[{"id":366,"title":"Domain Kullan\u0131c\u0131s\u0131na GPO \u0130le Local Admin Yetkisi Vermek","content":"<p>Merhaba dostlar!<\/p>\n<p>Bug&uuml;n biraz BT d&uuml;nyas\u0131n\u0131n <em>gizli kahramanlar\u0131ndan<\/em> bahsedece\u011fiz: <strong>Group Policy (GPO)<\/strong> ile bir kullan\u0131c\u0131ya <strong>Local Administrator<\/strong> yetkisi vermek. Evet, kula\u011fa teknik geliyor &mdash; ama asl\u0131nda bu i\u015flem, do\u011fru yap\u0131ld\u0131\u011f\u0131nda hem g&uuml;venli hem de pratik olabilir.<\/p>\n<p><iframe style=\"width: 661px; height: 372px;\" src=\"https:\/\/www.youtube.com\/embed\/gDgPWvOmqkQ\" width=\"661\" height=\"372\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h3>&nbsp;Neden Buna \u0130htiya&ccedil; Duyar\u0131z?<\/h3>\n<p>Genellikle \u015firket a\u011f\u0131nda kullan\u0131c\u0131lar sadece temel izinlere sahiptir. Bu, g&uuml;venlik i&ccedil;in harika bir \u015feydir. Ancak bazen baz\u0131 programlar\u0131n y&uuml;klenmesi, g&uuml;ncellemelerin yap\u0131lmas\u0131 ya da &ouml;zel bir yaz\u0131l\u0131m\u0131n &ccedil;al\u0131\u015ft\u0131r\u0131lmas\u0131 gerekti\u011finde sadece standart &ldquo;Domain User&rdquo; yetkisi yeterli olmaz. \u0130\u015fte bu gibi durumlarda o kullan\u0131c\u0131ya <strong>Local Admin yetkisi<\/strong> verilmesi gerekir.<\/p>\n<p>Ama elbette, bu i\u015flemi tek tek her bilgisayarda yapmak ideal de\u011fildir. Hem zaman al\u0131r, hem de tutars\u0131z sonu&ccedil;lara yol a&ccedil;abilir. Bu nedenle, Active Directory &uuml;zerinden bir <strong>Group Policy<\/strong> arac\u0131l\u0131\u011f\u0131yla bu yetkiyi topluca vermek en temiz &ccedil;&ouml;z&uuml;md&uuml;r.<\/p>\n<h2>Ne Yapaca\u011f\u0131z?<\/h2>\n<p>Amac\u0131m\u0131z \u015fu:<\/p>\n<p>\ud83d\udc49 Bir veya birka&ccedil; kullan\u0131c\u0131ya <strong>Local Admin<\/strong> yetkisi vermek,<br>\ud83d\udc49 Bunu merkezi ve g&uuml;venli bir \u015fekilde <strong>GPO ile<\/strong> ger&ccedil;ekle\u015ftirmek.<\/p>\n<hr>\n<h2>\ud83d\udee0 Ad\u0131m Ad\u0131m Pratik Rehber \ud83d\udca1<\/h2>\n<h3>1. Kullan\u0131c\u0131lar\u0131 Bir Grup Alt\u0131nda Topla<\/h3>\n<p>Gelin &ouml;nce, Local Admin yetkisi verilmesini istedi\u011fimiz kullan\u0131c\u0131lar\u0131 grupland\u0131ral\u0131m. Active Directory&rsquo;de yeni bir g&uuml;venlik grubu olu\u015fturup bu kullan\u0131c\u0131lar\u0131 i&ccedil;ine ekleyin. Bu, ileride y&ouml;netimi kolayla\u015ft\u0131r\u0131r.<\/p>\n<hr>\n<h3>2.&nbsp; Yeni Bir GPO Olu\u015ftur<\/h3>\n<p>Active Directory <strong>Group Policy Management<\/strong>&rsquo;a girin ve yeni bir GPO (Group Policy Object) olu\u015fturun.<\/p>\n<hr>\n<h3>3. \ud83e\udde9 GPO \u0130&ccedil;erisinde Yetkiyi Belirt<\/h3>\n<p>Olu\u015fturdu\u011funuz GPO&rsquo;yu <strong>Edit<\/strong> ile a&ccedil;\u0131n.<br>Ard\u0131ndan:<\/p>\n<p>\ud83d\udc49 &ldquo;Browse&hellip;&rdquo; ile az &ouml;nce olu\u015fturdu\u011funuz g&uuml;venlik grubunu se&ccedil;in<br>\ud83d\udc49 &ldquo;Add&hellip;&rdquo; ile bu grubu <strong>Administrators<\/strong> grubuna ekleyin<\/p>\n<p>Bu sayede o grubun &uuml;yeleri, yetkili olduklar\u0131 bilgisayarlarda art\u0131k Local Admin olacaklar.<\/p>\n<hr>\n<h3>4.&nbsp; GPO&rsquo;yu OU&rsquo;ya Uygula<\/h3>\n<p>Haz\u0131rlad\u0131\u011f\u0131n\u0131z GPO&rsquo;yu, bu yetkinin uygulanmas\u0131n\u0131 istedi\u011finiz OU&rsquo;ya (Organizational Unit) linkleyin. B&ouml;ylece ilgili t&uuml;m bilgisayarlara otomatik olarak uygulanacakt\u0131r.<\/p>\n<hr>\n<h3>5.&nbsp; De\u011fi\u015fiklikleri Zorla G&uuml;ncelle<\/h3>\n<p>Yeni ayarlar\u0131n hemen uygulanmas\u0131n\u0131 istiyorsan\u0131z \u015fu komutu kullanabilirsiniz:<\/p>\n<pre><code class=\"language-bash\">gpupdate \/force\n<\/code><\/pre>\n<p>Bu komut &ouml;nce Domain Controller&rsquo;da, ard\u0131ndan kullan\u0131c\u0131 bilgisayar\u0131nda &ccedil;al\u0131\u015ft\u0131r\u0131l\u0131r.<\/p>\n<hr>\n<h2>&nbsp;Sonu&ccedil;: Hem G&uuml;venli, Hem Kontrol Edilebilir<\/h2>\n<p>Bu y&ouml;ntem sayesinde:<\/p>\n<p>\u2705 \u0130zinleri tek tek manuel vermek zorunda kalmazs\u0131n\u0131z<br>\u2705 IT s&uuml;re&ccedil;leriniz daha tutarl\u0131 ve g&uuml;venli olur<br>\u2705 GPO sayesinde t&uuml;m yap\u0131y\u0131 merkezi olarak y&ouml;netirsiniz<\/p>\n<p>Her ne kadar Local Admin yetkisi b&uuml;y&uuml;k bir g&uuml;&ccedil; gibi g&ouml;r&uuml;nse de, dikkatli kullan\u0131lmas\u0131 gerekir. Sadece ger&ccedil;ekten ihtiya&ccedil; duyan kullan\u0131c\u0131lar\u0131 bu kapsama alman\u0131z\u0131 &ouml;neririm.<\/p>\n<p>&nbsp;<\/p>","excerpt":"Bug\u00fcn biraz BT d\u00fcnyas\u0131n\u0131n gizli kahramanlar\u0131ndan bahsedece\u011fiz: Group Policy (GPO) ile bir kullan\u0131c\u0131ya Local Administrator yetkisi vermek. Evet, kula\u011fa teknik geliyor \u2014 ama asl\u0131nda bu i\u015flem, do\u011fru yap\u0131ld\u0131\u011f\u0131nda hem g\u00fcvenli hem de pratik olabilir.","created_at":"2025-12-19 08:52:13","updated_at":"2026-09-23 14:17:48","category_id":6,"view_count":502,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-19 06:09:47","featured_image":"\/uploads\/images\/2025\/12\/6944eb9b6e308_1766124443.png","slug":"domain-kullanicisina-gpo-ile-local-admin-yetkisi-vermek","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":349,"title":"Windows GPO Tabanl\u0131 Uygulama Engelleme: Kullan\u0131c\u0131 Ba\u011flam\u0131nda G\u00fcvenlik Sertle\u015ftirmesi","content":"<p>Bu yap\u0131land\u0131rma,&nbsp;<strong>Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme<\/strong> stratejisi ile LOLBins ve bilinen k&ouml;t&uuml; ama&ccedil;l\u0131 yaz\u0131l\u0131mlar\u0131n &ccedil;al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 y&uuml;zeyini minimize eder.<\/p>\n<h2>Temel GPO Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>1. Yeni GPO Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\"># PowerShell ile GPO olu\u015fturma\nNew-GPO -Name \"W11-User-Application-Blocking\" -Comment \"LOLBins ve malware engellemesi\"\n\n# OU'ya ba\u011flama\nNew-GPLink -Name \"W11-User-Application-Blocking\" `\n           -Target \"OU=Users,DC=contoso,DC=local\" `\n           -LinkEnabled Yes `\n           -Order 1\n<\/code><\/pre>\n<h3>2. Loopback Processing Yap\u0131land\u0131rmas\u0131<\/h3>\n<pre><code>Computer Configuration &rarr; Policies &rarr; Administrative Templates &rarr; System &rarr; Group Policy\n&rarr; \"Configure user Group Policy loopback processing mode\" = Enabled (Merge mode)\n<\/code><\/pre>\n<h2>&nbsp;Security Filtering Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>PowerShell ile G&uuml;venlik Filtreleme<\/h3>\n<pre><code class=\"language-powershell\"># GPO Security Filtering ayarlama\n$GPO = Get-GPO -Name \"W11-User-Application-Blocking\"\n\n# Varsay\u0131lan \"Authenticated Users\" kald\u0131r\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Authenticated Users\" `\n                  -TargetType Group `\n                  -PermissionLevel None\n\n# Standart kullan\u0131c\u0131lar\u0131 ekle\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Domain Users\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Local Users ekle (SID kullanarak)\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"S-1-5-32-545\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Hari&ccedil; tutulacak gruplar (Read only izni)\n$ExcludedGroups = @(\n    \"Domain Admins\",\n    \"Enterprise Admins\",\n    \"IT-Helpdesk\",\n    \"Security-Admins\"\n)\n\nforeach ($group in $ExcludedGroups) {\n    Set-GPPermission -Name $GPO.DisplayName `\n                      -TargetName $group `\n                      -TargetType Group `\n                      -PermissionLevel GpoRead\n}\n<\/code><\/pre>\n<h2>Engellenecek Uygulamalar Listesi<\/h2>\n<h3>Kategorize Edilmi\u015f Engelleme Listesi<\/h3>\n<pre><code class=\"language-powershell\"># Tam engelleme listesi\n$BlockedApplications = @{\n    # Script Motorlar\u0131 ve Shell'ler\n    \"ScriptEngines\" = @(\n        \"powershell.exe\",\n        \"pwsh.exe\",\n        \"powershell_ise.exe\",\n        \"wscript.exe\",\n        \"cscript.exe\",\n        \"mshta.exe\",\n        \"cmd.exe\",\n        \"bash.exe\",\n        \"wsl.exe\"\n    )\n    \n    # \u0130ndirme\/C2 LOLBins\n    \"DownloadC2\" = @(\n        \"bitsadmin.exe\",\n        \"certutil.exe\",\n        \"curl.exe\",\n        \"ftp.exe\",\n        \"tftp.exe\",\n        \"xwizard.exe\"\n    )\n    \n    # Kurulum\/Proxy-Execution\n    \"ProxyExecution\" = @(\n        \"msiexec.exe\",\n        \"installutil.exe\",\n        \"regsvr32.exe\",\n        \"rundll32.exe\"\n    )\n    \n    # Persistence\/Lateral Movement\n    \"PersistenceLateral\" = @(\n        \"schtasks.exe\",\n        \"wmic.exe\",\n        \"winrs.exe\",\n        \"cmdkey.exe\",\n        \"reg.exe\"\n    )\n    \n    # Bilinen Malware\/Ara&ccedil;lar\n    \"KnownMalware\" = @(\n        \"agenttesla.exe\",\n        \"darkcomet.exe\",\n        \"havoc.exe\",\n        \"masscan.exe\",\n        \"meterpreter.exe\",\n        \"mimikatz.exe\",\n        \"mimilib.dll\",\n        \"msfvenom.exe\",\n        \"mythic.exe\",\n        \"nanocore.exe\",\n        \"ncat.exe\",\n        \"netcat.exe\",\n        \"nmap.exe\",\n        \"nping.exe\",\n        \"pathping.exe\",\n        \"pcalua.exe\",\n        \"pubprn.vbs\",\n        \"remcos.exe\",\n        \"revenge_rat.exe\",\n        \"sekurlsa.exe\",\n        \"sliver.exe\",\n        \"teamserver.exe\",\n        \"token.exe\",\n        \"vbc.exe\",\n        \"wevtutil.exe\",\n        \"winexe.exe\",\n        \"wusa.exe\",\n        \"xwizard.exe\",\n        \"wlrmdr.exe\",\n        \"zmap.exe\"\n    )\n}\n<\/code><\/pre>\n<h2>GPO Registry Ayarlar\u0131<\/h2>\n<h3>Registry.pol Dosyas\u0131 Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\">function Create-AppBlockingRegistry {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    $regPath = \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\"\n    \n    # Komut sat\u0131r\u0131 eri\u015fimini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableCMD\" `\n        -Type DWORD `\n        -Value 2\n    \n    # Registry edit&ouml;rlerini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableRegistryTools\" `\n        -Type DWORD `\n        -Value 1\n    \n    # Run men&uuml;s&uuml;n&uuml; devre d\u0131\u015f\u0131 b\u0131rak\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"NoRun\" `\n        -Type DWORD `\n        -Value 1\n}\n<\/code><\/pre>\n<h2>Software Restriction Policies (SRP) Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>PowerShell ile SRP Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\">function Configure-SoftwareRestrictionPolicies {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # SRP i&ccedil;in temel path\n    $srpPath = \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\"\n    \n    # Varsay\u0131lan g&uuml;venlik seviyesi (Unrestricted)\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $srpPath `\n        -ValueName \"DefaultLevel\" `\n        -Type DWORD `\n        -Value 262144\n    \n    # Her bir engellenecek uygulama i&ccedil;in hash rule olu\u015ftur\n    $ruleGuid = 0\n    foreach ($category in $BlockedApplications.Keys) {\n        foreach ($app in $BlockedApplications[$category]) {\n            $ruleGuid++\n            $guidString = \"{\" + [guid]::NewGuid().ToString().ToUpper() + \"}\"\n            \n            # Path rule olu\u015ftur\n            $rulePath = \"$srpPath\\0\\Paths\\$guidString\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"ItemData\" `\n                -Type String `\n                -Value \"*\\$app\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"SaferFlags\" `\n                -Type DWORD `\n                -Value 0\n        }\n    }\n}\n<\/code><\/pre>\n<h2>ADMX Template Olu\u015fturma<\/h2>\n<h3>Custom ADMX Template<\/h3>\n<pre><code class=\"language-xml\">&lt;?xml version=\"1.0\" encoding=\"utf-8\"?