<\/p>\n
Windows User Account Control (UAC)<\/strong> mekanizmas\u0131, sistem güvenli\u011finin kritik bir parças\u0131d\u0131r. Ancak varsay\u0131lan yap\u0131land\u0131rmada “Enumerate administrator accounts on elevation”<\/strong> ayar\u0131n\u0131n etkin olmas\u0131, sald\u0131rganlar\u0131n yönetici hesap bilgilerine eri\u015fmesine<\/strong> olanak tan\u0131r.<\/p>\n Bu görünürde zarars\u0131z özellik, asl\u0131nda ciddi güvenlik riskleri<\/strong> bar\u0131nd\u0131r\u0131r ve hedefli sald\u0131r\u0131lar\u0131n ba\u015flang\u0131ç noktas\u0131<\/strong> olabilir. Bu yaz\u0131da, bu kritik güvenlik aç\u0131\u011f\u0131n\u0131 ve etkili çözüm yöntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n Administrator Account Enumeration<\/strong>, Windows sistemlerinde UAC elevation dialog’u gösterildi\u011finde, mevcut yönetici hesaplar\u0131n\u0131n listelenmesi<\/strong> özelli\u011fidir. Kullan\u0131c\u0131 deneyimini iyile\u015ftirmek amac\u0131yla tasarlanm\u0131\u015f olsa da, bilgi s\u0131z\u0131nt\u0131s\u0131na yol açarak sald\u0131r\u0131 yüzeyini geni\u015fletir<\/strong>.<\/p>\n Standart kullan\u0131c\u0131, yönetici yetkisi gerektiren bir i\u015flem ba\u015flat\u0131r<\/p>\n<\/li>\n UAC dialog’u aç\u0131l\u0131r<\/p>\n<\/li>\n<\/ol>\n Enumeration Etkinken:<\/strong><\/p>\n Mevcut tüm yönetici hesaplar\u0131 listelenir<\/p>\n<\/li>\n Kullan\u0131c\u0131 dropdown’dan hesap seçer<\/p>\n<\/li>\n Sadece parola giri\u015fi yeterlidir<\/p>\n<\/li>\n<\/ul>\n Enumeration Devre D\u0131\u015f\u0131yken:<\/strong><\/p>\n Hesap listesi görünmez<\/p>\n<\/li>\n Kullan\u0131c\u0131 ad\u0131 ve<\/strong> parola girilmesi gerekir<\/p>\n<\/li>\n<\/ul>\n Aç\u0131\u011fa Ç\u0131kan Bilgiler:<\/strong><\/p>\n Domain ve local administrator hesap adlar\u0131<\/p>\n<\/li>\n Organizasyonun hesap adland\u0131rma kurallar\u0131<\/p>\n<\/li>\n Yönetici yetkili servis hesaplar\u0131<\/p>\n<\/li>\n Ki\u015fisel admin hesaplar\u0131<\/p>\n<\/li>\n<\/ul>\n Risk De\u011ferlendirmesi:<\/strong><\/p>\n Sald\u0131r\u0131 Stratejisi:<\/strong><\/p>\n Reconnaissance: UAC dialog’undan hesap isimlerini toplama<\/p>\n<\/li>\n Target Selection: En de\u011ferli hesaplar\u0131 belirleme<\/p>\n<\/li>\n Credential Attacks: Hedefli parola sald\u0131r\u0131lar\u0131<\/p>\n<\/li>\n Privilege Escalation: Yetki yükseltme<\/p>\n<\/li>\n<\/ul>\n Örnek Ak\u0131\u015f:<\/strong><\/p>\n Enhanced Phishing:<\/strong><\/p>\n Gerçek admin hesap adlar\u0131yla daha inand\u0131r\u0131c\u0131 phishing<\/p>\n<\/li>\n Spear phishing sald\u0131r\u0131lar\u0131nda do\u011fru rol bilgisi<\/p>\n<\/li>\n Sahte IT destek senaryolar\u0131<\/p>\n<\/li>\n<\/ul>\n Business Email Compromise (BEC):<\/strong><\/p>\n CEO fraud sald\u0131r\u0131lar\u0131nda gerçek yönetici