Security Blog
Technical perspectives on Active Directory, Windows and Microsoft security, networks, vulnerabilities and effective hardening.
A linked GPO is not yet an effective control. Check refresh, replication and restart requirements separately, roll out changes in stages and verify the resulting state on each endpoint.
RMM tools are privileged admin paths. Sustainable control separates Tier 0, hardens approved services, and blocks shadow access through application and network controls.
AD's built-in complexity rule is only a baseline. Sufficient length, targeted fine-grained password policies and a controlled banned-password rollout create a stronger, measurable password standard.
A disabled policy value does not remove passwords that were already stored reversibly. Checking domain policy, fine-grained password policies and user options, followed by controlled password rotation, removes the exposure.
PowerShell cannot be secured reliably with an execution policy or by blocking one executable. Application control, separate admin paths, JEA and protected telemetry create an enforceable execution boundary.
Unauthenticated SMB access turns a legacy share into a client-side security exception. Explicitly block insecure guest logons, replace guest access with named identities, and contain unavoidable transitions.
A domain join is a privileged provisioning operation. Separate roles, narrow OU rights, protected pre-staging and reuse workflows, and dependable telemetry replace broadly privileged join accounts.
SPNs are normal; the risk is a requestable service ticket combined with a weak secret and excessive privileges. gMSA, rotation, least privilege and ticket monitoring create the controlled target state.
Signed does not automatically mean safe for kernel drivers. The Microsoft Vulnerable Driver Blocklist closes known driver paths, but enterprise deployment still needs inventory, piloting, telemetry and a dependable recovery path.
Cached domain logons keep devices usable without a Domain Controller, but they also enlarge the local verifier set. A device-class-specific Group Policy baseline reduces the slots without locking out mobile users or recovery paths.
Windows clients rarely need unrestricted inbound reachability from other endpoints. A staged Group Policy baseline with default inbound blocking, narrowly scoped exceptions and central logging turns the local firewall into an enforceable boundary without disrupting normal operations.
AppLocker reduces the freely executable software surface on Windows systems. A defensible rollout starts in audit mode, separates device classes and rule collections, and enforces a maintainable allowlist only after the telemetry has been reviewed.
Domain members normally rotate their machine account password every 30 days. A sound AD baseline preserves that behavior, detects exceptions and treats stale passwords as lifecycle evidence rather than an automatic trust failure.
Microsoft Entra Connect links on-premises Active Directory and Entra ID through powerful accounts, rules and write paths. The sync server therefore belongs in the control plane, with narrow administration, minimum permissions, guarded exports and tested recovery.
LDAPS is not a single port switch. A reliable rollout needs valid Domain Controller certificates, clean trust chains, tested clients and a clear decision on which LDAP fallbacks remain acceptable.
SYSVOL and NETLOGON look ordinary, but they are critical AD paths. Hardened UNC Paths enforce Kerberos-based server authentication and SMB integrity instead of letting Group Policy load across weak paths.
WinRM is useful for Windows administration, but Basic Auth and unencrypted fallbacks do not belong in an AD baseline. Kerberos, narrow listeners, no stored admin credentials and clear exceptions are the better operating state.
Domain Controllers are not normal administration servers. RDP should only be possible for clearly defined Tier-0 administrators, from controlled networks and with visible logging.
Anonymous queries in older Windows environments often reveal more inventory than expected. A clean baseline limits null sessions, SAMR, named pipes, shares and guest paths without blindly breaking legacy systems.
sIDHistory is useful during domain migrations, but often remains as a quiet authorization anchor afterwards. A clean removal needs inventory, owners, access testing and a controlled pilot.
Credential Guard protects NTLM hashes and Kerberos material from normal compromised Windows sessions. Start with admin and Tier-0 systems, then roll out with hardware, driver and SSO validation.
AD DNS decides how systems find Domain Controllers, services, and administrative paths. Secure updates, clean permissions, scavenging, and controlled zone transfers belong in every AD hardening program.
