Similar Active Directory Problems Everywhere
𝗧𝗵𝗲𝘀𝗲 𝘁𝘄𝗼 𝗺𝗶𝘀𝘁𝗮𝗸𝗲𝘀 𝗸𝗲𝗲𝗽 𝘀𝗵𝗼𝘄𝗶𝗻𝗴 𝘂𝗽 𝗶𝗻 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁𝘀 After 35+ Active Directory security assessments, I keep seeing the same patterns—regardless of the company, industry, or environment size. 1️⃣ 𝗡𝗼 𝗿𝗲𝗮𝗹 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹 / 𝗹𝗲𝗮𝘀𝘁 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 ⚠️ 86% of assessed environments Administrative accounts are used on user workstations, privileged access isn’t properly separated, and […]
Active Directory – primaryGroupID
💡 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 🔒 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗽𝗿𝗶𝗺𝗮𝗿𝘆𝗚𝗿𝗼𝘂𝗽𝗜𝗗: 𝗰𝗵𝗲𝗰𝗸 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂𝗿 𝘁𝗼𝗼𝗹𝘀 𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 Active Directory group membership is not only defined by the member / memberOf attributes. A user can also be a member of a group through their primaryGroupID. 𝗧𝗵𝗶𝘀 𝗰𝗿𝗲𝗮𝘁𝗲𝘀 𝘀𝗼𝗺𝗲 𝗶𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗶𝗻𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗶𝗲𝘀: 🔹 Get-ADGroupMember returns users whose primaryGroupID points to the […]
Active Directory Certificate Services – ESC2
🔒 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 💡 𝗘𝗦𝗖 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀: 𝗟𝗲𝘁’𝘀 𝗹𝗼𝗼𝗸 𝗮𝘁 𝗘𝗦𝗖𝟮 Last time we covered ESC1. Today, another dangerous 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗔𝗗 𝗖𝗦)misconfiguration. 🎯 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗘𝗦𝗖𝟮? ESC2 involves certificate templates with overly broad usage, specifically templates where the Extended Key Usage (EKU) is set to Any Purpose or no EKU is specified. A template is […]
Automatic Windows event auditing
🔒 Secure Bits 💡 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗮𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗶𝗻 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗳𝗼𝗿 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗻𝗼𝘄 𝗴𝗼𝗲𝘀 𝗯𝗲𝘆𝗼𝗻𝗱 𝗱𝗼𝗺𝗮𝗶𝗻 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗿𝘀 You can now enable Windows event auditing on 𝗔𝗗 𝗖𝗦, 𝗔𝗗 𝗙𝗦 and 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗘𝗻𝘁𝗿𝗮 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 servers automatically. The servers have to run the 𝘀𝗲𝗻𝘀𝗼𝗿 𝘃𝟯.𝘅 to get the audit configuration automatically. 🛠️ 𝗪𝗵𝗲𝗿𝗲 𝘁𝗼 𝘁𝘂𝗿𝗻 𝗶𝘁 𝗼𝗻: Microsoft […]
Do you disable services?
𝗗𝗲𝗳𝗮𝘂𝗹𝘁 → 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 Real configs. Real fixes. Windows & AD security. 𝗗𝗼 𝘆𝗼𝘂 𝗱𝗶𝘀𝗮𝗯𝗹𝗲 𝘂𝗻𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝘆 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 𝗼𝗻 𝘆𝗼𝘂𝗿 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗱𝗲𝘃𝗶𝗰𝗲𝘀? I am actually surprised how rarely I see this security measure implemented. Why disable services at all? ✅ Simple: 𝗿𝗲𝗱𝘂𝗰𝗲 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸 𝘀𝘂𝗿𝗳𝗮𝗰𝗲. Fewer unnecessary services running means fewer components and potential vulnerabilities you need to care […]
Active Directory Certificate Services – ESC1
🔒 Secure Bits 💡 Have you ever heard of 𝗘𝗦𝗖 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀? I guess you have. If you’re running 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗔𝗗 𝗖𝗦) and haven’t audited it for ESC misconfigurations – you may be sitting on a 𝘁𝗶𝗰𝗸𝗶𝗻𝗴 𝘁𝗶𝗺𝗲 𝗯𝗼𝗺𝗯. 💣 🎯 ESC vulnerabilities (Enterprise PKI Escalation Paths) are incredibly 𝗰𝗼𝗺𝗺𝗼𝗻 and highly 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀. […]
Trust account & Windows Server 2025 changes
🔒 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 💡 𝗢𝗻𝗲-𝘄𝗮𝘆 𝗔𝗗 𝘁𝗿𝘂𝘀𝘁? 𝗗𝗼𝗻’𝘁 𝗮𝘀𝘀𝘂𝗺𝗲 𝘁𝗵𝗲 𝗿𝗶𝘀𝗸 𝗼𝗻𝗹𝘆 𝗴𝗼𝗲𝘀 𝗼𝗻𝗲 𝘄𝗮𝘆. This is one of those Active Directory behaviors I think deserves much more attention. With a 𝗼𝗻𝗲-𝘄𝗮𝘆 forest or external trust, we naturally think about the direction of the trust: ➡️ Forest A trusts Forest B → users from B […]
Do you follow licensing policy?