isimleri<\/p>\n<\/li>\n Wire transfer fraud senaryolar\u0131<\/p>\n<\/li>\n<\/ul>\n Active Directory Reconnaissance:<\/strong><\/p>\n Domain Admin tespiti<\/p>\n<\/li>\n Privileged account discovery<\/p>\n<\/li>\n Attack path planning<\/p>\n<\/li>\n<\/ul>\n PowerShell Discovery Örne\u011fi:<\/strong><\/p>\n Ad\u0131mlar:<\/strong><\/p>\n Computer Configuration → Administrative Templates → Windows Components → Credential User Interface<\/strong><\/p>\n<\/li>\n Enumerate administrator accounts on elevation = Disabled<\/strong><\/p>\n<\/li>\n<\/ol>\n GPO Hiyerar\u015fisi:<\/strong><\/p>\n Registry Path:<\/strong><\/p>\n De\u011ferler:<\/strong><\/p>\n PowerShell:<\/strong><\/p>\n Batch Script:<\/strong><\/p>\n UAC Seviye Kar\u015f\u0131la\u015ft\u0131rmas\u0131:<\/strong><\/p>\n Credential Guard durumu kontrolü<\/p>\n<\/li>\n UEFI + TPM gereksinimleri<\/p>\n<\/li>\n LSASS izolasyonu<\/p>\n<\/li>\n<\/ul>\n Just-In-Time Administration:<\/strong><\/p>\n Geçici admin hesaplar\u0131<\/p>\n<\/li>\n Otomatik süre sonu<\/p>\n<\/li>\n Audit logging<\/p>\n<\/li>\n<\/ul>\n \u0130lgili Event ID’ler:<\/strong><\/p>\n 4648 – Explicit credential use<\/p>\n<\/li>\n 4672 – Special privileges assigned<\/p>\n<\/li>\n 4624 – Admin logon<\/p>\n<\/li>\n 5376 – Credential Manager<\/p>\n<\/li>\n<\/ul>\n Anormal elevation frekanslar\u0131<\/p>\n<\/li>\n Baseline kar\u015f\u0131la\u015ft\u0131rmas\u0131<\/p>\n<\/li>\n Otomatik uyar\u0131lar<\/p>\n<\/li>\n<\/ul>\n Splunk \/ ELK<\/strong> kurallar\u0131 ile:<\/p>\n Admin elevation say\u0131m\u0131<\/p>\n<\/li>\n Zaman bazl\u0131 e\u015fikler<\/p>\n<\/li>\n Davran\u0131\u015fsal analiz<\/p>\n<\/li>\n<\/ul>\n CIS Control 4 & 6<\/strong><\/p>\n<\/li>\n NIST PR.AC-4 \/ PR.AC-6 \/ DE.CM-1<\/strong><\/p>\n<\/li>\n<\/ul>\n Registry do\u011frulama<\/p>\n<\/li>\n GPO kontrolü<\/p>\n<\/li>\n Günlük\/haftal\u0131k raporlar<\/p>\n<\/li>\n<\/ul>\n IT Staff:<\/strong><\/p>\n Yeni UAC davran\u0131\u015f\u0131<\/p>\n<\/li>\n Güvenli credential yönetimi<\/p>\n<\/li>\n<\/ul>\n End User:<\/strong><\/p>\n Hesap listesi görünmez<\/p>\n<\/li>\n Kullan\u0131c\u0131 ad\u0131 + parola girilir<\/p>\n<\/li>\n Bilgi yoksa IT ile ileti\u015fime geçilir<\/p>\n<\/li>\n Ba\u015fkas\u0131n\u0131n admin bilgisi kullan\u0131lmaz<\/p>\n<\/li>\n<\/ol>\n Administrator account enumeration<\/strong> özelli\u011finin devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131, sistem güvenli\u011fini do\u011frudan ve anlaml\u0131 biçimde art\u0131ran kritik bir ad\u0131md\u0131r<\/strong>. Bu de\u011fi\u015fiklik, sald\u0131rganlar\u0131n reconnaissance a\u015famas\u0131nda elde edebilece\u011fi yüksek de\u011ferli bilgileri gizler<\/strong> ve hedefli sald\u0131r\u0131lar\u0131 ciddi ölçüde zorla\u015ft\u0131r\u0131r.