EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
App control policy verification: WDAC beyond a GPO marker
ADGPOComputers

App control policy verification: WDAC beyond a GPO marker

Verify App Control policy identity, format and audit events on Windows targets before enforcement, with recovery beyond a GPO deployment marker.

BitLocker AD Recovery Verification: Policy, Volume State and Escrow
ADGPOComputers

BitLocker AD Recovery Verification: Policy, Volume State and Escrow

Verify BitLocker policy, volume protection and current recovery escrow separately. Match AD DS records to active protectors before testing recovery.

AD schema security descriptor metadata: qualify a recent change
ADMonitoringPermissions

AD schema security descriptor metadata: qualify a recent change

Qualify a recent AD schema descriptor change: verify the naming context, replication metadata, approved permissions and change records before escalation.

Configuration Manager trust boundaries: map authority to targets
ADPrivileged AccessComputers

Configuration Manager trust boundaries: map authority to targets

Map Configuration Manager administrators, site accounts, and target systems to verify trust boundaries beyond an Active Directory OU name.

AD validated DNS hostname rights: review the ACE before changing delegation
ADPermissionsComputers

AD validated DNS hostname rights: review the ACE before changing delegation

Review AD validated DNS hostname rights by checking the ACE, collection coverage and legitimate provisioning needs before changing delegation.

Restricted Groups Local Administrators: Verify Members Before Rollout
ADGPOPrivileged Access

Restricted Groups Local Administrators: Verify Members Before Rollout

Verify Restricted Groups Members, effective GPO scope and local administrator membership before rollout. Preserve recovery access and validate a pilot.

AD badPwdCount triage: qualify counters before an attack verdict
ADPasswordMonitoring

AD badPwdCount triage: qualify counters before an attack verdict

Qualify AD badPwdCount snapshots by DC, collection quality and authentication logs before deciding whether failures indicate user error or suspicious activity.

AD logon script paths: review scriptPath targets before changing ACLs
ADAccountsConfig

AD logon script paths: review scriptPath targets before changing ACLs

Inventory AD logon script paths, resolve their targets, and review share and NTFS permissions before making a targeted, owner-approved change.

AD foreign security principals: classify SIDs before cleanup
ADIdentityGroups

AD foreign security principals: classify SIDs before cleanup

Classify FSP SIDs, inspect consuming groups and verify trust context before removing any Active Directory placeholder or membership.

SYSVOL FRS to DFSR Migration: Confirm Every DC Before Eliminated
ADNetworkConfig

SYSVOL FRS to DFSR Migration: Confirm Every DC Before Eliminated

Plan SYSVOL FRS to DFSR migration with evidence from every DC. Verify convergence and replication before the irreversible Eliminated state.

AD OU accidental deletion protection: verify safeguards before cleanup
ADConfigPermissions

AD OU accidental deletion protection: verify safeguards before cleanup

Review AD OU accidental deletion protection before cleanup: inventory existing OUs, verify Deny permissions, and manage approved exceptions.

AD Account Expiration Review: Decide Before Extending Users
ADAccounts

AD Account Expiration Review: Decide Before Extending Users

Review AD account expiration dates, confirm owners and dependencies, and record authorized end dates before extending users.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page