&gt;\n&lt;policyDefinitions xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"\n                   xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n                   revision=\"1.0\"\n                   schemaVersion=\"1.0\"\n                   xmlns=\"http:\/\/schemas.microsoft.com\/GroupPolicy\/2006\/07\/PolicyDefinitions\"&gt;\n  \n  &lt;policyNamespaces&gt;\n    &lt;target prefix=\"w11block\" namespace=\"Microsoft.Policies.W11ApplicationBlocking\" \/&gt;\n  &lt;\/policyNamespaces&gt;\n  \n  &lt;resources minRequiredRevision=\"1.0\" \/&gt;\n  \n  &lt;categories&gt;\n    &lt;category name=\"W11_App_Blocking\" displayName=\"$(string.W11_App_Blocking)\"&gt;\n      &lt;parentCategory ref=\"windows:System\" \/&gt;\n    &lt;\/category&gt;\n  &lt;\/categories&gt;\n  \n  &lt;policies&gt;\n    &lt;policy name=\"BlockLOLBins\" \n            class=\"User\" \n            displayName=\"$(string.BlockLOLBins)\"\n            explainText=\"$(string.BlockLOLBins_Help)\"\n            key=\"Software\\Policies\\W11Block\"\n            valueName=\"BlockLOLBins\"&gt;\n      &lt;parentCategory ref=\"W11_App_Blocking\" \/&gt;\n      &lt;supportedOn ref=\"windows:SUPPORTED_Windows_10_0\" \/&gt;\n      &lt;enabledValue&gt;\n        &lt;decimal value=\"1\" \/&gt;\n      &lt;\/enabledValue&gt;\n      &lt;disabledValue&gt;\n        &lt;decimal value=\"0\" \/&gt;\n      &lt;\/disabledValue&gt;\n    &lt;\/policy&gt;\n  &lt;\/policies&gt;\n&lt;\/policyDefinitions&gt;\n<\/code><\/pre>\n<h2>Test ve Do\u011frulama<\/h2>\n<h3>Test Script'i<\/h3>\n<pre><code class=\"language-powershell\">function Test-ApplicationBlocking {\n    [CmdletBinding()]\n    param(\n        [string]$TestUser = \"testuser@domain.local\"\n    )\n    \n    # Test edilecek uygulamalar\n    $testApps = @(\n        @{Name=\"PowerShell\"; Path=\"powershell.exe\"; Command=\"-NoProfile -Command Write-Host 'Test'\"},\n        @{Name=\"CMD\"; Path=\"cmd.exe\"; Command=\"\/c echo Test\"},\n        @{Name=\"CertUtil\"; Path=\"certutil.exe\"; Command=\"-?\"}\n    )\n    \n    Write-Host \"Testing Application Blocking for: $TestUser\" -ForegroundColor Cyan\n    Write-Host \"=\" * 50\n    \n    foreach ($app in $testApps) {\n        try {\n            # RunAs ile test\n            $credential = Get-Credential -UserName $TestUser\n            $process = Start-Process -FilePath $app.Path `\n                                    -ArgumentList $app.Command `\n                                    -Credential $credential `\n                                    -PassThru `\n                                    -Wait `\n                                    -ErrorAction Stop\n            \n            if ($process.ExitCode -eq 0) {\n                Write-Host \"\u274c $($app.Name): NOT BLOCKED\" -ForegroundColor Red\n            } else {\n                Write-Host \"\u2705 $($app.Name): BLOCKED\" -ForegroundColor Green\n            }\n        }\n        catch {\n            Write-Host \"\u2705 $($app.Name): BLOCKED (Exception)\" -ForegroundColor Green\n        }\n    }\n}\n<\/code><\/pre>\n<h2>Rollback Plan\u0131<\/h2>\n<h3>Acil Durum Geri Alma<\/h3>\n<pre><code class=\"language-powershell\">function Emergency-Rollback {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # GPO'yu devre d\u0131\u015f\u0131 b\u0131rak\n    $GPO = Get-GPO -Name $GPOName\n    $GPO.GpoStatus = \"AllSettingsDisabled\"\n    \n    # GPO linklerini kald\u0131r\n    Get-GPOReport -Name $GPOName -ReportType Xml | \n        Select-Xml -XPath \"\/\/LinksTo\/SOMPath\" | \n        ForEach-Object {\n            Remove-GPLink -Name $GPOName -Target $_.Node.InnerText -Confirm:$false\n        }\n    \n    # Kullan\u0131c\u0131larda zorla g&uuml;ncelleme\n    Invoke-Command -ComputerName (Get-ADComputer -Filter *).Name -ScriptBlock {\n        gpupdate \/force\n    }\n    \n    Write-Host \"Emergency rollback completed!\" -ForegroundColor Yellow\n}\n<\/code><\/pre>\n<h2>Monitoring ve Raporlama<\/h2>\n<h3>Event Log \u0130zleme<\/h3>\n<pre><code class=\"language-powershell\"># AppLocker\/SRP event monitoring\nfunction Get-BlockedApplicationEvents {\n    param(\n        [int]$Hours = 24\n    )\n    \n    $startTime = (Get-Date).AddHours(-$Hours)\n    \n    # Event ID'ler\n    # 865: SRP blocked\n    # 866: SRP warning\n    # 8003: AppLocker blocked\n    \n    Get-WinEvent -FilterHashtable @{\n        LogName = 'Application'\n        ID = 865, 866, 8003\n        StartTime = $startTime\n    } | Select-Object TimeCreated, Id, Message, UserId |\n        Export-Csv \"BlockedApps_$(Get-Date -Format 'yyyyMMdd').csv\"\n}\n<\/code><\/pre>\n<h2>&Ouml;nemli Uyar\u0131lar<\/h2>\n<h3>Kritik Dikkat Edilmesi Gerekenler<\/h3>\n<ol>\n<li>\n<p><strong>rundll32.exe Engelleme<\/strong><\/p>\n<ul>\n<li>Bir&ccedil;ok sistem fonksiyonu rundll32 kullan\u0131r<\/li>\n<li>Engellemeden &ouml;nce kapsaml\u0131 test yap\u0131n<\/li>\n<li>Alternatif: Yaln\u0131zca belirli DLL'lere izin verin<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>msiexec.exe K\u0131s\u0131tlamas\u0131<\/strong><\/p>\n<ul>\n<li>Windows Update'ler etkilenebilir<\/li>\n<li>SCCM\/Intune da\u011f\u0131t\u0131mlar\u0131 bozulabilir<\/li>\n<li>&Ccedil;&ouml;z&uuml;m: Sistem hesaplar\u0131 i&ccedil;in istisna<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>wevtutil.exe<\/strong><\/p>\n<ul>\n<li>Log toplama sistemleri etkilenebilir<\/li>\n<li>SIEM entegrasyonlar\u0131 kontrol edilmeli<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h2>\u0130leri Seviye Yap\u0131land\u0131rmalar<\/h2>\n<h3>AppLocker ile Entegrasyon<\/h3>\n<pre><code class=\"language-xml\">&lt;AppLockerPolicy Version=\"1\"&gt;\n  &lt;RuleCollection Type=\"Exe\" EnforcementMode=\"Enabled\"&gt;\n    &lt;FilePublisherRule Id=\"a61c8b3c-a27f-4c8b-8e8a-8b4e62d8565f\" \n                       Name=\"MICROSOFT WINDOWS OPERATING SYSTEM\" \n                       Description=\"\" \n                       UserOrGroupSid=\"S-1-1-0\" \n                       Action=\"Allow\"&gt;\n      &lt;Conditions&gt;\n        &lt;FilePublisherCondition PublisherName=\"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\" \n                                ProductName=\"MICROSOFT&reg; WINDOWS&reg; OPERATING SYSTEM\" \n                                BinaryName=\"*\"&gt;\n          &lt;BinaryVersionRange LowSection=\"*\" HighSection=\"*\"\/&gt;\n        &lt;\/FilePublisherCondition&gt;\n      &lt;\/Conditions&gt;\n      &lt;Exceptions&gt;\n        &lt;!-- LOLBins exception listesi --&gt;\n        &lt;FilePathCondition Path=\"%SYSTEM32%\\certutil.exe\"\/&gt;\n        &lt;FilePathCondition Path=\"%SYSTEM32%\\bitsadmin.exe\"\/&gt;\n      &lt;\/Exceptions&gt;\n    &lt;\/FilePublisherRule&gt;\n  &lt;\/RuleCollection&gt;\n&lt;\/AppLockerPolicy&gt;\n<\/code><\/pre>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>Bu GPO tabanl\u0131 uygulama engelleme stratejisi:<\/p>\n<ul>\n<li>\u2705 Kullan\u0131c\u0131 seviyesinde g&uuml;&ccedil;l&uuml; kontrol sa\u011flar<\/li>\n<li>\u2705 LOLBins sald\u0131r\u0131 vekt&ouml;rlerini minimize eder<\/li>\n<li>\u2705 MITRE ATT&amp;CK T1218 tekniklerini engeller<\/li>\n<li>\u2705 Zero Trust prensipleriyle uyumludur<\/li>\n<\/ul>\n<p><strong>Kritik Ba\u015far\u0131 Fakt&ouml;rleri:<\/strong><\/p>\n<ol>\n<li>Test ortam\u0131nda kapsaml\u0131 validasyon<\/li>\n<li>Kademeli da\u011f\u0131t\u0131m stratejisi<\/li>\n<li>\u0130stisna y&ouml;netimi prosed&uuml;rleri<\/li>\n<li>S&uuml;rekli monitoring ve iyile\u015ftirme<\/li>\n<\/ol>\n<p>v<\/p>","excerpt":"Bu yap\u0131land\u0131rma,\u00a0Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme stratejisi ile LOLBins ve bilinen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 y\u00fczeyini minimize eder.","created_at":"2025-11-26 17:47:33","updated_at":"2026-09-08 00:39:21","category_id":6,"view_count":747,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-26 14:47:33","featured_image":"resimyok.jpg","slug":"windows-gpo-tabanli-uygulama-engelleme-kullanici-baglaminda-guvenlik-sertlestirmesi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":329,"title":"Windows 11 25H2: IT Ekiplerine Bloatware Kontrol\u00fc","content":"<p>Kurumsal cihaz y&ouml;netiminde&nbsp;<strong>k&uuml;&ccedil;&uuml;k g&ouml;r&uuml;nen ama b&uuml;y&uuml;k fark yaratan<\/strong> bir d&ouml;neme giriyoruz.<br>Microsoft&rsquo;un yeni s&uuml;r&uuml;m&uuml; <strong>Windows 11 25H2<\/strong>, sistem y&ouml;neticilerine y\u0131llard\u0131r beklenen bir g&uuml;&ccedil; kazand\u0131r\u0131yor:<\/p>\r\n<blockquote>\r\n<p>Art\u0131k &ouml;nceden y&uuml;kl&uuml; gelen gereksiz uygulamalar\u0131 (bloatware) tamamen kontrol alt\u0131na almak m&uuml;mk&uuml;n.<\/p>\r\n<\/blockquote>\r\n<hr>\r\n<h2>Art\u0131k IT&rsquo;nin Elinde: Gereksiz Uygulamalara Elveda<\/h2>\r\n<p>Yeni <strong>Group Policy<\/strong> (Grup \u0130lkesi) ayarlar\u0131 sayesinde IT ekipleri, kullan\u0131c\u0131 cihazlar\u0131na otomatik y&uuml;klenen uygulamalar\u0131 devre d\u0131\u015f\u0131 b\u0131rakabiliyor veya tamamen kald\u0131rabiliyor.<br>Bunlar aras\u0131nda \u015funlar yer al\u0131yor:<\/p>\r\n<ul>\r\n<li>\r\n<p>OneDrive<\/p>\r\n<\/li>\r\n<li>\r\n<p>Copilot<\/p>\r\n<\/li>\r\n<li>\r\n<p>TikTok<\/p>\r\n<\/li>\r\n<li>\r\n<p>Spotify<\/p>\r\n<\/li>\r\n<li>\r\n<p>ve di\u011fer Microsoft Store uygulamalar\u0131<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p>&Uuml;stelik kullan\u0131c\u0131 sisteme ilk kez giri\u015f yapt\u0131\u011f\u0131nda, bu uygulamalar <strong>hi&ccedil; y&uuml;klenmemi\u015f gibi<\/strong> davran\u0131yor.<br>Yani art\u0131k ilk oturumda gereksiz uygulama y&uuml;kleme s&uuml;re&ccedil;leriyle zaman kayb\u0131 yok.<\/p>\r\n<hr>\r\n<h2>PowerShell&rsquo;e Gerek Yok, Kontrol Art\u0131k Politikalarda<\/h2>\r\n<p>Daha &ouml;nce bu i\u015flemler i&ccedil;in <strong>PowerShell script&rsquo;leri<\/strong>, &ouml;zel imajlar veya &uuml;&ccedil;&uuml;nc&uuml; taraf ara&ccedil;lar gerekiyordu.<br>Windows 11 25H2 ile bu d&ouml;nem kapand\u0131.<\/p>\r\n<p>Yeni Group Policy sayesinde art\u0131k:<\/p>\r\n<ul>\r\n<li>\r\n<p>Bloatware y&uuml;klenmesini sistem genelinde engelleyebilir,<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Intune<\/strong> veya <strong>GPO<\/strong> &uuml;zerinden merkezi y&ouml;netim uygulayabilir,<\/p>\r\n<\/li>\r\n<li>\r\n<p>De\u011fi\u015fiklikleri cihazlara <strong>ilk oturum a&ccedil;\u0131l\u0131\u015f\u0131nda otomatik olarak<\/strong> yans\u0131tabilirsiniz.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p>Sonu&ccedil;?<br>Her cihaz ayn\u0131 \u015fekilde ba\u015flar, ayn\u0131 politikayla &ccedil;al\u0131\u015f\u0131r.<\/p>\r\n<hr>\r\n<h2>Daha Temiz, Daha H\u0131zl\u0131, Daha G&uuml;venli<\/h2>\r\n<p>Bu yenilik sadece performans\u0131 de\u011fil, <strong>kurumsal g&uuml;venli\u011fi ve standartla\u015fmay\u0131<\/strong> da do\u011frudan etkiliyor.<br>Art\u0131k her cihaz:<\/p>\r\n<ul>\r\n<li>\r\n<p>Daha az gereksiz uygulamayla a&ccedil;\u0131l\u0131yor,<\/p>\r\n<\/li>\r\n<li>\r\n<p>Daha az kaynak t&uuml;ketiyor,<\/p>\r\n<\/li>\r\n<li>\r\n<p>Daha az g&uuml;venlik y&uuml;zeyine sahip oluyor.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p>IT ekipleri i&ccedil;in bu, daha kolay y&ouml;netim ve daha az karma\u015fa anlam\u0131na geliyor.<br>Kullan\u0131c\u0131lar i&ccedil;inse daha h\u0131zl\u0131, daha ak\u0131c\u0131 bir deneyim.<\/p>\r\n<hr>\r\n<h2>Az Uygulama, Az Risk. Az Karma\u015fa, &Ccedil;ok Kontrol.<\/h2>\r\n<p>Windows 11 25H2 ile Microsoft, i\u015fletim sisteminin kontrol&uuml;n&uuml; yeniden profesyonellere teslim ediyor.<br>Bloatware art\u0131k kader de\u011fil &mdash; bir tercihe d&ouml;n&uuml;\u015f&uuml;yor.