EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
Windows Attachment Manager risk: verify user policies before changing prompts
ADGPOConfig

Windows Attachment Manager risk: verify user policies before changing prompts

Review Attachment Manager user policies, distinguish missing configuration from explicit weakening, and verify prompts in a controlled application pilot.

AD sites subnets: verify DC selection before changing topology
ADNetwork

AD sites subnets: verify DC selection before changing topology

Verify AD sites subnets against network inventory and client DC selection. Separate missing mappings, intentional remote service, and LDAP collection gaps.

Entra privacy statement: configure a usable tenant URL
AzureConfigIdentity

Entra privacy statement: configure a usable tenant URL

Configure an Entra privacy statement URL and contact. Verify Graph collection, document access, and the guest invitation journey without assuming acceptance.

Windows Firewall Outbound Rules: Design a Scoped Default-Block Pilot
ADGPOConfig

Windows Firewall Outbound Rules: Design a Scoped Default-Block Pilot

Plan a scoped default-block pilot with documented allow rules, target-side policy checks, dependency tests, and a verified rollback path.

HVCI memory integrity: verify drivers, runtime state and UEFI lock
ADComputersGPO

HVCI memory integrity: verify drivers, runtime state and UEFI lock

Verify HVCI memory integrity on target devices, test driver compatibility, and choose UEFI lock with a documented recovery plan.

Entra terms of use: require acceptance through Conditional Access
AzureConditional AccessIdentity

Entra terms of use: require acceptance through Conditional Access

Require Entra terms of use through a scoped Conditional Access policy. Verify agreements, PDF versions, acceptance records, and session-dependent reacceptance.

Defender ASR Rules via GPO: Verify Endpoint Configuration
ADGPOConfig

Defender ASR Rules via GPO: Verify Endpoint Configuration

Verify Defender ASR rules via GPO against endpoint GUIDs, modes and exclusions, then use ASR events to guide a tested rollout.

Entra entitlement management access packages: start with a governed pilot
AzureIdentityPermissions

Entra entitlement management access packages: start with a governed pilot

Build a governed access package pilot with scoped resources, approval, and expiration. Distinguish missing packages from incomplete audit collection.

AD user cannot change password: audit Deny ACEs
ADPasswordPermissions

AD user cannot change password: audit Deny ACEs

Audit Change Password Deny ACEs before changing AD policy. Inspect the user DACL independently and restore self-change only for approved accounts.

Pre-Windows 2000 Compatible Access Group Active Directory
ADGroupsPermissions

Pre-Windows 2000 Compatible Access Group Active Directory

Audit Pre-Windows 2000 Compatible Access membership, read ACEs, separate NetAPI from LDAP, and remove unnecessary access with dependency tests.

Smart card required password rotation Active Directory
ADPasswordAccounts

Smart card required password rotation Active Directory

Smart card accounts retain a network secret. Check domain rolling, interpret password age, and pilot safe rotation in Active Directory.

Common password pattern account naming Active Directory
ADPasswordAccounts

Common password pattern account naming Active Directory

Generic AD account names help select review candidates. Learn what the naming detector measures, how to investigate failures, and how to remediate exposure.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page