa\u011flayan adalet mekanizmas\u0131d\u0131r. Her birimizin benzersiz bir de\u011fer oldu\u011funu hat\u0131rlat\u0131r.<\/div>\n<\/li>\n<\/ul>\n<\/li>\n
          • \n
            PDC Emulator (Primary Domain Controller):<\/strong><\/div>\n
            \n
              \n
            • \n
              Teknik Rol:<\/em> Parola de\u011fi\u015fiklikleri, zaman (saat) senkronizasyonu ve GPO (Grup Politikalar\u0131) i\u015flemlerini yürütür.<\/div>\n<\/li>\n
            • \n
              Hümanist Kar\u015f\u0131l\u0131\u011f\u0131:<\/em> Zaman\u0131n ve Güvenin Ritmi.<\/strong> \u015eifrelerimiz güvenimizi, zaman senkronizasyonu ise ortak ritmimizi temsil eder. Bir grupta herkesin ayn\u0131 saate bakmas\u0131n\u0131, güvenin taze kalmas\u0131n\u0131 ve ortak hareket edilmesini sa\u011flayan liderlik enerjisidir.<\/div>\n<\/li>\n<\/ul>\n<\/li>\n
            • \n
              Infrastructure Master (Altyap\u0131 Yöneticisi):<\/strong><\/div>\n
              \n
                \n
              • \n
                Teknik Rol:<\/em> Farkl\u0131 domainler aras\u0131ndaki nesne referanslar\u0131n\u0131 günceller.<\/div>\n<\/li>\n
              • \n
                Hümanist Kar\u015f\u0131l\u0131\u011f\u0131:<\/em> Körprü Kurucular ve \u0130leti\u015fimciler.<\/strong> Farkl\u0131 gruplar, birimler veya kültürler aras\u0131ndaki ba\u011flar\u0131 canl\u0131 tutan, bilgi ak\u0131\u015f\u0131n\u0131 sa\u011flayan ve kopukluklar\u0131 gideren \"halkla ili\u015fkiler\" ruhudur.<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                Sahada En Büyük Hata: \u0130nsanlar\u0131 ve Rolleri Görmezden Gelmek<\/h3>\n
                Görselde teknik dünya için alt\u0131 çizilen \"Sahada En Büyük Hatalar\"<\/strong>, asl\u0131nda insan odakl\u0131 yönetimde de tam olarak kar\u015f\u0131m\u0131za ç\u0131kan ac\u0131 tecrübelerdir:<\/div>\n
                \n
                  \n
                1. \n
                  Rollerin nerede\/kimde oldu\u011funu bilmemek:<\/strong> Bir ekipte kimin hangi sorumlulu\u011fu üstlendi\u011fini bilmemek, kriz an\u0131nda kaos yarat\u0131r.<\/div>\n<\/li>\n
                2. \n
                  PDC Emulator'\u0131 (Güven ve Zaman Merkezini) yedeklememek:<\/strong> Güveni ve ileti\u015fimi tek bir noktaya ba\u011f\u0131ml\u0131 k\u0131l\u0131p korumazsan\u0131z, o nokta çöktü\u011fünde tüm yap\u0131 durur.<\/div>\n<\/li>\n
                3. \n
                  De\u011fi\u015fim an\u0131nda rolleri ta\u015f\u0131mamak:<\/strong> Bir çal\u0131\u015fan veya lider ayr\u0131l\u0131rken sorumluluklar\u0131 devretmezseniz, sistem i\u015flevsiz kal\u0131r.<\/div>\n<\/li>\n
                4. \n
                  Zaman senkronizasyonunu yanl\u0131\u015f yap\u0131land\u0131rmak:<\/strong> Ekip üyelerinin farkl\u0131 ritimlerde ve farkl\u0131 beklentilerde çal\u0131\u015fmas\u0131, senkronizasyon kayb\u0131na ve anla\u015fmazl\u0131klara yol açar.<\/div>\n<\/li>\n<\/ol>\n

