How to verify Active Directory domain "identity"?

Question

How to verify Active Directory domain "identity"?

MDell.Seradex 1

I am writing a .NET application and am wondering if there is a way to concretely identify that the Active Directory domain the application is running in is mine and not another domain attempting to impersonate mine.
In this case the internal domain names would be the identical, but they are actually separate domains running on different networks.
I was thinking of something like a certificate on the domain that I can validate, but would accept anything else.

Jack J Jun 25,296 Reputation points

2022-12-07T09:41:10.54+00:00

@MDell.Seradex , Welcome to Microsoft Q&A, I suggest that you could use your username and groupname to verify the identity of the domain. Please refer to the answer How to check if a user belongs to an AD group?.
MDell.Seradex 1 Reputation point

2022-12-08T18:44:36.333+00:00

Aren't those names something that could be replicated in another domain?
I am not trying to determine if the current account is a member of the domain, but instead am trying to validate that the domain is one that my company setup.
This is akin to how when one acquires a code signing certificate you are verified to confirm that you are actually who you say you are. As such I cannot just say that I am Microsoft, for instance.
I could create a domain on my network called "microsoft.com", but it would not really be Microsoft's domain.

I hope that clarifies what I am asking for. Perhaps it is not possible.

1 answer

Your answer

Jack J Jun 25,296 Reputation points

2022-12-07T09:41:10.54+00:00

@MDell.Seradex , Welcome to Microsoft Q&A, I suggest that you could use your username and groupname to verify the identity of the domain. Please refer to the answer How to check if a user belongs to an AD group?.
MDell.Seradex 1 Reputation point

2022-12-08T18:44:36.333+00:00

Aren't those names something that could be replicated in another domain?
I am not trying to determine if the current account is a member of the domain, but instead am trying to validate that the domain is one that my company setup.
This is akin to how when one acquires a code signing certificate you are verified to confirm that you are actually who you say you are. As such I cannot just say that I am Microsoft, for instance.
I could create a domain on my network called "microsoft.com", but it would not really be Microsoft's domain.

I hope that clarifies what I am asking for. Perhaps it is not possible.

Answer 1

Bruce (SqlWork.com) 78,006 Volunteer Moderator

domain controllers do use a certificate. But assuming your app is hosted by a "fake" domain, which installed an internal certificate as trusted, you would need to supply your own certificate validation routine.

Share via

How to verify Active Directory domain "identity"?

1 answer

Your answer