<\/p>\r\n<blockquote>\r\n<p><strong>Az uygulama, az risk. Az karma\u015fa, &ccedil;ok kontrol.<\/strong><br>Her cihaz ayn\u0131 d&uuml;zende, ayn\u0131 politikayla, ayn\u0131 standartta ba\u015fl\u0131yor.<\/p>\r\n<\/blockquote>\r\n<p>Bu sadece bir teknik iyile\u015ftirme de\u011fil, ayn\u0131 zamanda <strong>kurumsal verimlilik ve g&uuml;venlik i&ccedil;in insan merkezli bir ad\u0131m.<\/strong><\/p>\r\n<hr>\r\n<h2>IT Ekosisteminde Yeni Bir D&ouml;nem<\/h2>\r\n<p>Windows 11 25H2, IT ekipleri i&ccedil;in yaln\u0131zca bir g&uuml;ncelleme de\u011fil, <strong>y&ouml;netim paradigmas\u0131nda bir d&ouml;n&uuml;\u015f&uuml;m.<\/strong><br>Art\u0131k:<\/p>\r\n<ul>\r\n<li>\r\n<p>PowerShell yazmadan merkezi kontrol sa\u011flanabiliyor,<\/p>\r\n<\/li>\r\n<li>\r\n<p>Intune politikalar\u0131yla cihazlar ayn\u0131 standartta ba\u015fl\u0131yor,<\/p>\r\n<\/li>\r\n<li>\r\n<p>Bloatware y&uuml;k&uuml; tarih oluyor.<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p>Daha sade, g&uuml;venli ve verimli bir Windows deneyimi &mdash; hem kullan\u0131c\u0131lar hem de sistem y&ouml;neticileri i&ccedil;in.<\/p>\r\n<p><sup>Windows 11 25H2, IT ekiplerine bloatware &uuml;zerinde tam kontrol sa\u011fl\u0131yor. Yeni Group Policy ayarlar\u0131yla gereksiz uygulamalar\u0131 kald\u0131rmak art\u0131k &ccedil;ok daha kolay.<\/sup><\/p>\r\n<p><sub>Windows 11 25H2, bloatware kontrol&uuml;, Group Policy, Intune, IT y&ouml;netimi, kurumsal Windows, Microsoft, Windows optimizasyonu<\/sub><\/p>\r\n<p>&nbsp;<\/p>","excerpt":"Windows 11 25H2, IT ekiplerine bloatware (\u00f6n y\u00fckl\u00fc uygulamalar) \u00fczerinde tam kontrol veriyor. Yeni Group Policy ayarlar\u0131yla gereksiz uygulamalar\u0131 merkezi olarak kald\u0131rmak art\u0131k \u00e7ok daha kolay.","created_at":"2025-10-30 14:57:56","updated_at":"2026-09-07 14:34:09","category_id":6,"view_count":657,"reading_time":3,"status":"published","editor_choice":1,"is_editor_choice":1,"published_at":"2025-10-30 14:57:00","featured_image":"api_unsplash_1762013938_690632f2919c8.jpg","slug":"windows-11-25h2-it-ekiplerine-bloatware-kontrolu","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":63,"title":"Active Directory Ayr\u0131cal\u0131k Y\u00fckseltme Sald\u0131r\u0131lar\u0131","content":"<h2>\ud83d\udcca Giri\u015f: AD G&uuml;venlik Durumu<\/h2>\r\n<p class=\"ds-markdown-paragraph\"><strong>Active Directory<\/strong>, kurumsal a\u011flar\u0131n %90'\u0131ndan fazlas\u0131nda kullan\u0131l\u0131yor. Microsoft'un verilerine g&ouml;re:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">AD sald\u0131r\u0131lar\u0131 2023'te %67 artt\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Ortalama tespit s&uuml;resi 287 g&uuml;n<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">%85'i i&ccedil; tehdit kaynakl\u0131<\/p>\r\n<\/li>\r\n<\/ul>\r\n<hr>\r\n<h2>\ud83d\udd0d&nbsp;<strong>1. Kerberoasting: Derinlemesine Analiz<\/strong><\/h2>\r\n<h3><strong>Teknik Detaylar<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># PowerShell ile SPN sorgulama<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token punctuation\">{<\/span>ServicePrincipalName <span class=\"token operator\">-like<\/span> <span class=\"token string\">\"*\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>Properties ServicePrincipalName<span class=\"token punctuation\">,<\/span> PasswordLastSet <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> SamAccountName<span class=\"token punctuation\">,<\/span> ServicePrincipalName<span class=\"token punctuation\">,<\/span> PasswordLastSet\r\n\r\n<span class=\"token comment\"># Kerberoasting tespiti i&ccedil;in advanced query<\/span>\r\n<span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Message <span class=\"token operator\">-like<\/span> <span class=\"token string\">\"*0x17*\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> TimeCreated<span class=\"token punctuation\">,<\/span> @<span class=\"token punctuation\">{<\/span>Name=<span class=\"token string\">\"Client\"<\/span><span class=\"token punctuation\">;<\/span>Expression=<span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>0<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Impacket ile advanced Kerberoasting<\/span>\r\npython GetUserSPNs.py <span class=\"token parameter variable\">-request<\/span> -dc-ip <span class=\"token number\">192.168<\/span>.1.1 DOMAIN\/user\r\n\r\n<span class=\"token comment\"># Rubeus ile stealth mode<\/span>\r\nRubeus.exe kerberoast \/outfile:hashes.txt \/domain:domain.local \/dc:DC01.domain.local \/nowrap<\/pre>\r\n<\/div>\r\n<h3><strong>Kapsaml\u0131 Korunma Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Group Policy ile gMSA yap\u0131land\u0131rmas\u0131<\/span>\r\n<span class=\"token comment\"># 1. Hizmet hesab\u0131 parola politikas\u0131<\/span>\r\n<span class=\"token function\">Set-ADDefaultDomainPasswordPolicy<\/span> <span class=\"token operator\">-<\/span>Identity domain<span class=\"token punctuation\">.<\/span>local <span class=\"token operator\">-<\/span>MinPasswordLength 25 <span class=\"token operator\">-<\/span>ComplexityEnabled <span class=\"token boolean\">$true<\/span>\r\n\r\n<span class=\"token comment\"># 2. G&uuml;nl&uuml;k denetim politikas\u0131<\/span>\r\nauditpol <span class=\"token operator\">\/<\/span><span class=\"token function\">set<\/span> <span class=\"token operator\">\/<\/span>subcategory:<span class=\"token string\">\"Kerberos Service Ticket Operations\"<\/span> <span class=\"token operator\">\/<\/span>success:enable <span class=\"token operator\">\/<\/span>failure:enable\r\n\r\n<span class=\"token comment\"># 3. Real-time monitoring script<\/span>\r\n<span class=\"token keyword\">while<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token boolean\">$true<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>MaxEvents 10 <span class=\"token punctuation\">|<\/span> \r\n    <span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>3<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value <span class=\"token operator\">-eq<\/span> <span class=\"token string\">\"0x17\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span>\r\n    <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token function\">Write-Warning<\/span> <span class=\"token string\">\"Kerberoasting attempt detected: <span class=\"token function\">$<span class=\"token punctuation\">(<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>0<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">)<\/span><\/span>\"<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token function\">Start-Sleep<\/span> <span class=\"token operator\">-<\/span>Seconds 30\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfaf&nbsp;<strong>2. AS-REP Roasting: Geli\u015fmi\u015f Savunma<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Tespit Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Pre-auth devre d\u0131\u015f\u0131 hesaplar\u0131 bulma<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token punctuation\">{<\/span>DoesNotRequirePreAuth <span class=\"token operator\">-eq<\/span> <span class=\"token boolean\">$true<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>Properties DoesNotRequirePreAuth<span class=\"token punctuation\">,<\/span> MemberOf <span class=\"token punctuation\">|<\/span>\r\n<span class=\"token function\">Select-Object<\/span> SamAccountName<span class=\"token punctuation\">,<\/span> Name<span class=\"token punctuation\">,<\/span> MemberOf<span class=\"token punctuation\">,<\/span> Enabled\r\n\r\n<span class=\"token comment\"># Advanced logging configuration<\/span>\r\n<span class=\"token comment\"># Event ID 4768: Kerberos TGT requested without pre-auth<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Sald\u0131r\u0131 Senaryosu Geli\u015ftirme<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">python<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Python ile AS-REP Roasting<\/span>\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>asn1 <span class=\"token keyword\">import<\/span> AS_REQ<span class=\"token punctuation\">,<\/span> KERB_PA_PAC_REQUEST\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>kerberosv5 <span class=\"token keyword\">import<\/span> sendReceive\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5 <span class=\"token keyword\">import<\/span> constants\r\n\r\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">asreproast_attack<\/span><span class=\"token punctuation\">(<\/span>username<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">,<\/span> dc_ip<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\r\n    <span class=\"token comment\"># Pre-auth olmadan AS-REQ olu\u015fturma<\/span>\r\n    as_req <span class=\"token operator\">=<\/span> create_as_req<span class=\"token punctuation\">(<\/span>username<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">)<\/span>\r\n    response <span class=\"token operator\">=<\/span> sendReceive<span class=\"token punctuation\">(<\/span>as_req<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">,<\/span> dc_ip<span class=\"token punctuation\">)<\/span>\r\n    <span class=\"token keyword\">return<\/span> extract_encrypted_part<span class=\"token punctuation\">(<\/span>response<span class=\"token punctuation\">)<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Korunma Stratejileri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># T&uuml;m hesaplarda pre-auth zorunlulu\u011fu<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token operator\">*<\/span> <span class=\"token punctuation\">|<\/span> <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Set-ADAccountControl<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>SamAccountName <span class=\"token operator\">-<\/span>DoesNotRequirePreAuth <span class=\"token boolean\">$false<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># Privileged Access Workstations (PAW) yap\u0131land\u0131rmas\u0131<\/span>\r\n<span class=\"token comment\"># 1. Admin hesaplar\u0131 i&ccedil;in PAW zorunlulu\u011fu<\/span>\r\n<span class=\"token comment\"># 2. JIT (Just-In-Time) admin eri\u015fimi<\/span>\r\n<span class=\"token comment\"># 3. Privileged Identity Management<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udd11&nbsp;<strong>3. Pass-the-Hash: Modern Savunmalar<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Teknikleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Mimikatz alternatifleri<\/span>\r\n<span class=\"token comment\"># 1. Procdump + offline analysis<\/span>\r\nprocdump.exe <span class=\"token parameter variable\">-ma<\/span> lsass.exe lsass.dmp\r\nmimikatz.exe <span class=\"token string\">\"sekurlsa::minidump lsass.dmp\"<\/span> <span class=\"token string\">\"sekurlsa::logonPasswords full\"<\/span>\r\n\r\n<span class=\"token comment\"># 2. Comsvcs.dll method<\/span>\r\nrundll32.exe C:<span class=\"token punctuation\">\\<\/span>windows<span class=\"token punctuation\">\\<\/span>system32<span class=\"token punctuation\">\\<\/span>comsvcs.dll MiniDump <span class=\"token punctuation\">(<\/span>Get-Process lsass<span class=\"token punctuation\">)<\/span>.id lsass.dmp full<\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Mekanizmalar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Real-time PtH tespiti<\/span>\r\n<span class=\"token function\">Register-WmiEvent<\/span> <span class=\"token operator\">-<\/span>Query <span class=\"token string\">\"SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_LogonSession'\"<\/span> <span class=\"token operator\">-<\/span>Action <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$logonType<\/span> = <span class=\"token variable\">$Event<\/span><span class=\"token punctuation\">.