                  Gerçek Mühendislik (ve Gerçek \u0130nsanl\u0131k) Burada Ba\u015flar<\/h3>\n
                  Görselin alt k\u0131sm\u0131ndaki mesaj çok net:<\/div>\n
                  \n
                  \n
                  \"Gerçek mühendislik burada ba\u015flar: Domain Controller kurmak de\u011fil, hangi sunucunun hangi kritik görevi üstlendi\u011fini bilmektir.\"<\/em><\/div>\n<\/blockquote>\n
                  Bunu sistem mühendisli\u011finden al\u0131p insan ili\u015fkilerine uyarlad\u0131\u011f\u0131m\u0131zda kar\u015f\u0131m\u0131za \u015fu hakikat ç\u0131kar:<\/div>\n
                  \n
                  Gerçek liderlik ve ya\u015fam bilgeli\u011fi; sadece binalar kurmak veya ekipler olu\u015fturmak de\u011fil, o sistemin içindeki her bir bireyin hangi benzersiz görevi ve de\u011feri üstlendi\u011fini anlamakt\u0131r.<\/strong><\/div>\n
                  \n
                  Sistemlerinizi düzenli kontrol edin, sa\u011fl\u0131k taramalar\u0131n\u0131 aksatmay\u0131n ve en önemlisi; o sistemleri ayakta tutan rollerin ve insanlar\u0131n de\u011ferini belgeleyip koruyun. Çünkü ister bir sunucu odas\u0131 olsun ister bir toplum; düzen, sorumluluklar\u0131n fark\u0131nda olmakla ba\u015flar.<\/div>\n<\/div>","excerpt":"Sunuculardan \u0130nsanlara: FSMO Rolleri ve Hayat\u0131n Gizli Denge Merkezleri","created_at":"2026-08-25 17:53:02","updated_at":"2026-09-23 17:38:45","category_id":6,"view_count":96,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-08-25 14:53:02","featured_image":"\/uploads\/images\/2026\/08\/6a8dac49f2cf8_1787669577.jpeg","slug":"active-directory-fsmo-rolleri","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":92,"title":"Her SOC Analistinin Bilmesi Gereken Windows Dizinleri","content":"Bir SOC (G\u00fcvenlik Operasyon Merkezi) analisti olarak, Windows'un kritik g\u00fcvenlik bilgilerini nerede depolad\u0131\u011f\u0131n\u0131 anlamak, bir s\u0131zma giri\u015fimini erken tespit etmek veya tamamen ka\u00e7\u0131rmak aras\u0131ndaki fark\u0131 yaratabilir. Her g\u00fcvenlik profesyonelinin radar\u0131nda olmas\u0131 gereken temel Windows dizinlerini inceleyelim.

                  Kimlik Bilgileri ve Eri\u015fim Kay\u0131tlar\u0131<\/h2> Kullan\u0131c\u0131 kimlik bilgilerinin g\u00fcvenli\u011fi, her g\u00fcvenlik duru\u015funun temelini olu\u015fturur. Bu konumlar hassas kimlik do\u011frulama verilerini depolar:
                  • C:\\Windows\\System32\\config\\SAM<\/strong>: Windows'un yerel parola hash'lerini depolad\u0131\u011f\u0131 yerdir ve bu da onu kimlik bilgisi toplama sald\u0131r\u0131lar\u0131 i\u00e7in \u00f6ncelikli bir hedef haline getirir. Bu dosyaya eri\u015fen sald\u0131rganlar, \u00e7evrimd\u0131\u015f\u0131 k\u0131rma i\u015flemleri i\u00e7in parola hash'lerini \u00e7\u0131karabilir.<\/li>
                  • C:\\Windows\\repair\\SAM<\/strong>: Kullan\u0131c\u0131 kimlik bilgilerinin bir yede\u011fini i\u00e7erir ve sald\u0131rganlar kimlik bilgisi h\u0131rs\u0131zl\u0131\u011f\u0131 i\u00e7in alternatif bir yol olarak hedefleyebilir.<\/li>
                  • C:\\Windows\\System32\\config\\SECURITY<\/strong>: Sisteminizin g\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 tan\u0131mlayan g\u00fcvenlik politikalar\u0131n\u0131 ve eri\u015fim kontrol\u00fc ayarlar\u0131n\u0131 bar\u0131nd\u0131r\u0131r.<\/li> <\/ul>