🔒 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 💡 𝗔𝗿𝗲 𝘆𝗼𝘂 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝘁𝗲𝗻𝗮𝗻𝘁-𝘄𝗶𝗱𝗲 𝗳𝗲𝗮𝘁𝘂𝗿𝗲𝘀 𝗼𝗻 𝗼𝗻𝗲 𝗹𝗶𝗰𝗲𝗻𝘀𝗲? I warned our customers for years that this could happen. Microsoft tolerated license noncompliance in tenants for a long time. This summer I noticed one thing changed in Microsoft 365 that is here to fight it. 🔹 𝗢𝗻𝗲 𝗹𝗶𝗰𝗲𝗻𝘀𝗲 𝗳𝗼𝗿 𝘁𝗵𝗲 𝘄𝗵𝗼𝗹𝗲 𝘁𝗲𝗻𝗮𝗻𝘁 […]
Windows – Clipboard history
⏱️ 𝟲𝟬-𝗦𝗲𝗰𝗼𝗻𝗱 𝗕𝗶𝘁𝘀 🔒 𝗗𝗼𝗲𝘀 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗸𝗲𝗲𝗽 𝘆𝗼𝘂𝗿 𝗰𝗹𝗶𝗽𝗯𝗼𝗮𝗿𝗱 𝗵𝗶𝘀𝘁𝗼𝗿𝘆? Yes, it can. ⚠️ A while ago, I saw claims that Windows 𝘀𝘁𝗼𝗿𝗲𝘀 𝗰𝗹𝗶𝗽𝗯𝗼𝗮𝗿𝗱 𝗵𝗶𝘀𝘁𝗼𝗿𝘆 𝗯𝘆 𝗱𝗲𝗳𝗮𝘂𝗹𝘁. That surprised me, so I tested it across several VMs and asked a few friends to check their Windows devices. I 𝗱𝗶𝗱𝗻’𝘁 𝗳𝗶𝗻𝗱 𝗶𝘁 𝗲𝗻𝗮𝗯𝗹𝗲𝗱 𝗯𝘆 𝗱𝗲𝗳𝗮𝘂𝗹𝘁 on any of them […]
MS Intune – Enrollment Restrictions
🔒 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗶𝘁𝘀 💡 𝗪𝗵𝗮𝘁 𝗱𝗲𝘃𝗶𝗰𝗲𝘀 𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗮𝗹𝗹𝗼𝘄𝗲𝗱 𝘁𝗼 𝗲𝗻𝗿𝗼𝗹𝗹 𝗶𝗻𝘁𝗼 𝘆𝗼𝘂𝗿 𝗜𝗻𝘁𝘂𝗻𝗲? In roughly 𝟴 𝗼𝘂𝘁 𝗼𝗳 𝟭𝟬 𝘁𝗲𝗻𝗮𝗻𝘁𝘀 we assess, nobody has changed the default 𝗱𝗲𝘃𝗶𝗰𝗲 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗿𝗲𝘀𝘁𝗿𝗶𝗰𝘁𝗶𝗼𝗻𝘀. By default, Android, iOS/iPadOS, macOS, and Windows can enroll. Depending on the enrollment method, devices may also enroll as 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹𝗹𝘆 𝗼𝘄𝗻𝗲𝗱, even when BYOD […]