A compromised ConnectWise app credential got an attacker into hundreds of Microsoft 365 tenants. In a hybrid setup, a few AD settings decide whether a tenant takeover can reach your domain. Here’s how to check them.

Since April 2026, domain controllers don’t fall back to Kerberos RC4 for service accounts with no encryption types set. The July update removed the rollback. Old service accounts and Linux keytabs that leaned on that fallback can now fail. Here’s how to find them and move them to AES.

Plenty of domains still let Kerberos use DES and RC4, years after AES replaced them. Tickets issued with those ciphers are far easier to crack offline. That’s the weakness behind Kerberoasting, the technique that helped turn one phishing click into a 5.6 million record breach at Ascension. Here’s how to find the domain controllers that still allow them and move to AES.

Since the September 2025 updates, domain controllers only accept a certificate logon they can tie to one specific account. A weak certificate mapping, one in altSecurityIdentities that matches on a subject name or email address, doesn’t meet that bar. Here’s how to find the accounts that still depend on one and replace it.

Any user in your domain can ask for a service ticket for any account with a service principal name. Part of that ticket is protected by the service account’s password. If that password is weak, it can be guessed offline, with no failed logons and no lockouts. That’s Kerberoasting. It’s been showing up in real AD attacks for over a decade. Here’s how to find the accounts at risk and take them off the table.

Learn why disabling Kerberos pre-authentication exposes Active Directory accounts to AS-REP roasting, how attackers exploit this weakness, and how to detect and remediate vulnerable accounts.

DES is a decades-old encryption standard still found on some Active Directory accounts. When Kerberos is restricted to DES only, it weakens credential protection and opens the door to offline password cracking, especially on service accounts with excessive privilege.

Some Active Directory accounts are quietly exempt from your domain’s password policy. Here’s what the Password Not Required setting actually does, why it shows up more often than most teams realize, and how to find and remediate it before an attacker does.

When the PasswordNeverExpires flag is set, a stolen credential stays valid forever. Non-expiring passwords are one of the most common findings we see in Active Directory. Here is how attackers find and abuse these accounts, how to identify them in your environment, and how to close the gap for good.