<\/span>SourceEventArgs<span class=\"token punctuation\">.<\/span>NewEvent<span class=\"token punctuation\">.<\/span>TargetInstance<span class=\"token punctuation\">.<\/span>LogonType\r\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$logonType<\/span> <span class=\"token operator\">-eq<\/span> 3 <span class=\"token operator\">-or<\/span> <span class=\"token variable\">$logonType<\/span> <span class=\"token operator\">-eq<\/span> 9<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token function\">Write-EventLog<\/span> <span class=\"token operator\">-<\/span>LogName <span class=\"token string\">\"Security\"<\/span> <span class=\"token operator\">-<\/span>Source <span class=\"token string\">\"PtH Detector\"<\/span> <span class=\"token operator\">-<\/span>EventId 4658 <span class=\"token operator\">-<\/span>Message <span class=\"token string\">\"Potential PtH detected\"<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># Network monitoring for NTLM<\/span>\r\n<span class=\"token function\">Get-NetEventPacketCapture<\/span> <span class=\"token operator\">-<\/span>CaptureMode SaveToFile <span class=\"token operator\">-<\/span>FileName <span class=\"token string\">\"NTLM_Traffic.pcap\"<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Kapsaml\u0131 Korunma &Ccedil;&ouml;z&uuml;mleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># LSA Protection Configuration<\/span>\r\n<span class=\"token key atrule\">Registry Path<\/span><span class=\"token punctuation\">:<\/span> HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA\r\n<span class=\"token key atrule\">Value<\/span><span class=\"token punctuation\">:<\/span> RunAsPPL\r\n<span class=\"token key atrule\">Type<\/span><span class=\"token punctuation\">:<\/span> DWORD\r\n<span class=\"token key atrule\">Data<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token number\">1<\/span>\r\n\r\n<span class=\"token comment\"># Credential Guard Group Policy<\/span>\r\nComputer Configuration <span class=\"token punctuation\">&gt;<\/span> Administrative Templates <span class=\"token punctuation\">&gt;<\/span> System <span class=\"token punctuation\">&gt;<\/span> Device Guard\r\n<span class=\"token key atrule\">Enable<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">\"Turn On Virtualization Based Security\"<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfab&nbsp;<strong>4. Pass-the-Ticket: Enterprise Savunma<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Vekt&ouml;rleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">python<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Silver Ticket sald\u0131r\u0131s\u0131<\/span>\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5 <span class=\"token keyword\">import<\/span> constants\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>asn1 <span class=\"token keyword\">import<\/span> TGS_REP\r\n\r\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">create_silver_ticket<\/span><span class=\"token punctuation\">(<\/span>domain<span class=\"token punctuation\">,<\/span> sid<span class=\"token punctuation\">,<\/span> target_spn<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\r\n    <span class=\"token comment\"># Service ticket forgery<\/span>\r\n    ticket <span class=\"token operator\">=<\/span> forge_ticket<span class=\"token punctuation\">(<\/span>domain<span class=\"token punctuation\">,<\/span> sid<span class=\"token punctuation\">,<\/span> target_spn<span class=\"token punctuation\">)<\/span>\r\n    <span class=\"token keyword\">return<\/span> inject_ticket<span class=\"token punctuation\">(<\/span>ticket<span class=\"token punctuation\">)<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Kerberos ticket anomaly detection<\/span>\r\n<span class=\"token comment\"># 1. Ticket lifetime monitoring<\/span>\r\n<span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> TimeCreated<span class=\"token punctuation\">,<\/span> @<span class=\"token punctuation\">{<\/span>Name=<span class=\"token string\">\"TicketLifetime\"<\/span><span class=\"token punctuation\">;<\/span>Expression=<span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>7<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># 2. Abnormal ticket requests<\/span>\r\n<span class=\"token comment\"># Event ID 4768: TGT request from unusual location<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Enterprise Korunma Stratejileri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Protected Users Group implementation<\/span>\r\n<span class=\"token comment\"># 1. Admin hesaplar\u0131n\u0131 Protected Users grubuna ekle<\/span>\r\n<span class=\"token function\">Add-ADGroupMember<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token string\">\"Protected Users\"<\/span> <span class=\"token operator\">-<\/span>Members <span class=\"token string\">\"Domain Admins\"<\/span>\r\n\r\n<span class=\"token comment\"># 2. Ticket policies<\/span>\r\n<span class=\"token function\">Set-ADDefaultDomainPasswordPolicy<\/span> <span class=\"token operator\">-<\/span>Identity domain<span class=\"token punctuation\">.<\/span>local <span class=\"token operator\">-<\/span>MaxTicketAge 4<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfdb\ufe0f&nbsp;<strong>5. GPO Abuse: Enterprise Y&ouml;netimi<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO exploitation framework<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Add-MaliciousGPOScript<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token keyword\">param<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$GPOName<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$ScriptContent<\/span><span class=\"token punctuation\">)<\/span>\r\n    \r\n    <span class=\"token variable\">$gpo<\/span> = <span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>Name <span class=\"token variable\">$GPOName<\/span>\r\n    <span class=\"token variable\">$registryPath<\/span> = <span class=\"token string\">\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Scripts\"<\/span>\r\n    \r\n    <span class=\"token comment\"># Startup script ekleme<\/span>\r\n    <span class=\"token function\">Set-GPRegistryValue<\/span> <span class=\"token operator\">-<\/span>Name <span class=\"token variable\">$GPOName<\/span> <span class=\"token operator\">-<\/span>Key <span class=\"token variable\">$registryPath<\/span> <span class=\"token operator\">-<\/span>ValueName <span class=\"token string\">\"Startup\"<\/span> <span class=\"token operator\">-<\/span><span class=\"token function\">Type<\/span> String <span class=\"token operator\">-<\/span>Value <span class=\"token variable\">$ScriptContent<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Sistemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO change monitoring<\/span>\r\n<span class=\"token variable\">$query<\/span> = @<span class=\"token string\">\"\r\nSELECT * FROM __InstanceModificationEvent WITHIN 10 \r\nWHERE TargetInstance ISA 'Win32_GroupPolicy' \r\nAND TargetInstance.DisplayName = 'Default Domain Policy'\r\n\"<\/span>@\r\n\r\n<span class=\"token function\">Register-WmiEvent<\/span> <span class=\"token operator\">-<\/span>Query <span class=\"token variable\">$query<\/span> <span class=\"token operator\">-<\/span>Action <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Write-EventLog<\/span> <span class=\"token operator\">-<\/span>LogName <span class=\"token string\">\"Security\"<\/span> <span class=\"token operator\">-<\/span>Source <span class=\"token string\">\"GPO Monitor\"<\/span> <span class=\"token operator\">-<\/span>EventId 5136 <span class=\"token operator\">-<\/span>Message <span class=\"token string\">\"GPO modification detected\"<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Enterprise GPO G&uuml;venli\u011fi<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO permission auditing<\/span>\r\n<span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>All <span class=\"token punctuation\">|<\/span> <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$permissions<\/span> = <span class=\"token function\">Get-GPPermission<\/span> <span class=\"token operator\">-<\/span>Guid <span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Id <span class=\"token operator\">-<\/span>All\r\n    <span class=\"token variable\">$permissions<\/span> <span class=\"token punctuation\">|<\/span> <span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Permission <span class=\"token operator\">-eq<\/span> <span class=\"token string\">\"GpoEdit\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span>\r\n    <span class=\"token function\">Select-Object<\/span> Trustee<span class=\"token punctuation\">,<\/span> Permission\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># GPO backup automation<\/span>\r\n<span class=\"token variable\">$backupPath<\/span> = <span class=\"token string\">\"\\\\server\\gpo_backup\\\"<\/span>\r\n<span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>All <span class=\"token punctuation\">|<\/span> <span class=\"token function\">Backup-GPO<\/span> <span class=\"token operator\">-<\/span>Path <span class=\"token variable\">$backupPath<\/span> <span class=\"token operator\">-<\/span>Comment <span class=\"token string\">\"Daily GPO Backup\"<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udee1\ufe0f&nbsp;<strong>Proaktif Savunma Stratejileri<\/strong><\/h2>\r\n<h3><strong>1. Advanced Threat Hunting<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># AD anomaly detection framework<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Start-ADThreatHunt<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token comment\"># 1. Kerberoasting avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-Kerberoasting\r\n    \r\n    <span class=\"token comment\"># 2. AS-REP Roasting avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-ASREPRoasting\r\n    \r\n    <span class=\"token comment\"># 3. PtH\/PtT avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-PassTheCredential\r\n    \r\n    <span class=\"token comment\"># 4. GPO manipulation<\/span>\r\n    Hunt-GPOAbuse\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>2. Zero Trust Architecture<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Zero Trust prensipleri:<\/span>\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Verify explicitly<\/span><span class=\"token punctuation\">:<\/span> T&uuml;m eri\u015fimleri do\u011frula\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Use least privilege<\/span><span class=\"token punctuation\">:<\/span> Minimum yetki prensibi\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Assume breach<\/span><span class=\"token punctuation\">:<\/span> \u0130hlal oldu\u011funu varsay<\/pre>\r\n<\/div>\r\n<h3><strong>3. Microsoft Security Stack<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Microsoft 365 Defender entegrasyonu<\/span>\r\n<span class=\"token function\">Connect-MsolService<\/span>\r\n<span class=\"token function\">Enable-MsolDevice<\/span> <span class=\"token operator\">-<\/span>DeviceId <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-MsolDevice<\/span> <span class=\"token operator\">-<\/span>All<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>DeviceId\r\n\r\n<span class=\"token comment\"># Azure AD Identity Protection<\/span>\r\n<span class=\"token function\">Set-AzureADPolicy<\/span> <span class=\"token operator\">-<\/span>Definition @<span class=\"token string\">'\r\n{\r\n    \"displayName\": \"Block Legacy Auth\",\r\n    \"state\": \"enabled\"\r\n}\r\n'<\/span>@<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udcc8&nbsp;<strong>Monitoring ve Reporting<\/strong><\/h2>\r\n<h3><strong>SIEM Entegrasyonu<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Custom Windows Event koleksiyonu<\/span>\r\nwevtutil<span class=\"token punctuation\">.