{"id":403,"date":"2022-12-27T22:26:43","date_gmt":"2022-12-27T21:26:43","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=403"},"modified":"2022-12-27T23:45:08","modified_gmt":"2022-12-27T22:45:08","slug":"how-to-do-an-password-audit-of-your-active-directory-passwords-using-dsinternals","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=403","title":{"rendered":"How to do a Password Audit of your Active Directory passwords using DSInternals?"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Would you like to <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>detect if service accounts or admins are re-using same passwords in Active Directory<\/li>\n\n\n\n<li>detect if any accounts are using company standard passwords, based on a dictionary (TXT-file you can provide)<\/li>\n\n\n\n<li>detect if sensitive accounts are using passwords, previously being hacked and found on HaveIBeenPwned<\/li>\n\n\n\n<li>detect users with no password set<\/li>\n\n\n\n<li>detect users with same passwords<\/li>\n\n\n\n<li>detect accounts that are susceptible to the Kerberoasting attack<\/li>\n\n\n\n<li>detect administrative accounts that are allowed to be delegated to a service<\/li>\n\n\n\n<li>detect accounts where Kerberos pre-authentication is not required<\/li>\n\n\n\n<li>detect accounts where Kerberos AES keys are missing<\/li>\n\n\n\n<li>detect computer accounts having default passwords<\/li>\n\n\n\n<li>detect accounts with &#8216;passwords will never expire&#8217;<\/li>\n\n\n\n<li>detect accounts that are not required to have a password<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If yes, then continue on reading this blog-post \ud83d\ude42<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Great job Michael Grafnetter<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Initially, I would like to thank the author of DSInternals, Microsoft MVP Michael Grafnetter, for creating the amazing powershell module, <a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\" target=\"_blank\" rel=\"noreferrer noopener\">DSInternals<\/a>. This is a rockstar tool !!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is DSInternals ?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DSInternals project consists of these two parts:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The&nbsp;<a href=\"https:\/\/www.nuget.org\/profiles\/DSInternals\">DSInternals Framework<\/a>&nbsp;exposes several internal features of&nbsp;<em>Active Directory<\/em>&nbsp;and can be used from any .NET application.<\/li>\n\n\n\n<li>The&nbsp;<a href=\"https:\/\/www.powershellgallery.com\/packages\/DSInternals\/\">DSInternals PowerShell Module<\/a>&nbsp;provides easy-to-use cmdlets that are built on top of the Framework. These are the main features:\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-AzureADUserEx.md#get-azureaduserex\">Azure Active Directory FIDO2 key auditing<\/a>&nbsp;and retrieval of system information about all user-registered key credentials.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Test-PasswordQuality.md#test-passwordquality\">Active Directory password auditing<\/a>&nbsp;that discovers accounts sharing the same passwords or having passwords in a public database like&nbsp;<a href=\"https:\/\/haveibeenpwned.com\/\">HaveIBeenPwned<\/a>&nbsp;or in a custom dictionary.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-ADKeyCredential.md#get-adkeycredential\">Key credential auditing and generation<\/a>, including support for NGC, FIDO2 and STK keys. Keys can also be tested against the&nbsp;<a href=\"https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/ADV190026\">ROCA vulnerability<\/a>. New NGC keys can also be&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Add-ADReplNgcKey.md#add-adreplngckey\">registered through the MS-DRSR protocol<\/a>.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/New-ADDBRestoreFromMediaScript.md#new-addbrestorefrommediascript\">Bare-metal recovery of domain controllers<\/a>&nbsp;from just IFM backups (ntds.dit + SYSVOL).<\/li>\n\n\n\n<li>Offline ntds.dit file manipulation, including&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-ADDBAccount.md#get-addbaccount\">hash dumping<\/a>,&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Set-ADDBAccountPassword.md#set-addbaccountpassword\">password resets<\/a>,&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Set-ADDBPrimaryGroup.md#set-addbprimarygroup\">group membership changes<\/a>,&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Add-ADDBSidHistory.md#add-addbsidhistory\">SID History injection<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Enable-ADDBAccount.md#enable-addbaccount\">enabling<\/a>\/<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Disable-ADDBAccount.md#disable-addbaccount\">disabling<\/a>&nbsp;accounts.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-ADReplAccount.md#get-adreplaccount\">Online password hash dumping<\/a>&nbsp;through the Directory Replication Service (DRS) Remote Protocol (MS-DRSR). This feature is commonly called DCSync.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Set-SamAccountPasswordHash.md#set-samaccountpasswordhash\">Domain or local account password hash injection<\/a>&nbsp;through the Security Account Manager (SAM) Remote Protocol (MS-SAMR) or&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Set-ADDBAccountPasswordHash.md#set-addbaccountpasswordhash\">directly into the database<\/a>.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Set-LsaPolicyInformation.md#set-lsapolicyinformation\">LSA Policy modification<\/a>&nbsp;through the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD \/ LSARPC).