<\/p>\n \u2705 Enumeration durumunu kontrol edin \u2705 Enumeration disabled m\u0131? Privileged Access Management (PAM)<\/p>\n<\/li>\n Just-In-Time Administration<\/p>\n<\/li>\n Multi-Factor Authentication (MFA)<\/p>\n<\/li>\n Düzenli security assessment<\/p>\n<\/li>\n Behavioral analytics<\/p>\n<\/li>\n<\/ul>\n <\/p>\n <\/p>","excerpt":"UAC Elevation S\u0131ras\u0131nda Bilgi S\u0131z\u0131nt\u0131s\u0131 Windows User Account Control (UAC) mekanizmas\u0131, sistem g\u00fcvenli\u011finin kritik bir par\u00e7as\u0131d\u0131r. Ancak...","created_at":"2025-07-16 23:56:28","updated_at":"2026-09-07 04:19:13","category_id":12,"view_count":676,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:56:28","featured_image":"\/uploads\/images\/2025\/12\/6947c3c87b69f_1766310856.png","slug":"administrator-account-enumeration-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"}]
\nAdministrator Account Enumeration Nedir?<\/h2>\n
\nUAC Elevation Süreci<\/h2>\n
Normal Ak\u0131\u015f<\/h3>\n
\n
\n
\n
\nGüvenlik Fark\u0131<\/h2>\n
Enumeration Etkinken<\/h3>\n
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Select Administrator: \u2502\n\u2502 \u25bc \u2502\n\u2502 \u25bc \u2502\n\u2502 \u25bc \u2502\n\u2502 Password: \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\nEnumeration Devre D\u0131\u015f\u0131yken<\/h3>\n
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 Username: \u2502\n\u2502 Password: \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n
\nGüvenlik Riskleri ve Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n
1. Information Disclosure (Bilgi S\u0131z\u0131nt\u0131s\u0131)<\/h3>\n
\n
Risk = Bilgi De\u011feri × Eri\u015fim Kolayl\u0131\u011f\u0131 × Kötüye Kullan\u0131m Potansiyeli\nRisk = Yüksek × Çok Kolay × Çok Yüksek = KR\u0130T\u0130K\n<\/code><\/pre>\n
\n2. Targeted Brute Force Attacks<\/h3>\n
\n
$targetAccounts = @(\n \"Administrator\",\n \"john.admin\",\n \"backup.admin\",\n \"sql.service\"\n)\n\nforeach ($account in $targetAccounts) {\n Invoke-BruteForce -Username $account -PasswordList $commonPasswords\n}\n<\/code><\/pre>\n
\n3. Social Engineering Amplification<\/h3>\n
\n
\n
\n4. Lateral Movement Planning<\/h3>\n
\n
function Get-PrivilegedAccounts {\n $adminAccounts = @()\n foreach ($account in $enumeratedAccounts) {\n $user = Get-ADUser -Identity $account -Properties MemberOf\n if ($user.MemberOf -match \"Domain Admins|Enterprise Admins|Administrators\") {\n $adminAccounts += $user\n }\n }\n return $adminAccounts\n}\n<\/code><\/pre>\n
\nÇözüm Yöntemleri<\/h2>\n
1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n
\n
gpmc.msc<\/code><\/p>\n<\/li>\nDomain Policy\n\u2514\u2500\u2500 Computer Configuration\n \u2514\u2500\u2500 Administrative Templates\n \u2514\u2500\u2500 Windows Components\n \u2514\u2500\u2500 Credential User Interface\n \u2514\u2500\u2500 Enumerate administrator accounts on elevation: DISABLED\n<\/code><\/pre>\n
