Hi,
Recently I Find out when I run Query on my Active Directory and get dsa.msc on Primary DC it take Long time to run , one person claimed My dc Was hacked by him . he tell me till now each user change their password he can see changes password online on his application ,I think he got online replication of NTDS.DIT active directory replication or use periodic query to DC with high user privilege.
I dont know the name of his application and the way he can see user`s password as soon as i change it on active directory?
I changed the domain administrator password and he told me the new password.
I use Microsoft Tcp/View and Microsoft Processed Explorer and I did not see any suspicious process and it seems it is ok ,I use tcp view it show s lots of tcp connection from client machine and server .
I really dont know how could I solve this problem and fin out how he hacked and see domain user`s password.
I want to stop him and solve this problem.
you will be kind enough if you helping me?
Regard