Service accounts should run workloads, not become convenient shared users. Interactive sign-in, RDP, and local logon should be blocked in a controlled way without breaking legitimate service and batch workloads.
The Account Lockout Threshold is not a complete spray defense. Set well, it limits online guessing, creates usable signals, and exposes stale credential problems. Set badly, it locks the business out.
AS-REP Roasting usually starts with a simple account setting: Kerberos pre-authentication is not required. The fix is technically small, but it needs ownership, testing, and drift control.
Coerce attacks are rarely fixed by one setting. The real question is which systems can still trigger NTLM, SMB, RPC or HTTP authentication unexpectedly.
Unconstrained Delegation is often a historical convenience setting for old double-hop scenarios. In modern AD environments, it should be practically absent outside domain controllers.
AD CS indirectly controls who can authenticate as whom. If templates, enrollment rights and CA operations are unmanaged, PKI can become a domain takeover path.
Kerberos Armoring (FAST) hardens Kerberos pre-authentication and reduces exposure to certain offline and downgrade paths. The value is real — but only with dependency visibility, staged rollout, and well-tested rollback per scope.
LSASS is a prime target for credential theft. RunAsPPL makes direct access significantly harder — if you handle compatibility, rollout and operations with discipline.
The krbtgt account is the foundation of Kerberos ticket integrity in an AD domain. Rotating it is not a casual “password change” — it’s a controlled operation with replication, ticket lifetimes, and dependencies. This is a practical, low-drama rollout approach, including limits and a project checklist.
Deleted users, groups, or OUs are a very real operational risk — and classic backup restores are often too heavy for the job. With the AD Recycle Bin you get a pragmatic, auditable restore option, if you roll it out properly.
SMBv1 has no place in modern AD environments — yet in practice it’s often still enabled somewhere. This is a controlled, low-drama way to remove SMBv1 from clients, servers, and images without breaking operations.
When DNS fails, Windows often falls back to LLMNR or NetBIOS (NBT-NS) — multicast/broadcast instead of authority. That’s unnecessary attack surface and creates confusing authentication noise. Here’s a controlled, project-friendly rollout.
WDigest is a legacy mechanism that can be re-enabled by old images, GPOs, or troubleshooting workarounds. Here’s how to verify the current state, enforce a robust baseline, and keep plaintext passwords out of LSASS.
Domain Controllers are Tier 0. Print services don’t belong there. This is how to disable the Print Spooler safely, handle exceptions, and make the control auditable.
Unsigned LDAP binds are an avoidable risk lever. A controlled rollout starts with dependency visibility, clear telemetry and staged enforcement.
When regular users can create computer objects, unnecessary attack paths appear. MachineAccountQuota should be a decision, not an inherited default.
Protected Users is powerful, but not for broad rollout. Its value depends on carefully selected accounts and tested admin paths.
NTLM is rarely removed in one step. A reliable approach starts with audit data, clear exceptions and a Kerberos target state.
SMB signing does not secure every file share by itself, but it removes an important lever from relay-style attacks.
LAPS reduces lateral movement only when scope, permissions, rotation and DSRM recovery are planned deliberately.
Critical vulnerabilities must be assessed quickly, but always in the context of exposure, exploitability and compensating controls.
Conditional Access is not a one-off project, but a continuous control layer for identities, devices, risk and administrative access.
Why AD security should not be treated as a one-off check, but as a prioritized project building block for risk reduction, audit readiness and incident readiness.
Ransomware readiness is not decided by the backup tool alone, but by identities, recovery paths and separated administration models.
Firewall and NGFW rulebases quickly lose value without maintenance. Good hygiene reduces attack surface and improves audit readiness.
EDR creates value only through clean policies, meaningful exceptions, incident processes and tests against realistic attack techniques.
Zero Trust works better as an architecture principle than as a product category: identities, devices, segmentation and visibility must align.
For critical-infrastructure environments, remote access is defensible only when identity, segmentation, logging and emergency operations are designed together.
Awareness reduces risk sustainably only when technical controls, reporting paths and measurable improvements are included.