\n2. Registry ile Manuel Yap\u0131land\u0131rma<\/h3>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\n<\/code><\/pre>\n\n
EnumerateAdministrators<\/code> (REG_DWORD)<\/p>\n<\/li>\n0<\/code> = Disabled<\/p>\n<\/li>\n<\/ul>\n$registryPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\"\n\nif (!(Test-Path $registryPath)) {\n New-Item -Path $registryPath -Force | Out-Null\n}\n\nSet-ItemProperty -Path $registryPath -Name \"EnumerateAdministrators\" -Value 0 -Type DWord\n<\/code><\/pre>\nreg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\" ^\n \/v EnumerateAdministrators \/t REG_DWORD \/d 0 \/f\n<\/code><\/pre>\n
\n3. PowerShell DSC (Desired State Configuration)<\/h3>\n
Configuration DisableAdminEnumeration {\n Node 'localhost' {\n Registry DisableAdminEnum {\n Key = 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI'\n ValueName = 'EnumerateAdministrators'\n ValueData = '0'\n ValueType = 'Dword'\n Ensure = 'Present'\n }\n }\n}\n<\/code><\/pre>\n
\nGeli\u015fmi\u015f Güvenlik Stratejileri<\/h2>\n
1. Comprehensive UAC Hardening<\/h3>\n
ConsentPromptBehaviorAdmin = 2\nConsentPromptBehaviorUser = 3\nPromptOnSecureDesktop = 1\nEnableInstallerDetection = 1\n<\/code><\/pre>\n\n\n
\n \nSeviye<\/th>\n Aç\u0131klama<\/th>\n Güvenlik<\/th>\n<\/tr>\n<\/thead>\n \n 0<\/td>\n Never notify<\/td>\n \u274c<\/td>\n<\/tr>\n \n 1<\/td>\n Prompt for credentials<\/td>\n \u26a0\ufe0f<\/td>\n<\/tr>\n \n 2<\/td>\n Prompt for consent<\/td>\n \u2705<\/td>\n<\/tr>\n \n 3<\/td>\n Prompt for credentials (secure desktop)<\/td>\n \u2705\u2705<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n2. Credential Guard Entegrasyonu<\/h3>\n
\n
\n3. Privileged Access Management (PAM)<\/h3>\n
\n
\nMonitoring ve Detection<\/h2>\n
Event Log Analysis<\/h3>\n
\n
\nAdvanced Threat Detection<\/h3>\n
\n
\nSIEM Integration<\/h3>\n
\n
\nCompliance ve Audit<\/h2>\n
Framework Mapping<\/h3>\n
\n
\nAutomated Compliance Checking<\/h3>\n
\n
\nUser Experience Considerations<\/h2>\n
Training ve Awareness<\/h3>\n
\n
\n
\nSonuç ve Öneriler<\/h2>\n
\nKritik Uygulama Ad\u0131mlar\u0131<\/h3>\n
\u2705 GPO ile devre d\u0131\u015f\u0131 b\u0131rak\u0131n
\u2705 Registry ayarlar\u0131n\u0131 do\u011frulay\u0131n
\u2705 Monitoring & alerting kurun
\u2705 IT staff’\u0131 e\u011fitin
\u2705 Compliance kontrollerini otomatikle\u015ftirin<\/p>\n
\nH\u0131zl\u0131 Kontrol Listesi<\/h3>\n
\u2705 Registry de\u011feri 0<\/code> m\u0131?
\u2705 GPO tüm bilgisayarlara uyguland\u0131 m\u0131?
\u2705 UAC hardening tamam m\u0131?
\u2705 Event log monitoring aktif mi?
\u2705 Help desk süreçleri güncel mi?<\/p>\n
\nEk Güvenlik Önerileri<\/h3>\n
\n
\n