Insight Recon blog
Write-ups on the AD problems we keep finding, with the PowerShell to check your own domain and the steps to fix it.
By Heath Adams and Brad Thornton at Breach Point
Run a free scan to check your whole domain at once.
When you connect AD to Entra ID, the setup creates a small set of objects inside your domain and hands them real power: the directory synchronization accounts, the Seamless SSO computer account, and, if you use cloud Kerberos trust, a dedicated trust object. They are privileged by design, they make good targets, and in most environments no one is keeping an eye on them.
A compromised account with standing schema admin rights gives an attacker a path to alter the forest’s structure itself, changes that are irreversible and can break replication forest wide. Here is how attackers abuse a populated Schema Admins group, how to find these accounts, and how to close the gap for good.
When the PasswordNeverExpires flag is set, a stolen credential stays valid forever. Non-expiring passwords are one of the most common findings we see in Active Directory. Here is how attackers find and abuse these accounts, how to identify them in your environment, and how to close the gap for good.
Active Directory Security Privileged Access Moderate 9 min read Who Owns Your Domain Controllers? The Ownership Gap Attackers Love. In
