Post

The new local admin account policy is a welcome improvement, just like the hardened LDAP signing requirements enabled by default

Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage

so damn many things are still NetBIOS that Steve hasn't managed to burn out yet

There are a few Windows LAPS improvements, particularly to make it easier to communicate temporary passwords and type them without making mistakes. This appears to imply a common pain point with LAPS is that even if you get the password, you must manually type it in somewhere