Insight Recon blog
Write-ups on the AD problems we keep finding, with the PowerShell to check your own domain and the steps to fix it.
By Heath Adams and Brad Thornton at Breach Point
Run a free scan to check your whole domain at once.
Researchers showed domain controllers with LDAP signing enforced could still be relayed into. Microsoft patched it in the October 2026 updates. Until your DCs are on that update, enforced signing isn’t protecting them the way you think.
When DNS can’t find a name, Windows asks everyone on the local network instead. Anyone can answer. Whoever does gets a login hash from the machine that asked. Here’s how to turn LLMNR and NBT-NS off without breaking things.
A compromised ConnectWise app credential got an attacker into hundreds of Microsoft 365 tenants. In a hybrid setup, a few AD settings decide whether a tenant takeover can reach your domain. Here’s how to check them.
SMB signing is now required out of the box on business editions of Windows 11 24H2. Most domains still have machines that don’t require it, sometimes even a domain controller. Here’s how to find them and fix it without breaking every copier and NAS.
Since April 2026, domain controllers don’t fall back to Kerberos RC4 for service accounts with no encryption types set. The July update removed the rollback. Old service accounts and Linux keytabs that leaned on that fallback can now fail. Here’s how to find them and move them to AES.
Since the October 2026 update, Windows 11 24H2 and later and Windows Server 2025 block NTLMv1 SSO by default. On devices without Credential Guard, PEAP-MSCHAPv2 Wi-Fi, wired 802.1X and VPN connections that sign in with the user’s Windows logon now prompt or fail. Here’s how to tell if it’s hitting you and fix it properly.
If every machine in your domain shares the same local admin password, one compromised laptop hands an attacker admin on all of them. Windows LAPS fixes that. It’s been built into Windows since April 2023. Here’s how to roll it out without locking out your helpdesk and get legacy LAPS off your machines.
Plenty of domains still let Kerberos use DES and RC4, years after AES replaced them. Tickets issued with those ciphers are far easier to crack offline. That’s the weakness behind Kerberoasting, the technique that helped turn one phishing click into a 5.6 million record breach at Ascension. Here’s how to find the domain controllers that still allow them and move to AES.
Since the September 2025 updates, domain controllers only accept a certificate logon they can tie to one specific account. A weak certificate mapping, one in altSecurityIdentities that matches on a subject name or email address, doesn’t meet that bar. Here’s how to find the accounts that still depend on one and replace it.
For most of Active Directory’s history, domain controllers have accepted unsigned LDAP binds by default. Windows Server 2025 finally requires LDAP signing on new deployments. Older DCs and upgraded ones still need you to turn it on. Here’s how to find the apps that will break before you flip the switch.