<\/span>exe <span class=\"token function\">sl<\/span> Security <span class=\"token operator\">\/<\/span>ms:1073741824\r\nwevtutil<span class=\"token punctuation\">.<\/span>exe <span class=\"token function\">sl<\/span> <span class=\"token string\">\"Microsoft-Windows-Windows Defender\/Operational\"<\/span> <span class=\"token operator\">\/<\/span>ms:1073741824\r\n\r\n<span class=\"token comment\"># Splunk forwarder konfig&uuml;rasyonu<\/span>\r\n&amp; <span class=\"token string\">\"<span class=\"token variable\">$SplunkHome<\/span>\\bin\\splunk.exe\"<\/span> add monitor <span class=\"token string\">\"C:\\Windows\\System32\\winevt\\Logs\\Security.evtx\"<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>&Ouml;zel Raporlama<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Daily security report<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Get-ADSecurityReport<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$report<\/span> = @<span class=\"token punctuation\">{<\/span>\r\n        KerberoastingAttempts = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-KerberoastingEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        ASREPRoastingAttempts = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-ASREPRoastingEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        PtHEvents = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-PtHEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        GPOChanges = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-GPOChanges<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n    <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token keyword\">return<\/span> <span class=\"token variable\">$report<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udea8&nbsp;<strong>Acil M&uuml;dahale Plan\u0131<\/strong><\/h2>\r\n<h3><strong>1. Tespit Edilen Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Automated incident response<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Invoke-ADIncidentResponse<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token keyword\">param<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$AttackType<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$CompromisedAccount<\/span><span class=\"token punctuation\">)<\/span>\r\n    \r\n    <span class=\"token keyword\">switch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$AttackType<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token string\">\"Kerberoasting\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Revoke-KerberosTickets<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n        <span class=\"token string\">\"ASREPRoasting\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Enable-ADAccountPreAuth<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n        <span class=\"token string\">\"PtH\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Revoke-Sessions<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>2. Forensics ve Analysis<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Memory forensics i&ccedil;in Volatility<\/span>\r\nvolatility <span class=\"token parameter variable\">-f<\/span> memory.dmp <span class=\"token parameter variable\">--profile<\/span><span class=\"token operator\">=<\/span>Win10x64_18362 pslist\r\nvolatility <span class=\"token parameter variable\">-f<\/span> memory.dmp <span class=\"token parameter variable\">--profile<\/span><span class=\"token operator\">=<\/span>Win10x64_18362 mimikatz\r\n\r\n<span class=\"token comment\"># Disk forensics<\/span>\r\nftkimager <span class=\"token parameter variable\">--source<\/span> C: <span class=\"token parameter variable\">--dest<\/span> C:<span class=\"token punctuation\">\\<\/span>forensics<span class=\"token punctuation\">\\<\/span>image.aff4<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udcda&nbsp;<strong>E\u011fitim ve Fark\u0131ndal\u0131k<\/strong><\/h2>\r\n<h3><strong>Red Team Egzersizleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># AD security assessment plan:<\/span>\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 1<\/span><span class=\"token punctuation\">:<\/span> Kerberoasting simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 2<\/span><span class=\"token punctuation\">:<\/span> AS<span class=\"token punctuation\">-<\/span>REP Roasting simulation  \r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 3<\/span><span class=\"token punctuation\">:<\/span> PtH\/PtT simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 4<\/span><span class=\"token punctuation\">:<\/span> GPO abuse simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 5<\/span><span class=\"token punctuation\">:<\/span> Full attack chain<\/pre>\r\n<\/div>\r\n<h3><strong>Blue Team E\u011fitimi<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Defensive techniques workshop:<\/span>\r\n<span class=\"token comment\"># 1. Advanced logging configuration<\/span>\r\n<span class=\"token comment\"># 2. Real-time monitoring<\/span>\r\n<span class=\"token comment\"># 3. Incident response procedures<\/span>\r\n<span class=\"token comment\"># 4. Forensic analysis techniques<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udca1&nbsp;<strong>Sonu&ccedil; ve &Ouml;neriler<\/strong><\/h2>\r\n<h3><strong>&Ouml;ncelikli Eylemler:<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>\u2705 <span class=\"token punctuation\">[<\/span>AC\u0130L<span class=\"token punctuation\">]<\/span> T&uuml;m admin hesaplar\u0131nda MFA zorunlulu\u011fu\r\n\u2705 <span class=\"token punctuation\">[<\/span>AC\u0130L<span class=\"token punctuation\">]<\/span> LSA Protection ve Credential Guard etkinle\u015ftirme\r\n\u2705 <span class=\"token punctuation\">[<\/span>HAFTALIK<span class=\"token punctuation\">]<\/span> Kerberoasting ve AS-REP Roasting denetimi\r\n\u2705 <span class=\"token punctuation\">[<\/span>AYLIK<span class=\"token punctuation\">]<\/span> GPO izinleri ve yap\u0131land\u0131rmas\u0131 denetimi\r\n\u2705 <span class=\"token punctuation\">[<\/span>S&Uuml;REKL\u0130<span class=\"token punctuation\">]<\/span> Security monitoring ve threat hunting<\/pre>\r\n<\/div>\r\n<h3><strong>Uzun Vadeli Stratejiler:<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>\ud83d\udd12 Zero Trust Architecture implementasyonu\r\n\ud83d\udd12 Privileged Access Management <span class=\"token punctuation\">(<\/span>PAM<span class=\"token punctuation\">)<\/span> &ccedil;&ouml;z&uuml;mleri\r\n\ud83d\udd12 Microsoft Defender <span class=\"token keyword\">for<\/span> Identity entegrasyonu\r\n\ud83d\udd12 Regular red team\/purple team egzersizleri<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\">Bu kapsaml\u0131 rehber, Active Directory g&uuml;venli\u011finizi bir sonraki seviyeye ta\u015f\u0131man\u0131z i&ccedil;in gerekli t&uuml;m ara&ccedil;lar\u0131, teknikleri ve stratejileri i&ccedil;ermektedir. Unutmay\u0131n:&nbsp;<strong>\"Sald\u0131rganlar sadece bir a&ccedil;\u0131k bulmak zorunda, siz ise t&uuml;m a&ccedil;\u0131klar\u0131 kapatmak.\"<\/strong> \ud83d\udd10<\/p>","excerpt":"Windows Active Directory'de Ayr\u0131cal\u0131k Y\u00fckseltme Sald\u0131r\u0131lar\u0131: 5 Kritik Teknik ve Korunma Y\u00f6ntemleri Giri\u015f Windows Active Directory (AD)...","created_at":"2025-05-20 09:43:00","updated_at":"2026-09-08 03:56:48","category_id":7,"view_count":776,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-20 09:43:00","featured_image":"resimyok.jpg","slug":"1089-2","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":89,"title":"Grup \u0130lkesi Nesneleri (GPO) Enforced  \u00d6zelli\u011fi","content":"Windows ortamlar\u0131nda kullan\u0131c\u0131 ve bilgisayar yap\u0131land\u0131rmalar\u0131n\u0131 merkezi olarak y\u00f6netmek i\u00e7in Grup \u0130lkesi Nesneleri (GPO) temel bir ara\u00e7t\u0131r. Ancak, hiyerar\u015fik yap\u0131lar aras\u0131nda \u00e7ak\u0131\u015fan politikalar y\u00f6netimi karma\u015f\u0131kla\u015ft\u0131rabilir. Bu noktada \"Zorla Uygula (Enforced)\" \u00f6zelli\u011fi, kritik ayarlar\u0131n alt OU'ler taraf\u0131ndan de\u011fi\u015ftirilmesini engelleyerek tutarl\u0131l\u0131\u011f\u0131 ve g\u00fcvenli\u011fi sa\u011flar. <p >Bir IT y\u00f6neticisinin, \u00fcst d\u00fczey etki alan\u0131 GPO ayarlar\u0131n\u0131n di\u011fer GPO'lar taraf\u0131ndan ge\u00e7ersiz k\u0131l\u0131nmamas\u0131n\u0131 sa\u011flamak i\u00e7in yapmas\u0131 gereken en uygun eylem, \u00fcst d\u00fczey etki alan\u0131 GPO'sunu \"Enforced\" (Zorunlu) olarak ayarlamakt\u0131r.<\/p> <p >\"Enforced\" se\u00e7ene\u011fi (bazen \"No Override\" olarak da adland\u0131r\u0131l\u0131r), bir GPO'nun her zaman di\u011fer GPO ayarlar\u0131ndan ba\u011f\u0131ms\u0131z olarak uygulanmas\u0131n\u0131 sa\u011flar. Bir GPO \"Enforced\" olarak i\u015faretlendi\u011finde:<\/p> <ol > <li >Bu GPO'daki ayarlar, GPO uygulama s\u0131ralamas\u0131ndan ba\u011f\u0131ms\u0131z olarak her zaman uygulan\u0131r<\/li> <li >Alt d\u00fczeydeki hi\u00e7bir GPO, \u00fcst d\u00fczey GPO'nun ayarlar\u0131n\u0131 ge\u00e7ersiz k\u0131lamaz<\/li> <li >GPO hiyerar\u015fisinde daha a\u015fa\u011f\u0131da bulunan GPO'lar\u0131n \u00e7ak\u0131\u015fan ayarlar\u0131 yok say\u0131l\u0131r<\/li> <li >Y\u00f6neticilere kritik ayarlar\u0131n her zaman uygulanmas\u0131n\u0131 sa\u011flama imkan\u0131 verir<\/li> <\/ol> &nbsp; <p >Di\u011fer se\u00e7enekler (loopback i\u015fleme, ba\u011flant\u0131 s\u0131ras\u0131 de\u011fi\u015ftirme, g\u00fcvenlik filtreleme veya devralma devre d\u0131\u015f\u0131 b\u0131rakma) bu \u00f6zel sorunu etkili bir \u015fekilde \u00e7\u00f6zmez ve baz\u0131 durumlarda yan\u0131lt\u0131c\u0131 sonu\u00e7lara yol a\u00e7abilir.<\/p> <strong data-spm-anchor->Kar\u015f\u0131la\u015ft\u0131rma:<\/strong> <div > <div > <table > <thead > <tr > <th  scope=\"col\"> <div >\u00d6zellik<\/div><\/th> <th  scope=\"col\"> <div >Zorla Uygula (Enforced)<\/div><\/th> <th  scope=\"col\"> <div >Devralmay\u0131 Engellemek (Block Inheritance)<\/div><\/th> <\/tr> <\/thead> <tbody> <tr > <td > <div  data-spm-anchor->\u00dcst d\u00fczey GPO uygulan\u0131r m\u0131?<\/div><\/td> <td > <div >Evet, hatta devralma engellenmi\u015f olsa bile<\/div><\/td> <td > <div >Hay\u0131r, t\u00fcm \u00fcst GPO'lar devral\u0131nmaz<\/div><\/td> <\/tr> <tr > <td > <div >\u00c7ak\u0131\u015fan alt GPO'lar\u0131 etkiler mi?<\/div><\/td> <td > <div >Evet, alt GPO'lar\u0131n ayarlar\u0131n\u0131 ge\u00e7ersiz k\u0131lar<\/div><\/td> <td  data-spm-anchor-> <div >Hay\u0131r, sadece \u00fcst GPO'lar\u0131 engeller<\/div><\/td> <\/tr> <\/tbody> <\/table> <\/div> <\/div> <h3>Enforced Nedir?<\/h3> Zorla Uygula, bir GPO'nun alt OU'lerde tan\u0131mlanan \u00e7ak\u0131\u015fan politikalar taraf\u0131ndan devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131n\u0131 veya de\u011fi\u015ftirilmesini engelleyen bir \u00f6zelliktir. Bu \u00f6zellik etkinle\u015ftirildi\u011finde, ilgili GPO'nun ayarlar\u0131 hi\u00e7bir alt yap\u0131land\u0131rma taraf\u0131ndan ge\u00e7ersiz k\u0131l\u0131namaz . \u00d6zellikle g\u00fcvenlik politikalar\u0131, yaz\u0131l\u0131m k\u0131s\u0131tlamalar\u0131 veya \u015firket i\u00e7i standartlar gibi kritik ayarlar\u0131n korunmas\u0131nda kullan\u0131l\u0131r. <strong>\u00d6rnek:<\/strong> Bir \u015firketin BT departman\u0131, etki alan\u0131 d\u00fczeyinde g\u00fc\u00e7l\u00fc bir parola politikas\u0131 tan\u0131mlar ve bu GPO'yu \"Zorla Uygula\" olarak i\u015faretler. Bu durumda, pazarlama veya muhasebe gibi alt OU'lerdeki y\u00f6neticiler, parola karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 gev\u015fetmeye \u00e7al\u0131\u015fsa bile, ana GPO'nun ayarlar\u0131 ge\u00e7erli kal\u0131r. <h3><strong data-spm-anchor->Zorla Uygula Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/strong><\/h3> <ul> <li data-spm-anchor-><strong>\u0130\u015flem S\u0131ras\u0131: <\/strong>GPO'lar yerel, site, etki alan\u0131 ve OU d\u00fczeylerinde i\u015flenir. Genellikle son uygulanan GPO \u00f6nceliklidir. Ancak Zorla Uygula, bu \u00f6nceli\u011fi de\u011fi\u015ftirerek \u00fcst seviye GPO'lar\u0131n \u00e7ak\u0131\u015fan ayarlar\u0131n\u0131 korur.