Post

"Securing Active Directory" by @brd.bsky.social is the most interesting presentation from the Windows Server Summit so far: techcommunity.microsoft.com/event/window...

The new local admin account policy is a welcome improvement, just like the hardened LDAP signing requirements enabled by default

Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage

There are a few Windows LAPS improvements, particularly to make it easier to communicate temporary passwords and type them without making mistakes. This appears to imply a common pain point with LAPS is that even if you get the password, you must manually type it in somewhere

It's always good to go over a list of common Active Directory security mistakes, like the famous ms-DS-MachineAccountQuota default value which I just keep hearing about but never really understood what it did.

@syfuhs.net what's up with the NTLM deprecation? Is there a presentation from the Windows Server Summit that goes deeper into it?

The phrase I have been using to describe this viciously and fricken hard problem is that it's an onion peeling exercise. Ultimately our plan hasn't changed; it's just taking longer.

Slower or faster than smb1?

You may want to add the RD Gateway to your list of things where IAKerb is probably not going to have the intended effect unless a fix is made in the RDP client code: awakecoding.com/posts/rd-gat...