It is… Is Microsoft Active Directory Still Risky to Your Enterprise?

The talk opens with a LinkedIn poll the speaker ran last year, where only 18 percent of respondents felt confident they could secure their Active Directory. He frames the directory as the most common target in intrusions. Attackers typically phish a user, escalate to local admin on a workstation, harvest credentials and work toward domain privileges. He argues that prevention matters more than detection and recovery, since attackers who gain domain control can easily plant persistence that survives restores.

The core of the talk is a set of AD configuration checks that can be verified with built-in tools and PowerShell. Privileged groups should be inventoried across default, application and service categories and audited recursively. A leftover primary group ID of 512 can quietly grant Domain Admin rights, and a demo showed that a standard user can query for such accounts. Other items include SID History leftovers, unexpected entries in AdminSDHolder that propagate to protected groups, unconstrained and constrained Kerberos delegation, service accounts with SPNs exposed to Kerberoasting, and Replicate Directory Changes rights on the domain root that enable DCSync.

The speaker stressed resetting the KRBTGT password twice in succession on a regular schedule, and recommended dumping ACLs with dsacls and monitoring privileged groups with a dedicated tool. He closed with a combined PowerShell audit bundle and noted that Azure AD has its own misconfiguration issues.