Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles

ADComputersGPO

AD workstation server OU review: verify policy impact before a move

Review workstation placement in server-named OUs, verify the real device role, and preserve computer policy results before and after an approved pilot move.

October 4, 2026

ADComputersPermissions

AD computer adminCount triage: protected DCs versus member hosts

Classify computer adminCount findings by role, protected membership and ACL evidence before approving any marker or inheritance maintenance.

October 4, 2026

ADAdvancedMonitoring

AD object creation whenCreated review: approved provisioning

Review AD creations with whenCreated, a deduplicated object register, approved provisioning and Event 5137 evidence whose audit coverage is verified.

October 4, 2026

ADMonitoringCompliance

DC Security Log Retention Review: Verify Readable History

Verify readable Security history on every domain controller, check archives and central copies, and test recovery against an approved retention policy.

October 4, 2026

ADGPOConfig

AD GPO metadata review: verify WMI filters against a scoped report

Reconcile GPO inventory with scoped reports. Verify WMI metadata, links, delegation, and AD/SYSVOL versions while keeping collection gaps explicit.

October 4, 2026

ADConfigPermissions

AD OU direct child census: verify counts before restructuring

Verify AD OU contents with a scoped OneLevel census, reconcile collector limits, and retain owner approval before restructuring.

October 4, 2026

ADComputersConfig

Server Core DC Verification: Identify Each Installation Option

Verify each domain controller's installation option with host evidence, preserve read failures, and review required tools before planning a Server Core rebuild.

October 4, 2026

ADComputers

AD domain controller inventory: reconcile FSMO metadata

Reconcile DC identities and FSMO holders with independent directory reads. Qualify empty metadata and keep replication health checks separate.

October 4, 2026

ADAccountsPrivileged Access

AD logonCount per DC review: qualify totals before account retirement

Review AD logonCount by DC, preserve unknown readings, and verify current access and ownership before retiring an administrative account.

October 4, 2026

ADComplianceMonitoring

AD compliance score scope: Reconcile five deductions

Reconcile five AD score deductions with domain-policy and adminCount evidence. Learn why a score of 100 cannot establish overall compliance.

October 4, 2026

ADAccountsPassword

gMSA first deployment pilot: prove KDS readiness before service cutover

Verify KDS readiness, authorized hosts, and service behavior before your first gMSA cutover. Use a scoped pilot with tested rollback and adoption evidence.

October 4, 2026

ADGPOComputers

Windows Update scan sources: verify each update class before closing a WSUS gap

Verify Windows Update scan sources by update class and client population. Reconcile applied policies, successful scans, and separate patch installation evidence.

October 4, 2026

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page

Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page

PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page

Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page

ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page