                    Sistem ve Olay Kay\u0131tlar\u0131<\/h2> Etkili g\u00fcvenlik izleme, kapsaml\u0131 g\u00fcnl\u00fck tutmaya ba\u011fl\u0131d\u0131r. Bu dizinler kritik g\u00fcnl\u00fck verilerini i\u00e7erir:
                    • C:\\Windows\\System32\\winevt<\/strong>: Windows Olay G\u00fcnl\u00fcklerini depolar, bu da SIEM korelasyonu ve g\u00fcvenlik izleme i\u00e7in \u00e7ok \u00f6nemlidir. Bu, potansiyel g\u00fcvenlik olaylar\u0131n\u0131 ara\u015ft\u0131r\u0131rken genellikle ilk dura\u011f\u0131n\u0131zd\u0131r.<\/li>
                    • C:\\Windows\\System32\\config\\SYSTEM<\/strong>: Yetkisiz de\u011fi\u015fiklikleri g\u00f6sterebilecek sistem genelindeki de\u011fi\u015fiklikleri ve yap\u0131land\u0131rmalar\u0131 izler.<\/li>
                    • C:\\Windows\\System32\\config\\SOFTWARE<\/strong>: Y\u00fckl\u00fc yaz\u0131l\u0131mlar ve de\u011fi\u015fiklikler hakk\u0131nda ayr\u0131nt\u0131lar i\u00e7eren kay\u0131t defteri bilgilerini i\u00e7erir, yetkisiz yaz\u0131l\u0131m kurulumlar\u0131n\u0131 belirlemenize yard\u0131mc\u0131 olur.<\/li> <\/ul>

                      K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m ve Tehdit Avlama G\u00f6stergeleri<\/h2> Tehditleri ararken, bu konumlar genellikle de\u011ferli adli kan\u0131tlar sa\u011flar:
                      • C:\\Windows\\Prefetch<\/strong>: Son zamanlarda \u00e7al\u0131\u015ft\u0131r\u0131lan programlar\u0131 izler, bu da bir soru\u015fturma s\u0131ras\u0131nda adli zaman \u00e7izelgeleri olu\u015fturmak i\u00e7in paha bi\u00e7ilmezdir.<\/li>
                      • C:\\Windows\\AppCompat\\Programs\\Amcache.hve<\/strong>: \u00c7al\u0131\u015ft\u0131r\u0131lan uygulamalar\u0131n ayr\u0131nt\u0131lar\u0131n\u0131 kaydeder, sald\u0131rganlar a\u011f\u0131n\u0131zda gezinirken yanal hareketi tespit etmek i\u00e7in m\u00fckemmeldir.<\/li>
                      • C:\\Users*\\NTUSER.dat<\/strong>: K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n kal\u0131c\u0131l\u0131k i\u00e7in s\u0131kl\u0131kla istismar etti\u011fi kullan\u0131c\u0131ya \u00f6zg\u00fc kay\u0131t defteri ayarlar\u0131n\u0131 i\u00e7erir.<\/li> <\/ul>

                        Kal\u0131c\u0131l\u0131k ve Ba\u015flang\u0131\u00e7 Ara\u015ft\u0131rmalar\u0131<\/h2> K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar genellikle sistem yeniden ba\u015flatmalar\u0131ndan sonra hayatta kalmak i\u00e7in kal\u0131c\u0131l\u0131k sa\u011flar. Bu konumlar s\u0131kl\u0131kla hedef al\u0131n\u0131r:
                        • C:\\Users*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: Belirli bir kullan\u0131c\u0131 oturum a\u00e7t\u0131\u011f\u0131nda programlar\u0131 ba\u015flatan kullan\u0131c\u0131ya \u00f6zg\u00fc kal\u0131c\u0131l\u0131k mekanizmalar\u0131.<\/li>
                        • C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: T\u00fcm kullan\u0131c\u0131lar\u0131 etkileyen k\u00fcresel ba\u015flang\u0131\u00e7 klas\u00f6r\u00fc, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar taraf\u0131ndan yayg\u0131n olarak k\u00f6t\u00fcye kullan\u0131l\u0131r.<\/li> <\/ul> Bu kritik dizinleri d\u00fczenli olarak izleyerek, SOC analistleri yetkisiz eri\u015fimi, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m kurulumunu ve kal\u0131c\u0131 tehditleri daha etkili bir \u015fekilde tespit edebilir. \u0130zleme stratejinize bu konumlar\u0131 dahil etmek, g\u00fcvenlik duru\u015funuzu ve olay m\u00fcdahale yeteneklerinizi \u00f6nemli \u00f6l\u00e7\u00fcde geli\u015ftirecektir. Sald\u0131rganlar\u0131n da bu konumlar\u0131n fark\u0131nda oldu\u011funu unutmay\u0131n, bu nedenle bu dizinler i\u00e7in uygun eri\u015fim kontrollerini ve izleme \u00e7\u00f6z\u00fcmlerini uygulamak, her g\u00fcvenlik ekibi i\u00e7in bir \u00f6ncelik olmal\u0131d\u0131r. EN:

