Active Directory
Active Directory auditing and hardening: Kerberos, NTLM, privileged accounts, delegation, domain controllers and attack paths, step by step.
Each article starts from what we find when auditing directories and ends with the list of checks to run.
Service accounts: moving to gMSA and dMSA without opening new gaps
Automatically managed passwords, retrieval rights, limits, migration steps, and caution around Windows Server 2025 dMSAs following the "BadSuccessor" research.
Active DirectoryActive Directory delegations: finding and cleaning up excessive rights on OUs and objects
GenericAll, WriteDacl, delegated password resets: how ACLs accumulated on OUs create attack paths, and how to analyse and then clean them up.
Active DirectoryMachineAccountQuota: why any user can still add ten computers to your domain
The default ms-DS-MachineAccountQuota lets any account create computer accounts. Why this makes many attacks easier, and how to delegate domain join properly instead.
Active DirectoryThe first 48 hours of an Active Directory compromise: contain, preserve, take back control
Containment, preserving evidence, resetting privileged accounts, the double krbtgt reset and its timing, the rebuild decision and communication: a framework for the first hours.
Active DirectoryAD-integrated DNS: securing zones, dynamic updates and the DnsAdmins group
Dynamic updates, record creation by any authenticated user, WPAD, wildcard records and the DnsAdmins group: the blind spots of Active Directory-integrated DNS.
Active DirectoryGroup Managed Service Accounts (gMSA): putting an end to static service passwords
gMSAs replace fixed-password service accounts with long, automatically rotated secrets. The key is still controlling who is allowed to retrieve them.
Active DirectoryMachineAccountQuota: why any user can join machines to your domain, and how to stop it
By default, every authenticated user can create up to ten computer accounts. A legacy setting that enables several attack paths and is simple to fix.
Active DirectoryThe Protected Users group: strong protections for privileged accounts, deployed with care
No NTLM, no delegation, no RC4, short-lived TGTs: Protected Users hardens sensitive accounts with no extra tooling. How to use it and the pitfalls to avoid.
Active DirectoryAuthentication policies and silos: restricting where Tier 0 accounts can sign in
Authentication silos let the domain controller refuse a Kerberos ticket to a privileged account signing in from an unauthorised machine.
Active DirectoryDangerous ACLs in Active Directory: forgotten delegations that lead to Domain Admins
GenericAll, WriteDACL, WriteOwner, password reset: some permissions on sensitive objects are as good as membership of privileged groups.
Active DirectoryShadow credentials: understanding and controlling the msDS-KeyCredentialLink attribute
Designed for Windows Hello for Business, the msDS-KeyCredentialLink attribute lets whoever can write it authenticate as the account. Who holds that right in your domain?
Active DirectorySecrets in SYSVOL: cpassword, scripts and clear-text passwords readable by everyone
More than ten years after MS14-025, we still find Group Policy Preferences passwords and clear-text credentials in SYSVOL. How to find and remove them.
Active DirectoryProtecting LSASS: LSA protection and Credential Guard, what they block and what they don't
In-memory credential theft remains central to Active Directory compromises. Two protections built into Windows make it much harder, provided they are deployed correctly.
Active DirectoryStopping privileged accounts from signing in to lower tiers with user rights assignment
"Deny log on" user rights applied through Group Policy make the tier model real: a domain administrator must never leave credentials on a user workstation.
Active DirectoryPrivileged Access Workstations (PAW): administering Active Directory from a clean source
Administering the domain from the machine you also use for email exposes your most sensitive accounts to the first successful phishing. Principles and architecture of a privileged access workstation.
Active DirectoryForest and domain functional levels: what each level actually brings to security
Protected Users, authentication policies, LAPS encryption, the Windows Server 2025 level: the protections tied to functional levels, and how to raise them safely.
Active DirectoryDomain controllers on unsupported Windows Server versions: getting out of the dead end cleanly
An unpatched domain controller exposes the whole forest. Inventory, in-place upgrade versus new DC, demotion and metadata cleanup.
