Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

123 articles

ADKerberosAttack Paths

AS-REP Roasting: Harvesting Hashes Without Credentials

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled, allowing attackers to collect crackable hashes with zero credentials. Learn how to detect and fix it.

March 31, 2026

ADKerberosAttack Paths

Kerberoasting Detection Prevention Guide: How to Find and Protect Crackable Service Accounts

A technical guide to Kerberoasting detection and prevention in Active Directory, covering SPN exposure, TGS telemetry, RC4 reduction, service account hardening, and validation.

March 31, 2026

ADKerberosAttack Paths

Golden Ticket Attack: The Keys to Your Kingdom

A Golden Ticket is a forged Kerberos TGT that grants unlimited, persistent access to every resource in an Active Directory domain. Learn how it works, how to detect it, and how to shut it down.

March 30, 2026

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page

Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page

PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page

Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page

ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page