<\/li> <\/ul> <ul> <li data-spm-anchor-><strong>Hiyerar\u015fi \u00dczerinde Etkisi:<\/strong> <ul> <li>Bir \u00fcst OU'da Zorla Uygula etkinle\u015ftirilmi\u015f bir GPO varsa, alt OU'lardaki \u00e7ak\u0131\u015fan GPO'lar bu ayarlar\u0131 etkileyemez.<\/li> <li data-spm-anchor->Zorla Uygula, <strong>alt OU'lerdeki \"Devralmay\u0131 Engellemeyi (Block Inheritance)\" <\/strong>bile ge\u00e7erli k\u0131lar. Yani, alt bir OU \"Devralmay\u0131 Engellemeyi\" se\u00e7se bile, \u00fcst d\u00fczeyde Zorla Uygula olan GPO yine uygulan\u0131r.<\/li> <\/ul> <\/li> <\/ul> <strong>\u00d6rnek :<\/strong> Etki alan\u0131 d\u00fczeyinde \"Zorla Uygula\" ile tan\u0131mlanan bir yaz\u0131l\u0131m k\u0131s\u0131tlama politikas\u0131, sat\u0131\u015f departman\u0131n\u0131n OU'sunda yer alan \"Yaz\u0131l\u0131m Kurulumuna \u0130zin Ver\" GPO'sunu ge\u00e7ersiz k\u0131lar. <h3><strong data-spm-anchor->Zorla Uygula vs. Devralmay\u0131 Engellemek (Block Inheritance)<\/strong><\/h3> Bu iki \u00f6zellik farkl\u0131 ama ili\u015fkili g\u00f6revleri yerine getirir: <ul> <li data-spm-anchor-><strong>Zorla Uygula: <\/strong>\u00dcst d\u00fczey GPO'lar\u0131n alt OU'larda etkisini korur.<\/li> <li><strong>Devralmay\u0131 Engellemek: <\/strong>Alt OU'nun \u00fcst d\u00fczey GPO'lardan herhangi bir politika devralmas\u0131n\u0131 durdurur. Ancak Zorla Uygula etkin GPO'lar yine de uygulan\u0131r.<\/li> <\/ul> &nbsp; <h3><strong data-spm-anchor->En \u0130yi Uygulama S\u00fcre\u00e7leri<\/strong><\/h3> <ul> <li><strong>Kritik Politikalar \u0130\u00e7in Kullan\u0131n:<\/strong> <ul> <li data-spm-anchor->G\u00fcvenlik ayarlar\u0131 (parola politikalar\u0131, denetim loglar\u0131).<\/li> <li>\u015eirket standartlar\u0131 (taray\u0131c\u0131 yap\u0131land\u0131rmalar\u0131, g\u00fcncelleme zamanlamalar\u0131).<\/li> <\/ul> <div ><\/div><\/li> <li><strong>A\u015f\u0131r\u0131 Kullanmaktan Ka\u00e7\u0131n\u0131n:<\/strong> <ul> <li>A\u015f\u0131r\u0131 Zorla Uygula kullan\u0131m\u0131, politika \u00e7ak\u0131\u015fmalar\u0131n\u0131 ve sorun gidermeyi zorla\u015ft\u0131rabilir.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>Test Ortam\u0131nda Deneyin:<\/strong> <ul> <li>\u00dcretim ortam\u0131na uygulamadan \u00f6nce test edin.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>Belgeleme:<\/strong> <ul> <li>Hangi GPO'lar\u0131n Zorla Uygula oldu\u011funu ve neden uyguland\u0131\u011f\u0131n\u0131 kaydedin.<\/li> <\/ul> <\/li> <\/ul> <h3><strong>Uygulama Hatalar\u0131, Sorunlar\u0131<\/strong><\/h3> <ul> <li data-spm-anchor-><strong>A\u015f\u0131r\u0131 Zorlama: <\/strong>T\u00fcm GPO'lara Zorla Uygula uygulamak, esnekli\u011fi azalt\u0131r.<\/li> <li data-spm-anchor-><strong>Hiyerar\u015fi Bilin\u00e7sizli\u011fi: <\/strong>\u00c7ok say\u0131da GPO ve OU varsa, \u00f6ncelik s\u0131ralamas\u0131 kar\u0131\u015fabilir.<\/li> <li data-spm-anchor-><strong>Testsiz Uygulama: <\/strong>\u00dcretimde aniden uygulanan Zorla Uygula, kullan\u0131c\u0131lar \u00fczerinde olumsuz etkilere neden olabilir.<\/li> <\/ul> <strong>Hiyerar\u015fi Kontrol Ara\u00e7lar\u0131n\u0131 Kullan\u0131n!<\/strong> <ul> <li data-spm-anchor-><strong data-spm-anchor->Group Policy Management Console (GPMC):<\/strong> <ul> <li>GPO ba\u011flant\u0131lar\u0131nda \"Zorla Uygula\" durumunu kontrol edin.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>GPResult \/H:<\/strong> <ul> <li>Ge\u00e7erli kullan\u0131c\u0131\/bilgisayara uygulanan GPO'lar\u0131 raporlay\u0131n.<\/li> <\/ul> <\/li> <\/ul> Belirli bir OU'deki Zorla Uygula aktif GPO'lar\u0131 listele <pre  data-enlighter-language=\"powershell\">Get-GPInheritance -Name \"OU=Sales,DC=example,DC=com\" | Select-Object -ExpandProperty GpoLinks | Where-Object { $_.Enforced -eq \"Yes\" }<\/pre> <p data-spm-anchor->Her zaman bir GPO'nun etkisini anlamak i\u00e7in <code >GPResult<\/code> veya GPMC'deki <strong>Modelleme (Modeling) <\/strong>\u00f6zelli\u011fini kullan\u0131n.<\/p> <div ><em>GPO y\u00f6netimi konusunda daha derinlemesine bilgi almak isteyen BT profesyonellerine faydal\u0131 olaca\u011f\u0131n\u0131 umuyorum. Sorular\u0131n\u0131z\u0131 yorum olarak payla\u015fabilirsiniz!<\/em><\/div> &nbsp;","excerpt":"Windows ortamlar\u0131nda kullan\u0131c\u0131 ve bilgisayar yap\u0131land\u0131rmalar\u0131n\u0131 merkezi olarak y\u00f6netmek i\u00e7in Grup \u0130lkesi Nesneleri (GPO) temel bir...","created_at":"2025-05-01 11:17:38","updated_at":"2026-09-23 12:56:59","category_id":8,"view_count":1024,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-01 11:17:38","featured_image":"resimyok.jpg","slug":"grup-ilkesi-nesneleri-gpo-enforced-ozelligi","category_name":"Active Directory \/Azure","category_slug":"active-directory-azure","category_color":"#f59e0b"},{"id":135,"title":"Active Directory G\u00fcvenli\u011fi: Eski GPP Parolalar\u0131n\u0131n Gizli Tehlikesi","content":"<h2>Eski GPP Parolalar\u0131: Active Directory'nizde Gizlenen Tehlike<\/h2> Kurumsal a\u011f\u0131n\u0131z\u0131n g\u00fcvenli\u011fi s\u00f6z konusu oldu\u011funda, bazen en b\u00fcy\u00fck tehditler g\u00f6zden ka\u00e7an eski yap\u0131land\u0131rmalardan gelir. Bug\u00fcn, bir\u00e7ok kurulu\u015fun fark\u0131nda olmad\u0131\u011f\u0131 ancak potansiyel olarak felaket sonu\u00e7lar do\u011furabilecek bir Active Directory g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 ele alaca\u011f\u0131z: 2014 \u00f6ncesi Grup \u0130lkesi Tercihleri (GPP) ile depolanan parolalar. <h2>Sorunun Temeli: 2014 \u00d6ncesi GPP<\/h2> 2014'ten \u00f6nce, sistem y\u00f6neticileri \u00e7e\u015fitli g\u00f6revler, hizmetler ve yap\u0131land\u0131rmalar i\u00e7in parola belirlemek amac\u0131yla Grup \u0130lkesi Tercihleri'ni yayg\u0131n olarak kullan\u0131yordu. Bu y\u00f6ntem kullan\u0131\u015fl\u0131 g\u00f6r\u00fcn\u00fcyordu - tek bir yerden birden fazla sisteme parola da\u011f\u0131tman\u0131n basit bir yoluydu. Ancak bu kolayl\u0131\u011f\u0131n bedeli, \u015fimdi anlad\u0131\u011f\u0131m\u0131z gibi, \u00e7ok y\u00fcksekti. <h2>Neden Bu Kadar Tehlikeli?<\/h2> Bu eski GPP yap\u0131land\u0131rmalar\u0131n\u0131n neden bu kadar riskli oldu\u011funu anlamak i\u00e7in birka\u00e7 kritik fakt\u00f6r\u00fc g\u00f6z \u00f6n\u00fcnde bulundurmam\u0131z gerekiyor: <ol> <li><strong>Depolama Konumu:<\/strong> Bu parolalar, kimli\u011fi do\u011frulanm\u0131\u015f herhangi bir kullan\u0131c\u0131n\u0131n eri\u015febildi\u011fi SYSVOL klas\u00f6r\u00fcnde saklan\u0131yordu.<\/li> <li><strong>Zay\u0131f \u015eifreleme:<\/strong> Evet, parolalar \u015fifreleniyordu, ancak kullan\u0131lan AES \u015fifreleme anahtar\u0131 kamuya a\u00e7\u0131kt\u0131. Microsoft taraf\u0131ndan belgelenmi\u015f ve herkes taraf\u0131ndan biliniyordu, bu da \u015fifre \u00e7\u00f6zme i\u015flemini son derece basit hale getiriyordu.<\/li> <li><strong>Kal\u0131c\u0131l\u0131k Sorunu:<\/strong> Microsoft bu sorunu 2014'te d\u00fczeltti, ancak daha \u00f6nce olu\u015fturulan ve g\u00fcvenlik a\u00e7\u0131\u011f\u0131 i\u00e7eren GPO'lar otomatik olarak d\u00fczeltilmedi. Bu, on y\u0131l \u00f6ncesine ait g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n hala aktif olabilece\u011fi anlam\u0131na geliyor.<\/li> <\/ol> <h2>Ortam\u0131n\u0131z\u0131 Kontrol Edin<\/h2> Active Directory ortam\u0131n\u0131z\u0131n bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan etkilenip etkilenmedi\u011fini belirlemek i\u00e7in, a\u015fa\u011f\u0131daki basit PowerShell komutunu \u00e7al\u0131\u015ft\u0131rman\u0131z yeterlidir: <pre><code >$domain = Get-ADDomain | select -ExpandProperty Forest findstr \/S \/I cpassword \\\\$domain\\SYSVOL\\$domain\\Policies\\*.xml <\/code><\/pre> Bu komut, SYSVOL dizinindeki t\u00fcm ilke dosyalar\u0131n\u0131 arayarak \u015fifrelenmi\u015f parolalar\u0131 tespit edecektir. E\u011fer sonu\u00e7 al\u0131rsan\u0131z, bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n kurumunuzu etkiledi\u011fi anlam\u0131na gelir. <h2>\u00c7\u00f6z\u00fcm \u00d6nerileri<\/h2> E\u011fer savunmas\u0131z GPO'lar tespit ederseniz, \u015fu ad\u0131mlar\u0131 izlemelisiniz: <ol> <li><strong>Envanter \u00c7\u0131kar\u0131n:<\/strong> Etkilenen t\u00fcm GPO'lar\u0131 tan\u0131mlay\u0131n ve belgelendirin.<\/li> <li><strong>Parolalar\u0131 De\u011fi\u015ftirin:<\/strong> GPP arac\u0131l\u0131\u011f\u0131yla depolanan t\u00fcm parolalar\u0131 hemen de\u011fi\u015ftirin, \u00e7\u00fcnk\u00fc bunlar potansiyel olarak tehlikededir.<\/li> <li><strong>Modern Alternatifler Kullan\u0131n:<\/strong> GPP ile parola depolamak yerine, \u015fu g\u00fcvenli alternatifleri de\u011ferlendirin: <ul> <li>Grup Y\u00f6netimli Hizmet Hesaplar\u0131 (gMSA)<\/li> <li>Yerel Y\u00f6netici Parola \u00c7\u00f6z\u00fcm\u00fc (LAPS)<\/li> <li>Privileged Access Management (PAM)<\/li> <li>Just-In-Time (JIT) eri\u015fim \u00e7\u00f6z\u00fcmleri<\/li> <\/ul> <\/li> <li><strong>D\u00fczenli Taramalar Yap\u0131n:<\/strong> Bu t\u00fcr g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 d\u00fczenli olarak taray\u0131n ve belirleyin.<\/li> <\/ol> Siber g\u00fcvenlikte, bazen en b\u00fcy\u00fck tehditler en g\u00f6r\u00fcn\u00fcr olanlar de\u011fil, uzun zamand\u0131r unutulmu\u015f olan yap\u0131land\u0131rmalard\u0131r. On y\u0131l \u00f6nce olu\u015fturulmu\u015f bir GPO, bug\u00fcn kurulu\u015funuzun g\u00fcvenli\u011fini tehdit edebilir. Proaktif bir yakla\u015f\u0131m benimseyerek ve eski g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit ederek, kurumsal a\u011f\u0131n\u0131z\u0131 daha g\u00fcvenli hale getirebilirsiniz. G\u00fcvenli sistemler dile\u011fiyle! <hr \/> <em>Not: Bu blog yaz\u0131s\u0131 yaln\u0131zca bilgilendirme ama\u00e7l\u0131d\u0131r. Her zaman kendi kurulu\u015funuzun g\u00fcvenlik politikalar\u0131na uygun \u015fekilde hareket etti\u011finizden emin olun ve \u00f6nemli de\u011fi\u015fiklikler yapmadan \u00f6nce g\u00fcvenlik ekibinize dan\u0131\u015f\u0131n.<\/em>","excerpt":"Eski GPP Parolalar\u0131: Active Directory'nizde Gizlenen Tehlike Kurumsal a\u011f\u0131n\u0131z\u0131n g\u00fcvenli\u011fi s\u00f6z konusu oldu\u011funda, bazen en b\u00fcy\u00fck tehditler...","created_at":"2025-04-03 11:00:58","updated_at":"2026-09-08 00:55:40","category_id":6,"view_count":834,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-04-03 11:00:58","featured_image":"resimyok.jpg","slug":"active-directory-guvenligi-eski-gpp-parolalarinin-gizli-tehlikesi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":144,"title":"Windows Server'da T\u00fcm Kullan\u0131c\u0131lara Masa\u00fcst\u00fc K\u0131sayolu Ekleme","content":"Bir a\u011f ortam\u0131nda y\u00f6netici olarak \u00e7al\u0131\u015f\u0131yorsan\u0131z, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n \u00f6nemli uygulamalara h\u0131zl\u0131 eri\u015fim sa\u011flamas\u0131n\u0131 isteyebilirsiniz. Bu yaz\u0131mda, Windows Server ortam\u0131nda t\u00fcm kullan\u0131c\u0131lar\u0131n masa\u00fcst\u00fcne otomatik olarak k\u0131sayol eklemenin birka\u00e7 farkl\u0131 yolunu inceleyece\u011fiz. <h2>Neden Public Desktop?