Post

The new local admin account policy is a welcome improvement, just like the hardened LDAP signing requirements enabled by default

29/4/25, 5:42 pm0 reposts7 likes

Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage

Mary Branscombe

@marypcbuk.bsky.social

so damn many things are still NetBIOS that Steve hasn't managed to burn out yet

I'm happy NetBIOS domain controller detection is getting disabled for a different reason: it makes cross-platform domain controller detection easier to implement in a way that matches the built-in Windows DCLocator behavior

There are a few Windows LAPS improvements, particularly to make it easier to communicate temporary passwords and type them without making mistakes. This appears to imply a common pain point with LAPS is that even if you get the password, you must manually type it in somewhere

It's always good to go over a list of common Active Directory security mistakes, like the famous ms-DS-MachineAccountQuota default value which I just keep hearing about but never really understood what it did.