When DNS can’t find a name, Windows asks everyone on the local network instead. Anyone can answer. Whoever does gets a login hash from the machine that asked. Here’s how to turn LLMNR and NBT-NS off without breaking things.

SMB signing is now required out of the box on business editions of Windows 11 24H2. Most domains still have machines that don’t require it, sometimes even a domain controller. Here’s how to find them and fix it without breaking every copier and NAS.

For most of Active Directory’s history, domain controllers have accepted unsigned LDAP binds by default. Windows Server 2025 finally requires LDAP signing on new deployments. Older DCs and upgraded ones still need you to turn it on. Here’s how to find the apps that will break before you flip the switch.

LDAP channel binding helps prevent NTLM authentication relay attacks against LDAPS by tying authentication to the TLS session. Learn how to detect disabled channel binding, audit incompatible clients, and safely enforce it across Active Directory domain controllers.

SMBv1 lacks the signing and integrity protections built into SMBv2 and SMBv3, and it often stays enabled on domain controllers by accident. Here’s how to find it, confirm what depends on it, and turn it off without breaking anything.

The Active Directory Recycle Bin makes it easier to recover deleted users, groups, computers, and OUs while preserving important attributes and relationships. Learn why it matters, how to check whether it is enabled, and how to close this common Active Directory recovery gap.