Skip to main content

Authentication Job Group

The Authentication job group provides information on authentication settings within audited systems to help identify potential security vulnerabilities and reduce risk within the environment.

Authentication Job Group in the Jobs Tree

The jobs in the Authentication job group are:

  • SG_LSASettings Job – This job lists LSA settings on all targeted hosts. In particular, the RunAsPPL, RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If these keys aren't set to 1, a host is vulnerable to mimikatz and other exploitation tools. See the Microsoft Configuring Additional LSA Protection article for additional information.
  • SG_SecuritySupportProviders Job – This job identifies security support providers on all targeted hosts, highlighting potentially malicious SSPs
  • SG_WDigestSettings Job – This job lists WDigest settings on all targeted hosts. In particular, the UseLogonCredentials key is examined. If the KB isn't installed, and this key isn't set properly for a given host, the host stores cleartext passwords in memory. See the Microsoft Security Advisory article for more information.