Since the October 2026 update, Windows 11 24H2 and later and Windows Server 2025 block NTLMv1 SSO by default. On devices without Credential Guard, PEAP-MSCHAPv2 Wi-Fi, wired 802.1X and VPN connections that sign in with the user’s Windows logon now prompt or fail. Here’s how to tell if it’s hitting you and fix it properly.

If every machine in your domain shares the same local admin password, one compromised laptop hands an attacker admin on all of them. Windows LAPS fixes that. It’s been built into Windows since April 2023. Here’s how to roll it out without locking out your helpdesk and get legacy LAPS off your machines.

The DnsAdmins group can provide far more privilege than its name suggests. When DNS runs on a domain controller, unnecessary membership can create a path from delegated DNS administration to SYSTEM-level access and domain compromise.

Operator groups were built to delegate admin tasks without full Domain Admin rights, but leftover membership can quietly hand attackers a shortcut to privilege escalation. Here’s how to find populated operator groups and clean them up for good.

Risky AdminSDHolder permissions can create persistent privileged access across protected Active Directory accounts and groups. Learn how attackers abuse AdminSDHolder and SDProp, how to detect dangerous ACL entries, and how to safely remediate them.

A compromised account with standing schema admin rights gives an attacker a path to alter the forest’s structure itself, changes that are irreversible and can break replication forest wide. Here is how attackers abuse a populated Schema Admins group, how to find these accounts, and how to close the gap for good.

Active Directory Security Privileged Access Moderate 9 min read Who Owns Your Domain Controllers? The Ownership Gap Attackers Love. In Active Directory, the owner of an object can rewrite its permissions at will. When Domain Controller ownership drifts to a service account or an individual user, it opens a privilege escalation path that standard permission […]