<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Save-DPAPIBlob.md#save-dpapiblob\">Extracting credential roaming data<\/a>&nbsp;and DPAPI domain backup keys, either online through&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-ADReplBackupKey.md#get-adreplbackupkey\">directory replication<\/a>,&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-LsaBackupKey.md#get-lsabackupkey\">LSARPC<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/Get-ADDBBackupKey.md#get-addbbackupkey\">offline from ntds.dit<\/a>.<\/li>\n\n\n\n<li>Password hash calculation, including&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/ConvertTo-NTHash.md#convertto-nthash\">NT hash<\/a>,&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/ConvertTo-LMHash.md#convertto-lmhash\">LM hash<\/a>&nbsp;and&nbsp;<a href=\"https:\/\/github.com\/MichaelGrafnetter\/DSInternals\/blob\/master\/Documentation\/PowerShell\/ConvertTo-KerberosKey.md#convertto-kerberoskey\">kerberos keys<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">How I use it for Password Auditing?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">I use <strong>DSInternals<\/strong>  for <strong>Password auditing<\/strong> to :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>detect if service accounts or admins are re-using same passwords. They must have an unique password<\/li>\n\n\n\n<li>detect if any accounts are using company standard passwords, based on a dictionary (TXT-file you can provide)<\/li>\n\n\n\n<li>detect if sensitive accounts are using passwords, previously being hacked and found on HaveIBeenPwned<\/li>\n\n\n\n<li>detect users with no password set<\/li>\n\n\n\n<li>detect users with same passwords<\/li>\n\n\n\n<li>detect accounts that are susceptible to the Kerberoasting attack<\/li>\n\n\n\n<li>detect administrative accounts that are allowed to be delegated to a service<\/li>\n\n\n\n<li>detect accounts where Kerberos pre-authentication is not required<\/li>\n\n\n\n<li>detect accounts where Kerberos AES keys are missing<\/li>\n\n\n\n<li>detect computer accounts having default passwords<\/li>\n\n\n\n<li>detect accounts with &#8216;passwords will never expire&#8217;<\/li>\n\n\n\n<li>detect accounts that are not required to have a password<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I have uploaded my <a href=\"https:\/\/github.com\/KnudsenMorten\/ActiveDirectory_Password_Overview_using_DSInternals\" target=\"_blank\" rel=\"noreferrer noopener\">script on my github<\/a>, where you can see how I use the tool for password auditing.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Script (main program)<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>#--------------------------------------------------------\r\n# Variables\r\n#--------------------------------------------------------\r\n\r\n$PathOutput = \"D:\\Scripts\\Output\"\r\n\n# This is the location where your password dictionary file exists. You can start by creating a simple file with one line like Password1234\r\n$Passwords  = \"D:\\SCRIPTS\\DATA\\AD-DictionaryPasswords.txt\"\r\n\r\n\r\n#------------------------------------------------------------------------------------------------------------\r\n# MAIN PROGRAM\r\n#------------------------------------------------------------------------------------------------------------\r\n\r\n$ExportDateTime = Get-Date -Format \"yyyy-MM-dd_HH-mm-ss\"\r\n\r\n$OutPutReport_ALL                   = \"$($PathOutput)\\OUTPUT\\AD-PasswordQualityReport_ALL_$($ExportDateTime).txt\"\r\n$OutPutReport_Enabled_Only_ALL      = \"$($PathOutput)\\OUTPUT\\AD-PasswordQualityReport_Enabled_Only_ALL_$($ExportDateTime).txt\"\r\n$OutPutReport_Disabled_Only_ALL     = \"$($PathOutput)\\OUTPUT\\AD-PasswordQualityReport_Disabled_Only_ALL_$($ExportDateTime).txt\"\r\n$OutPutReport_Admins_Only_ALL       = \"$($PathOutput)\\OUTPUT\\AD-PasswordQualityReport_Admins_Only_ALL_$($ExportDateTime).txt\"\r\n\r\n$Result_ALL                         = Get-ADReplAccount -All:$true -Server (Get-ADDomainController).Hostname -NamingContext (Get-ADRootDSE | select *naming*).defaultNamingContext\r\n$Result_Enabled_Only_ALL            = $Result_ALL | Where-Object { ($_.Enabled -eq $true) -and ($_.SamAccountType -eq \"User\") }\r\n$Result_Disabled_Only_ALL           = $Result_ALL | Where-Object { ($_.Enabled -eq $false) -and ($_.SamAccountType -eq \"User\")}\r\n$Result_Admins_Only_ALL             = $Result_ALL | Where-Object { ($_.AdminCount -eq $true)  -and ($_.SamAccountType -eq \"User\")}\r\n\r\n$PasswordResult_All                 = $Result_ALL | Test-PasswordQuality -WeakPasswordsFile $Passwords\r\n$PasswordResult_Enabled_Only_ALL    = $Result_Enabled_Only_ALL | Test-PasswordQuality -WeakPasswordsFile $Passwords\r\n$PasswordResult_Disabled_Only_ALL   = $Result_Disabled_Only_ALL | Test-PasswordQuality -WeakPasswordsFile $Passwords\r\n$PasswordResult_Admins_Only_ALL     = $Result_Admins_Only_ALL | Test-PasswordQuality -WeakPasswordsFile $Passwords\r\n\r\nWrite-Output \"Building reports ....\"\r\n$PasswordResult_All | Out-File -FilePath $OutPutReport_ALL -Encoding UTF8\r\n$PasswordResult_Enabled_Only_ALL | Out-File -FilePath $OutPutReport_Enabled_Only_ALL -Encoding UTF8\r\n$PasswordResult_Disabled_Only_ALL | Out-File -FilePath $OutPutReport_Disabled_Only_ALL -Encoding UTF8\r\n$PasswordResult_Admins_Only_ALL | Out-File -FilePath $OutPutReport_Admins_Only_ALL -Encoding UTF8\r\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tip &#8211; adding OU-filtering<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ADReplAccount -All -Server 'dcsrv01.contoso.com' |\n    Where-Object DistinguishedName -like '*,OU=Admins,DC=contoso,DC=com' |\n    Test-PasswordQuality -WeakPasswordHashesSortedFile d:\\scripts\\data\\ad-passwords.