EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
SMBv1 dependency evidence: attempts, dialects and scope
ADNetworkComputers

SMBv1 dependency evidence: attempts, dialects and scope

Verify SMBv1 dependency evidence with server attempts, client dialect snapshots and scoped workflow checks before removing legacy support.

AD attribute change approval: pair 5136 values
ADMonitoringCompliance

AD attribute change approval: pair 5136 values

Reconstruct an existing AD object's attribute change with 5136 values, provenance and independent approval evidence before closing the review.

RDP secure RPC verification: confirm the policy source
ADGPO

RDP secure RPC verification: confirm the policy source

Verify RDS administrative RPC policy and native RDP encryption sources on the same host. Separate collected GPO settings from observed connection protection.

Windows file access audit proof: SACLs and 4656/4663
ADMonitoring

Windows file access audit proof: SACLs and 4656/4663

Verify effective File System auditing, SACLs and dummy-file access tests. Separate 4656 handle requests from 4663 rights used before remediation.

Cached domain logon verification: REG_SZ and offline sign-in
ADComputersGPO

Cached domain logon verification: REG_SZ and offline sign-in

Verify cached domain logons by reconciling applied GPOs, local REG_SZ and a pilot offline sign-in. Document eviction context before changing policy.

AppLocker effective policy: test the intended user's rules
ADGPO

AppLocker effective policy: test the intended user's rules

Verify AppLocker effective policy for the intended user. Export GP rules, review collection modes and plan controlled execution tests before enforcement.

Service account PSO coverage: verify every account
ADPassword

Service account PSO coverage: verify every account

Verify every service account's resultant PSO, domain default, and exceptions. Build coverage evidence that a binary detector result cannot provide.

AD Shared Account Attribution: Qualify the Logon Evidence
ADAccounts

AD Shared Account Attribution: Qualify the Logon Evidence

Qualify shared-account logons with 4624 and 4648 evidence, separate account use from human attribution, and review dependencies before retirement.

AD confidential attributes: verify read access
ADCompliance

AD confidential attributes: verify read access

Verify AD confidential attributes with an approved inventory, effective read rights and dummy-value lab tests before proposing a schema change.

AD sensitive privilege use auditing: Failure plus Success
ADMonitoringConfig

AD sensitive privilege use auditing: Failure plus Success

Verify Sensitive Privilege Use on each AD host, check Failure plus Success, and confirm 4673/4674 reach your collector with the fields needed for review.

AD Disabled Computer WhenChanged Review: Establish Disable Provenance
ADComputersMonitoring

AD Disabled Computer WhenChanged Review: Establish Disable Provenance

Review disabled AD computer accounts without mistaking whenChanged for a disable date. Verify current state, event evidence and dependencies before removal.

AD empty privileged group review: verify membership before closure
ADGroups

AD empty privileged group review: verify membership before closure

Verify empty privileged AD groups before closing an Info: reconcile group identity, membership reads and the owner's intended configuration.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page