<\/h2> Bir Windows sunucusunda birden fazla kullan\u0131c\u0131 hesab\u0131 bulunabilir. Her kullan\u0131c\u0131 i\u00e7in ayr\u0131 ayr\u0131 k\u0131sayol olu\u015fturmak yerine, <strong>Public Desktop<\/strong> klas\u00f6r\u00fcn\u00fc kullanarak tek bir k\u0131sayol ile t\u00fcm kullan\u0131c\u0131lar\u0131n eri\u015fimini sa\u011flayabilirsiniz. Bu yakla\u015f\u0131m, \u00f6zellikle Remote Desktop Services (Terminal Sunucular\u0131) gibi payla\u015f\u0131ml\u0131 ortamlarda \u00e7ok i\u015fe yarar. Public Desktop klas\u00f6r\u00fc genellikle \u015fu konumda bulunur: <code>C:\\Users\\Public\\Desktop<\/code> <h2>PowerShell ile K\u0131sayol Olu\u015fturma<\/h2> PowerShell, k\u0131sayol olu\u015fturma i\u015flemini otomatikle\u015ftirmek i\u00e7in harika bir ara\u00e7t\u0131r. \u0130\u015fte, istedi\u011finiz bir uygulaman\u0131n k\u0131sayolunu t\u00fcm kullan\u0131c\u0131lar i\u00e7in olu\u015fturan basit bir PowerShell beti\u011fi: <pre><code ># Y\u00f6netici haklar\u0131yla \u00e7al\u0131\u015ft\u0131r\u0131lmal\u0131d\u0131r #Requires -RunAsAdministrator $shortcutName = \"Uygulama Ad\u0131.lnk\" $targetPath = \"C:\\Program\\Uygulama.exe\" $iconLocation = \"$targetPath,0\" # Public Desktop konumunu al $publicDesktop = ::GetFolderPath(\"CommonDesktopDirectory\") $shortcutPath = Join-Path -Path $publicDesktop -ChildPath $shortcutName try { # K\u0131sayol olu\u015ftur $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut($shortcutPath) $Shortcut.TargetPath = $targetPath $Shortcut.IconLocation = $iconLocation $Shortcut.Description = \"Uygulama A\u00e7\u0131klamas\u0131\" $Shortcut.WorkingDirectory = Split-Path $targetPath -Parent $Shortcut.Save() Write-Host \"K\u0131sayol ba\u015far\u0131yla olu\u015fturuldu: $shortcutPath\" -ForegroundColor Green } catch { Write-Host \"K\u0131sayol olu\u015fturma hatas\u0131: $_\" -ForegroundColor Red } <\/code><\/pre> <h2>Yayg\u0131n Hata: Yetkisiz Eri\u015fim (Unauthorized Access)<\/h2> Beti\u011fi \u00e7al\u0131\u015ft\u0131r\u0131rken en s\u0131k kar\u015f\u0131la\u015f\u0131lan sorun \"Unauthorized Access Exception\" hatas\u0131d\u0131r. Beti\u011fin \u00e7\u0131kt\u0131s\u0131 \u015f\u00f6yle g\u00f6r\u00fcnebilir: <pre><code>Unable to save shortcut \"C:\\Users\\Public\\Desktop\\Uygulama Ad\u0131.lnk\". At line:17 char:1 + $Shortcut.Save() + ~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) , UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException <\/code><\/pre> <h3>\u00c7\u00f6z\u00fcm 1: Y\u00f6netici Olarak \u00c7al\u0131\u015ft\u0131rma<\/h3> Bu hatan\u0131n en yayg\u0131n \u00e7\u00f6z\u00fcm\u00fc, PowerShell'i Y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131rmakt\u0131r: <ol> <li>PowerShell k\u0131sayoluna sa\u011f t\u0131klay\u0131n<\/li> <li>\"Y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131r\" se\u00e7ene\u011fini se\u00e7in<\/li> <li>Beti\u011fi \u00e7al\u0131\u015ft\u0131r\u0131n<\/li> <\/ol> <h3>\u00c7\u00f6z\u00fcm 2: Beti\u011fi G\u00fc\u00e7lendirme<\/h3> Betik i\u00e7inde y\u00f6netici kontrol\u00fc ekleyerek hata mesajlar\u0131n\u0131 daha a\u00e7\u0131klay\u0131c\u0131 hale getirebilirsiniz: <pre><code >#Requires -RunAsAdministrator # Veya \u015fu kontrol\u00fc ekleyin if (-NOT (::GetCurrent()).IsInRole( \"Administrator\")) { Write-Warning \"Bu betik y\u00f6netici izinleri gerektirir. L\u00fctfen PowerShell'i 'Y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131r' se\u00e7ene\u011fi ile ba\u015flat\u0131n.\" Break } <\/code><\/pre> <h2>Ger\u00e7ek D\u00fcnya \u00d6rne\u011fi: Edge uygulamas\u0131<\/h2> \u00d6rnek olarak, \"Edge\" adl\u0131 uygulaman\u0131n k\u0131sayolunu t\u00fcm kullan\u0131c\u0131lar i\u00e7in olu\u015fturmak istedi\u011fimizi d\u00fc\u015f\u00fcnelim. \u0130\u015fte tam betik: <pre><code >#Requires -RunAsAdministrator $shortcutName = \"Edge.lnk\" $targetPath = \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" $iconLocation = \"$targetPath,0\" # Uygulaman\u0131n kendi ikonunu kullan\u0131r # Y\u00f6netici haklar\u0131n\u0131 kontrol et if (-NOT (::GetCurrent()).IsInRole( \"Administrator\")) { Write-Warning \"Bu betik y\u00f6netici izinleri gerektirir. L\u00fctfen PowerShell'i 'Y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131r' se\u00e7ene\u011fi ile ba\u015flat\u0131n.\" Break } # Public Desktop konumunu al $publicDesktop = ::GetFolderPath(\"CommonDesktopDirectory\") $shortcutPath = Join-Path -Path $publicDesktop -ChildPath $shortcutName try { # K\u0131sayol olu\u015ftur $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut($shortcutPath) $Shortcut.TargetPath = $targetPath $Shortcut.IconLocation = $iconLocation $Shortcut.Description = \"Edge\" $Shortcut.WorkingDirectory = Split-Path $targetPath -Parent $Shortcut.Save() Write-Host \"K\u0131sayol ba\u015far\u0131yla olu\u015fturuldu: $shortcutPath\" -ForegroundColor Green } catch { Write-Host \"K\u0131sayol olu\u015fturma hatas\u0131: $_\" -ForegroundColor Red } <\/code><\/pre> <h2>Alternatif Y\u00f6ntemler<\/h2> <h3>Group Policy Kullan\u0131m\u0131<\/h3> Daha b\u00fcy\u00fck ortamlarda, k\u0131sayollar\u0131 Group Policy ile da\u011f\u0131tmak daha verimli olabilir: <ol> <li>Group Policy Management konsolunu a\u00e7\u0131n<\/li> <li>Bir GPO olu\u015fturun veya d\u00fczenleyin<\/li> <li>\"User Configuration\" &gt; \"Preferences\" &gt; \"Windows Settings\" &gt; \"Shortcuts\" b\u00f6l\u00fcm\u00fcne gidin<\/li> <li>Sa\u011f t\u0131klay\u0131p \"New\" &gt; \"Shortcut\" se\u00e7in<\/li> <li>K\u0131sayol \u00f6zelliklerini ayarlay\u0131n<\/li> <\/ol> <h3>Oturum A\u00e7ma Beti\u011fi Kullan\u0131m\u0131<\/h3> Kullan\u0131c\u0131lar oturum a\u00e7t\u0131\u011f\u0131nda \u00e7al\u0131\u015facak bir betik haz\u0131rlayabilirsiniz: <ol> <li>Beti\u011fi bir a\u011f payla\u015f\u0131m\u0131nda saklay\u0131n<\/li> <li>Group Policy ile oturum a\u00e7ma beti\u011fi olarak ayarlay\u0131n (User Configuration &gt; Windows Settings &gt; Scripts &gt; Logon)<\/li> <\/ol> <h2>Bilgisayar Ba\u015flang\u0131c\u0131nda \u00c7al\u0131\u015ft\u0131rma<\/h2> K\u0131sayol olu\u015fturma beti\u011finizi bilgisayar ba\u015flang\u0131c\u0131nda otomatik olarak \u00e7al\u0131\u015ft\u0131rmak i\u00e7in G\u00f6rev Zamanlay\u0131c\u0131 kullanabilirsiniz: <ol> <li>G\u00f6rev Zamanlay\u0131c\u0131'y\u0131 a\u00e7\u0131n (taskschd.msc)<\/li> <li>\"Temel G\u00f6rev Olu\u015ftur\" t\u0131klay\u0131n<\/li> <li>G\u00f6reve bir isim verin, \u00f6rn: \"PublicDesktopKisayolOlustur\"<\/li> <li>Tetikleyici olarak \"Ba\u015flang\u0131\u00e7ta\" se\u00e7in<\/li> <li>Eylem olarak \"Program ba\u015flat\" se\u00e7in<\/li> <li>Program\/betik alan\u0131na: <code>powershell.exe<\/code><\/li> <li>Parametreler alan\u0131na: <code>-ExecutionPolicy Bypass -File \"C:\\Scripts\\KisayolOlustur.ps1\"<\/code><\/li> <li>\"Son\" d\u00fc\u011fmesine t\u0131klay\u0131n<\/li> <\/ol> <h2><\/h2> Windows Server ortam\u0131nda t\u00fcm kullan\u0131c\u0131lar\u0131n masa\u00fcst\u00fcne k\u0131sayol eklemek, Public Desktop klas\u00f6r\u00fcn\u00fc kullanarak olduk\u00e7a kolayd\u0131r. Bu y\u00f6ntem, \u00f6zellikle Remote Desktop Services ortamlar\u0131nda kullan\u0131c\u0131lara \u00f6nemli uygulamalara h\u0131zl\u0131 eri\u015fim sa\u011flar. Kar\u015f\u0131la\u015fabilece\u011finiz en yayg\u0131n sorun yetkilendirme hatas\u0131 olacakt\u0131r, bu nedenle beti\u011fi her zaman y\u00f6netici olarak \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun. Daha b\u00fcy\u00fck a\u011flarda ise Group Policy kullan\u0131m\u0131 daha verimli bir \u00e7\u00f6z\u00fcm sunabilir. <hr \/> <em>Bu yaz\u0131y\u0131 faydal\u0131 buldunuz mu? Yorumlar\u0131n\u0131z\u0131 a\u015fa\u011f\u0131da payla\u015f\u0131n ve di\u011fer Windows Server y\u00f6netim ipu\u00e7lar\u0131 i\u00e7in blogumuzu takip etmeyi unutmay\u0131n!<\/em>","excerpt":"Bir a\u011f ortam\u0131nda y\u00f6netici olarak \u00e7al\u0131\u015f\u0131yorsan\u0131z, kullan\u0131c\u0131lar\u0131n\u0131z\u0131n \u00f6nemli uygulamalara h\u0131zl\u0131 eri\u015fim sa\u011flamas\u0131n\u0131...","created_at":"2025-03-28 15:42:17","updated_at":"2026-09-23 12:28:56","category_id":8,"view_count":843,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-03-28 15:42:17","featured_image":"resimyok.jpg","slug":"756-2","category_name":"Active Directory \/Azure","category_slug":"active-directory-azure","category_color":"#f59e0b"},{"id":159,"title":"Windows Server Group Policy ile Otomatik WiFi Profili Da\u011f\u0131t\u0131m\u0131","content":"Kurumsal ortamlarda, t\u00fcm bilgisayarlara WiFi ayarlar\u0131n\u0131n otomatik olarak da\u011f\u0131t\u0131lmas\u0131 \u00f6nemli bir ihtiya\u00e7t\u0131r. Bu yaz\u0131da, Group Policy kullanarak WiFi profillerinin nas\u0131l merkezi olarak da\u011f\u0131t\u0131laca\u011f\u0131n\u0131 anlataca\u011f\u0131m B\u00fcy\u00fck organizasyonlarda, her kullan\u0131c\u0131n\u0131n manuel olarak WiFi ayarlar\u0131n\u0131 yapmas\u0131 hem zaman kayb\u0131 hem de g\u00fcvenlik riski olu\u015fturabilir. Group Policy (GPO) kullanarak WiFi profillerini otomatik da\u011f\u0131tmak, bu sorunu etkin bir \u015fekilde \u00e7\u00f6zer. Gereksinimler - Domain Controller yetkisi - Group Policy Management Console - WiFi profil script'i - Domain'e ba\u011fl\u0131 bilgisayarlar Ad\u0131m 1: GPO Olu\u015fturma 1. Group Policy Management Console'u a\u00e7\u0131n 2. Domain veya OU (Organizational Unit) \u00fczerine sa\u011f t\u0131klay\u0131n 3. \"Create a GPO in this domain, and Link it here\" se\u00e7ene\u011fini se\u00e7in 4. GPO'ya anlaml\u0131 bir isim verin (\u00f6rn: \"WiFi-Profile-Deployment\") Ad\u0131m 2: Script Konumland\u0131rma Script'i domain controller \u00fczerinde payla\u015f\u0131lan bir klas\u00f6re yerle\u015ftirin: \\\\domain.local\\SYSVOL\\domain.local\\scripts\\wifi-profile.bat Ad\u0131m 3: GPO Yap\u0131land\u0131rma 1. Olu\u015fturdu\u011funuz GPO'yu d\u00fczenleyin 2. \u015eu yolu takip edin: Computer Configuration -&gt; Windows Settings -&gt; Scripts -&gt; Startup 3. \"Startup\" \u00fczerine \u00e7ift t\u0131klay\u0131n 4. \"Add\" butonuna t\u0131klay\u0131n 5. Script yolunu belirtin: Script Name: wifi-profile.bat Script Parameters: Ad\u0131m 4: G\u00fcvenlik Ayarlar\u0131 GPO g\u00fcvenlik ayarlar\u0131n\u0131 yap\u0131land\u0131r\u0131n: 1. GPO'nun \"Security Filtering\" b\u00f6l\u00fcm\u00fcnde: - \"Authenticated Users\" grubu ekli olmal\u0131 - Hedef bilgisayar gruplar\u0131 eklenmi\u015f olmal\u0131 2. \"Delegation\" sekmesinde: - \"Read\" ve \"Apply Group Policy\" izinleri kontrol edilmeli Ad\u0131m 5: Test ve Do\u011frulama 1. Test bilgisayar\u0131nda PowerShell'i y\u00f6netici olarak a\u00e7\u0131n 2. GPO g\u00fcncellemesi i\u00e7in komutu \u00e7al\u0131\u015ft\u0131r\u0131n: powershell gpupdate \/force 3. Bilgisayar\u0131 yeniden ba\u015flat\u0131n 4. WiFi profilinin eklendi\u011fini kontrol edin: powershell netsh wlan show profiles &nbsp; S\u0131k kar\u015f\u0131la\u015f\u0131lan sorunlar ve \u00e7\u00f6z\u00fcmleri(Troubleshooting): 1. **GPO Uygulanm\u0131yor** - GPO ba\u011flant\u0131s\u0131n\u0131 kontrol edin - Security filtering ayarlar\u0131n\u0131 g\u00f6zden ge\u00e7irin - gpresult \/r komutu ile GPO durumunu kontrol edin 2. **Script \u00c7al\u0131\u015fm\u0131yor** - Script eri\u015fim izinlerini kontrol edin - Script yolunun do\u011frulu\u011funu teyit edin - Event Viewer'da hata kay\u0131tlar\u0131n\u0131 inceleyin 3. **WiFi Profili Eklenmiyor** - Script'in y\u00f6netici haklar\u0131yla \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun - XML format\u0131n\u0131 kontrol edin - WiFi adapt\u00f6r durumunu kontrol edin Group Policy ile WiFi profili da\u011f\u0131t\u0131m\u0131, kurumsal a\u011flarda \u00f6nemli bir y\u00f6netim kolayl\u0131\u011f\u0131 sa\u011flar. Bu y\u00f6ntem sayesinde: - Merkezi y\u00f6netim imkan\u0131 - Standardizasyon - Zaman tasarrufu - G\u00fcvenlik kontrol\u00fc elde edilir. Bu konfig\u00fcrasyonu yaparken dikkat edilmesi gereken en \u00f6nemli nokta, g\u00fcvenlik ve performans dengesidir. Test ortam\u0131nda t\u00fcm ad\u0131mlar\u0131 do\u011frulad\u0131ktan sonra production ortam\u0131na ge\u00e7i\u015f yapman\u0131z \u00f6nerilir. Bat file tamam\u0131; <pre  data-enlighter-language=\"generic\">@echo off echo Corp WiFi profili ekleniyor... :: XML dosyas\u0131n\u0131 olu\u015ftur echo ^&lt;?xml version=\"1.0\"?