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Output<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Active Directory Password Quality Report\n----------------------------------------\n\nPasswords of these accounts are stored using reversible encryption:\n  \nLM hashes of passwords of these accounts are present:\n  \nThese accounts have no password set:\n  \nPasswords of these accounts have been found in the dictionary:\n  \nThese groups of accounts have the same passwords:\n  Group 1:\n\txxxxx\n\tyyyyy\n  Group 2:\n\txxxxx\n\tyyyyy\n  \nThese computer accounts have default passwords:\n  \nKerberos AES keys are missing from these accounts:\n  \nKerberos pre-authentication is not required for these accounts:\n  \nOnly DES encryption is allowed to be used with these accounts:\n  \nThese accounts are susceptible to the Kerberoasting attack:\n\txxxxx\n\tyyyyy\n  \nThese administrative accounts are allowed to be delegated to a service:\n\txxxxx\n\tyyyyy\n  \nPasswords of these accounts will never expire:\n\txxxxx\n\tyyyyy\n  \nThese accounts are not required to have a password:\n  \nThese accounts that require smart card authentication have a password:\n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Prerequisites before running the script<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Microsoft Defender for Identity Exclusions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In case your environment is monitoring by <strong>Microsoft Defender for Identity<\/strong>, please start by making an exception of the machine, from where you run the scripts. Otherwise you will get an alert with &#8216;Suspected DCSync attack (replication of directory services)&#8217;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"662\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-1024x662.png\" alt=\"\" class=\"wp-image-404\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-1024x662.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-300x194.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-768x496.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-1536x992.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/DSInternals_MDI_Exclude-2048x1323.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Creation of company dictionary password file<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create a text-file with any known company passwords, one line per password (sample below)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/KnudsenMorten\/ActiveDirectory_Password_Overview_using_DSInternals\/blob\/main\/Sample%20AD-DictionaryPasswords.txt\" target=\"_blank\" rel=\"noreferrer noopener\">Link to sample file<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Password2020\nPassword2021\nPassword2022\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Installation of Powershell module, DSInternals<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># TLS 1.2 must be enabled on older versions of Windows.\n&#91;System.Net.ServicePointManager]::SecurityProtocol = &#91;System.Net.SecurityProtocolType]::Tls12\n\n# Download the NuGet package manager binary.\nInstall-PackageProvider -Name NuGet -Force\n\n# Register the PowerShell Gallery as package repository if it is missing for any reason.\nif($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) { Register-PSRepository -Default }\n\n# Download the DSInternals PowerShell module.\nInstall-Module -Name DSInternals -Force\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">More information<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Please check out the official DSInternal homepage using <a href=\"https:\/\/www.dsinternals.com\/en\/\" target=\"_blank\" rel=\"noreferrer noopener\">this link<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here you can find other great blog-posts of how to use the other features.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Great job Michael Grafnetter Initially, I would like to thank the author of DSInternals, Microsoft MVP Michael Grafnetter, for creating &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"How to do a Password Audit of your Active Directory passwords using DSInternals?\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=403#more-403\" aria-label=\"Read more about How to do a Password Audit of your Active Directory passwords using DSInternals?\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":409,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[70,38,56,71],"tags":[73,77,74,76,72,79,80,75,78],"class_list":["post-403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory","category-defender-for-identity","category-m365-security","category-password-audit","tag-active-directory","tag-activedirectory","tag-ad","tag-dsinternals","tag-m365-security","tag-m365security","tag-microsoftsecurity","tag-password-audit","tag-passwordaudit","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/passwords.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/passwords.png","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=403"}],"version-history":[{"count":5,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/403\/revisions"}],"predecessor-version":[{"id":414,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/403\/revisions\/414"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/409"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}