                          Key Windows Directories Every SOC Analyst Should Monitor<\/h2> As a SOC (Security Operations Center) analyst, understanding where Windows stores critical security information can make the difference between detecting an intrusion early or missing it completely. Let's explore the essential Windows directories that should be on every security professional's radar.

                          Credential & Access Logs<\/h2> The security of user credentials forms the foundation of any security posture. These locations store sensitive authentication data:
                          • C:\\Windows\\System32\\config\\SAM<\/strong>: This is where Windows stores local password hashes, making it a prime target for credential dumping attacks. Attackers who gain access to this file can potentially extract password hashes for offline cracking.<\/li>
                          • C:\\Windows\\repair\\SAM<\/strong>: Contains a backup of user credentials that attackers may target as an alternative path to credential theft.<\/li>
                          • C:\\Windows\\System32\\config\\SECURITY<\/strong>: Houses security policies and access control settings that define your system's security boundaries.<\/li> <\/ul>

                            System & Event Logs<\/h2> Effective security monitoring depends on comprehensive logging. These directories contain critical log data:
                            • C:\\Windows\\System32\\winevt<\/strong>: Stores Windows Event Logs, which are crucial for SIEM correlation and security monitoring. This is often your first stop when investigating potential security incidents.<\/li>
                            • C:\\Windows\\System32\\config\\SYSTEM<\/strong>: Tracks system-wide changes and configurations that may indicate unauthorized modifications.<\/li>
                            • C:\\Windows\\System32\\config\\SOFTWARE<\/strong>: Contains the registry hive with details on installed software and changes, helping you identify unauthorized software installations.<\/li> <\/ul>

                              Malware & Threat Hunting Indicators<\/h2> When hunting for threats, these locations often provide valuable forensic evidence:
                              • C:\\Windows\\Prefetch<\/strong>: Tracks recently executed programs, which is invaluable for building forensic timelines during an investigation.<\/li>
                              • C:\\Windows\\AppCompat\\Programs\\Amcache.hve<\/strong>: Logs details of executed applications, making it excellent for detecting lateral movement as attackers navigate through your network.<\/li>
                              • C:\\Users*\\NTUSER.dat<\/strong>: Contains user-specific registry settings that malware often abuses for persistence.<\/li> <\/ul>

                                Persistence & Startup Investigations<\/h2> Malware often establishes persistence to survive system reboots. These locations are frequently targeted:
                                • C:\\Users*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: User-specific persistence mechanisms that launch programs when a specific user logs in.<\/li>
                                • C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/strong>: Global startup folder affecting all users, commonly misused by malware.<\/li> <\/ul> By regularly monitoring these critical directories, SOC analysts can more effectively detect unauthorized access, malware installation, and persistent threats. Including these locations in your monitoring strategy will significantly enhance your security posture and incident response capabilities. Remember that attackers are well aware of these locations too, so implementing proper access controls and monitoring solutions for these directories should be a priority for any security team.","excerpt":"Bir SOC (G\u00fcvenlik Operasyon Merkezi) analisti olarak, Windows'un kritik g\u00fcvenlik bilgilerini nerede depolad\u0131\u011f\u0131n\u0131 anlamak, bir s\u0131zma...","created_at":"2025-04-21 11:06:28","updated_at":"2026-09-23 20:08:40","category_id":7,"view_count":685,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-04-21 11:06:28","featured_image":"resimyok.jpg","slug":"soc-analistinin-bilmesi-gereken-windows-dizinleri","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]