^&gt; &gt; \"%TEMP%\\Corp_WiFi.xml\" echo ^&lt;WLANProfile xmlns=\"http:\/\/www.microsoft.com\/networking\/WLAN\/profile\/v1\"^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;name^&gt;Corp^&lt;\/name^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;SSIDConfig^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;SSID^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;name^&gt;Corp^&lt;\/name^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;\/SSID^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;\/SSIDConfig^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;connectionType^&gt;ESS^&lt;\/connectionType^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;connectionMode^&gt;auto^&lt;\/connectionMode^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;MSM^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;security^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;authEncryption^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;authentication^&gt;WPA2PSK^&lt;\/authentication^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;encryption^&gt;AES^&lt;\/encryption^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;useOneX^&gt;false^&lt;\/useOneX^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;\/authEncryption^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;sharedKey^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;keyType^&gt;passPhrase^&lt;\/keyType^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;protected^&gt;false^&lt;\/protected^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;keyMaterial^&gt;\u015eifre&lt;\/keyMaterial^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;\/sharedKey^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 \u00a0 \u00a0 ^&lt;\/security^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo \u00a0 \u00a0 ^&lt;\/MSM^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" echo ^&lt;\/WLANProfile^&gt; &gt;&gt; \"%TEMP%\\Corp_WiFi.xml\" :: Profili ekle netsh wlan add profile filename=\"%TEMP%\\Corp_WiFi.xml\" :: Temizlik del \"%TEMP%\\Corp_WiFi.xml\" echo Corp WiFi profili ba\u015far\u0131yla eklendi. exit \/b 0<\/pre> &nbsp;","excerpt":"Kurumsal ortamlarda, t\u00fcm bilgisayarlara WiFi ayarlar\u0131n\u0131n otomatik olarak da\u011f\u0131t\u0131lmas\u0131 \u00f6nemli bir ihtiya\u00e7t\u0131r. Bu yaz\u0131da, Group Policy kullanarak WiFi profillerinin nas\u0131l merkezi olarak da\u011f\u0131t\u0131laca\u011f\u0131n\u0131 anlataca\u011f\u0131m","created_at":"2025-02-17 14:27:35","updated_at":"2026-09-07 18:46:54","category_id":6,"view_count":928,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-17 14:27:35","featured_image":"resimyok.jpg","slug":"windows-group-policy-ile-otomatik-wifi-profili-dagitimi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":230,"title":"Windows Server Group Policy ile \u015eifre Politikalar\u0131 Y\u00f6netimi","content":"<p>Windows Server ortam\u0131nda, kullan\u0131c\u0131 hesaplar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u015fifre politikalar\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. Group Policy (Grup \u0130lkesi) ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 nas\u0131l y\u00f6netebilece\u011finizi, g\u00f6r\u00fcnt\u00fcleyebilece\u011finizi ve d\u00fczenleyebilece\u011finizi bu yaz\u0131da detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z.<\/p><p>1. Group Policy ile \u015eifre Politikalar\u0131 Y\u00f6netimi<\/p><p>1.1 Group Policy Management Console'da \u015eifre Politikalar\u0131na Ula\u015fma<\/p><p>Group Policy Management Console (GPMC) \u00fczerinden \u015fifre politikalar\u0131n\u0131 y\u00f6netmek i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyebilirsiniz:<\/p><p>1. **Group Policy Management** konsolunu a\u00e7\u0131n.<br>2. **Forest: domain.com** &gt; **Domains** &gt; **domain.com** &gt; **Default Domain Policy** yolunu takip edin.<br>3. **Default Domain Policy** \u00fczerine sa\u011f t\u0131klay\u0131p **Edit** se\u00e7ene\u011fini se\u00e7in.<br>4. **Computer Configuration** &gt; **Policies** &gt; **Windows Settings** &gt; **Security Settings** &gt; **Account Policies** &gt; **Password Policy** yolunu izleyerek \u015fifre politikalar\u0131na ula\u015f\u0131n.<\/p><p>1.2 Alternatif Yol<\/p><p>1. **Server Manager** &gt; **Tools** &gt; **Group Policy Management** yolunu izleyin.<br>2. **Default Domain Policy** \u00fczerine sa\u011f t\u0131klay\u0131p **Edit** se\u00e7ene\u011fini se\u00e7in.<br>3. **Computer Configuration** &gt; **Windows Settings** &gt; **Security Settings** &gt; **Account Policies** &gt; **Password Policy** yolunu izleyin.<\/p><p>2. PowerShell ile \u015eifre Politikalar\u0131n\u0131 G\u00f6r\u00fcnt\u00fcleme<\/p><p>2.1 Default Domain Policy<\/p><p>Varsay\u0131lan domain \u015fifre politikas\u0131n\u0131 g\u00f6r\u00fcnt\u00fclemek i\u00e7in a\u015fa\u011f\u0131daki PowerShell komutlar\u0131n\u0131 kullanabilirsiniz:<\/p><p>```powershell<br>Varsay\u0131lan domain \u015fifre politikas\u0131<br>Get-ADDefaultDomainPasswordPolicy | Format-List *password*<\/p><p>Daha spesifik bilgiler i\u00e7in<br>Get-ADDefaultDomainPasswordPolicy | Select-Object ComplexityEnabled,<br>&nbsp; MinPasswordLength,<br>&nbsp; MaxPasswordAge,<br>&nbsp; MinPasswordAge,<br>&nbsp; PasswordHistoryCount<br>```<\/p><p>2.2 Fine-Grained Password Policies (FGPP)<\/p><p>Fine-Grained Password Policies (FGPP) ile daha detayl\u0131 \u015fifre politikalar\u0131 olu\u015fturabilirsiniz. FGPP'leri g\u00f6r\u00fcnt\u00fclemek i\u00e7in:<\/p><p>```powershell<br>T\u00fcm FGPP'leri listele<br>Get-ADFineGrainedPasswordPolicy -Filter * |&nbsp;<br>Select-Object Name, Precedence, MinPasswordLength, PasswordHistoryCount, ComplexityEnabled<\/p><p>Belirli bir FGPP'yi g\u00f6r\u00fcnt\u00fcle<br>Get-ADFineGrainedPasswordPolicy -Identity \"PolicyName\"<br>```<\/p><p>2.3 Group Policy Objects \u0130\u00e7inde \u015eifre Politikalar\u0131<\/p><p>\u015eifre politikalar\u0131 ile ilgili Group Policy Objects (GPO) bulmak i\u00e7in:<\/p><p>```powershell<br>\u015eifre ile ilgili GPO'lar\u0131 bul<br>Get-GPO -All | Where-Object {$_.DisplayName -like \"*password*\"} |&nbsp;<br>Select-Object DisplayName, CreationTime, ModificationTime<\/p><p>GPO'lar\u0131n uyguland\u0131\u011f\u0131 OU'lar\u0131 g\u00f6r<br>Get-GPInheritance -Target \"DC=domain,DC=com\"<br>```<\/p><p>3. \u00d6rnek Policy Ayarlar\u0131 ve Anlamlar\u0131<\/p><p>Tipik bir \u015fifre politikas\u0131 yap\u0131land\u0131rmas\u0131 a\u015fa\u011f\u0131daki gibi olabilir:<\/p><p>```powershell<br>ComplexityEnabled &nbsp; &nbsp;: True &nbsp; &nbsp; &nbsp; Karma\u015f\u0131kl\u0131k gereksinimleri aktif<br>MinPasswordLength &nbsp; &nbsp;: 10 &nbsp; &nbsp; &nbsp; &nbsp; Minimum 10 karakter<br>MaxPasswordAge &nbsp; &nbsp; &nbsp; : 180.00:00:00 &nbsp; 180 g\u00fcn sonra de\u011fi\u015fmeli<br>MinPasswordAge &nbsp; &nbsp; &nbsp; : 5.00:00:00 &nbsp; &nbsp; 5 g\u00fcn ge\u00e7meden de\u011fi\u015ftiremez<br>PasswordHistoryCount : 5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Son 5 \u015fifre tekrar kullan\u0131lamaz<br>```<\/p><p>4. Fine-Grained Password Policy (FGPP) Y\u00f6netimi<\/p><p>4.1 FGPP Olu\u015fturma ve D\u00fczenleme<\/p><p>FGPP olu\u015fturma ve d\u00fczenleme i\u015flemleri i\u00e7in PowerShell kullanabilirsiniz:<\/p><p>```powershell<br>\u015eifre ge\u00e7mi\u015fini g\u00fcncelleme<br>Set-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" -PasswordHistoryCount 5<\/p><p>Kullan\u0131c\u0131 ekleme<br>$user = Get-ADUser username | Select-Object DistinguishedName<br>Set-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" -Add @{AppliesTo=$user.DistinguishedName}<br>```<\/p><p>4.2 FGPP Kontrol<\/p><p>FGPP detaylar\u0131n\u0131 ve kullan\u0131c\u0131ya uygulanan politikalar\u0131 kontrol etmek i\u00e7in:<\/p><p>```powershell<br>Policy detaylar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcle<br>Get-ADFineGrainedPasswordPolicy -Identity \"PolicyName\" | Select-Object PasswordHistoryCount,AppliesTo<\/p><p>Kullan\u0131c\u0131ya uygulanan FGPP'yi kontrol et<br>Get-ADUserResultantPasswordPolicy -Identity \"username\"<br>```<\/p><p>5. Kullan\u0131c\u0131 \u015eifre Durumu Kontrol\u00fc<\/p><p>5.1 Son \u015eifre De\u011fi\u015fikli\u011fi<\/p><p>Kullan\u0131c\u0131n\u0131n son \u015fifre de\u011fi\u015fikli\u011fi tarihini \u00f6\u011frenmek i\u00e7in:<\/p><p>```powershell<br>Get-ADUser username -Properties PasswordLastSet | Select-Object PasswordLastSet<br>```<\/p><p>5.2 Bir Sonraki \u015eifre De\u011fi\u015fikli\u011fi Tarihi<\/p><p>Bir sonraki \u015fifre de\u011fi\u015fikli\u011fi tarihini hesaplamak i\u00e7in:<\/p><p>```powershell<br>$user = Get-ADUser username -Properties PasswordLastSet<br>$nextPossibleChange = $user.PasswordLastSet.AddDays(5)<br>Write-Host \"Bir sonraki \u015fifre de\u011fi\u015fikli\u011fi yap\u0131labilecek tarih: $nextPossibleChange\"<br>```<\/p><p>6. RSOP (Resultant Set of Policy)<\/p><p>Group Policy sonu\u00e7lar\u0131n\u0131 HTML raporu olarak almak i\u00e7in:<\/p><p>```powershell<br>gpresult \/H \"C:\\PasswordPolicies.html\"<br>```<\/p><p>7. \u0130yi Uygulama \u00d6nerileri<\/p><p>7.1 Politika Y\u00f6netimi<\/p><p>- Politika de\u011fi\u015fikliklerini test ortam\u0131nda deneyin.<br>- De\u011fi\u015fiklik \u00f6ncesi mevcut ayarlar\u0131 yedekleyin.<br>- De\u011fi\u015fiklikleri dok\u00fcmante edin.<\/p><p>7.2 G\u00fcvenlik \u00d6nerileri<\/p><p>- Minimum \u015fifre uzunlu\u011fu en az 10 karakter olmal\u0131.<br>- Karma\u015f\u0131kl\u0131k gereksinimleri aktif olmal\u0131.<br>- Makul bir \u015fifre de\u011fi\u015fim s\u00fcresi belirleyin (\u00f6rn. 180 g\u00fcn).<br>- \u015eifre ge\u00e7mi\u015fi en az 5 olmal\u0131.<\/p><p>7.3 Monitoring<\/p><p>- D\u00fczenli olarak politika ayarlar\u0131n\u0131 kontrol edin.<br>- Kullan\u0131c\u0131 \u015fikayetlerini takip edin.<br>- Security log'lar\u0131 d\u00fczenli kontrol edin.<\/p><p>7.4 Dok\u00fcmantasyon<\/p><p>- T\u00fcm politika de\u011fi\u015fikliklerini kaydedin.<br>- \u00d6zel durumlar\u0131 ve istisnalar\u0131 belgelendirin.<br>- Troubleshooting ad\u0131mlar\u0131n\u0131 dok\u00fcmante edin.<\/p><p>Sonu\u00e7<\/p><p>Windows Server ortam\u0131nda Group Policy ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 etkili bir \u015fekilde y\u00f6netebilirsiniz. Bu rehber, \u015fifre politikalar\u0131n\u0131 nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131, g\u00f6r\u00fcnt\u00fcleyece\u011finizi ve d\u00fczenleyece\u011finizi ad\u0131m ad\u0131m anlatmaktad\u0131r. G\u00fcvenli bir ortam sa\u011flamak i\u00e7in bu politikalar\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irmeyi ve g\u00fcncellemeyi unutmay\u0131n.<\/p>","excerpt":"Windows Server ortam\u0131nda, kullan\u0131c\u0131 hesaplar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in \u015fifre politikalar\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. Group Policy (Grup \u0130lkesi) ve PowerShell kullanarak \u015fifre politikalar\u0131n\u0131 nas\u0131l y\u00f6netebilece\u011finizi, g\u00f6r\u00fcnt\u00fcleyebilece\u011finizi ve d\u00fczenleyebilece\u011finizi bu yaz\u0131da detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z.","created_at":"2025-01-09 13:41:51","updated_at":"2026-09-23 11:19:35","category_id":6,"view_count":752,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-01-09 13:41:51","featured_image":"resimyok.jpg","slug":"windows-server-group-policy-ile-sifre-politikalari-yonetimi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}]