Active DirectoryRead-only domain controllers: getting the Password Replication Policy right
An RODC is only as safe as its Password Replication Policy. Allowed and denied groups, dedicated krbtgt accounts, delegated administrators and branch office risks.
Active DirectoryAD-integrated DNS: secure updates, record creation rights and booby-trapped records
Dynamic updates, Authenticated Users rights, wildcard and WPAD records, the DnsAdmins group, scavenging: the DNS settings that matter for AD security.
Active DirectoryLLMNR, NBT-NS and mDNS: shutting down the fallback name resolution that leaks your NTLM hashes
When DNS fails, Windows asks the local network and trusts the first answer. Understanding poisoning, disabling these protocols via GPO and DHCP, and anticipating what might break.
Active DirectoryDHCPv6 spoofing and WPAD: when a network "without IPv6" becomes a way in
Windows prefers IPv6 even where nobody deployed it. How a rogue DHCPv6 server hijacks DNS and WPAD to feed NTLM relay, and the right countermeasures.
Active DirectoryKerberos encryption: moving off RC4 to AES without breaking services
RC4 makes Kerberoasting easier and Microsoft is preparing its retirement. msDS-SupportedEncryptionTypes, accounts without AES keys, ticket logs: a method to migrate safely.
Active DirectoryRisky userAccountControl flags: finding and fixing them before an attacker does
Password not required, reversible encryption, DES, unconstrained delegation: these quiet bits weaken your accounts. How to find them and remove them properly.
Active DirectorySIDHistory: the migration legacy that can hide privileges
Essential during a migration, SIDHistory becomes a risk if it lingers. Legitimate use, abuse for persistence, auditing, cleanup and SID filtering on trusts.
Active DirectoryActive Directory Recycle Bin: enabling it, restoring objects and knowing its limits
An accidentally deleted OU should never require restoring a domain controller. Enabling, lifetimes, restoring objects and memberships, and what only a backup still covers.
Active DirectoryMicrosoft Defender for Identity: what the sensors really detect, and what they do not replace
Sensors on domain controllers, AD FS, AD CS and Entra Connect, detections, posture assessments and tuning: how to get value from Defender for Identity without expecting miracles.
Active DirectoryNetwork isolation of domain controllers: no Internet, controlled flows and an active firewall
A domain controller does not browse the Internet, accepts administration only from dedicated workstations and filters its traffic: the network rules that protect the heart of the directory.
Active DirectoryTime synchronization in Active Directory: the PDC emulator, Kerberos and virtualization pitfalls
A skewed clock breaks Kerberos, corrupts logs and weakens certificates. How to build a reliable time hierarchy, from the PDC emulator down to virtualized domain controllers.
Active DirectoryPasswords in Active Directory attributes: the Description field anyone can read
Description, info, comment, userPassword: passwords sit in attributes any authenticated user can read. How to find them, remove them and keep them from coming back.
Active DirectoryDesigning OUs for delegated administration without creating attack paths
Separate tiers, delegate to groups rather than people, control inheritance and document everything: the principles of an OU structure that supports security instead of undermining it.
Active DirectorySchema Admins and Enterprise Admins: groups that should stay empty
The two most powerful groups in the forest only need members a few hours a year. Temporary membership, hardening the built-in Administrator account and monitoring changes.
Active DirectoryDomain password policy: favour length, rethink lockout
Length over complexity, passphrases, lockout threshold versus password spraying and fine-grained policies: bringing the domain policy in line with current guidance.
Active DirectoryPre-Windows 2000 Compatible Access and anonymous access: closing directory enumeration
A legacy group, a dSHeuristics setting and a few security options can be enough to open the directory to anonymous queries. How to check and harden without breaking applications.
Active DirectoryWDigest, LM hashes and NTLMv1: removing the legacy settings that expose credentials
Clear-text passwords in memory, stored LM hashes, NTLMv1 authentication still accepted: three legacy issues still found in audits, and the Group Policy settings that fix them.
Active DirectoryAuthentication coercion and NTLM relay: understanding PetitPotam and its relatives to defend against them
PetitPotam, DFSCoerce, the printer bug: forcing a domain controller to authenticate, then relaying that authentication. The concept, and the measures that break the chain.