Post

The new local admin account policy is a welcome improvement, just like the hardened LDAP signing requirements enabled by default

Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage

There are a few Windows LAPS improvements, particularly to make it easier to communicate temporary passwords and type them without making mistakes. This appears to imply a common pain point with LAPS is that even if you get the password, you must manually type it in somewhere

29/4/25, 5:46 pm1 repost6 likes

It's always good to go over a list of common Active Directory security mistakes, like the famous ms-DS-MachineAccountQuota default value which I just keep hearing about but never really understood what it did.

About NTLM deprecation, there's nothing new that hadn't been announced previously. I don't know if it'll be discussed in another presentation as it's unclear when and how we'll see the IAKerb and local KDC extensions released

@syfuhs.net what's up with the NTLM deprecation? Is there a presentation from the Windows Server Summit that goes deeper into it?

Steve Syfuhs

@syfuhs.net

The phrase I have been using to describe this viciously and fricken hard problem is that it's an onion peeling exercise. Ultimately our plan hasn't changed; it's just taking longer.