EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
Entra ID custom directory roles unused admin roles audit
AzurePrivileged AccessPermissions

Entra ID custom directory roles unused admin roles audit

Audit Entra custom roles, unassigned enabled roles, and admin counts. Verify Graph evidence, reduce permissions, and govern access with PIM reviews.

Maester ScubaGear Entra ID Security Baseline Testing: Guide
AzureConfigIdentity

Maester ScubaGear Entra ID Security Baseline Testing: Guide

Run Maester and ScubaGear baseline tests for Entra ID. Review Graph permissions, failed controls, remediation, reports, and recurring assessment.

entra id group ownership governance: Owners and expiry
AzureGroupsGuest External

entra id group ownership governance: Owners and expiry

Audit guest owners, ownerless groups, Public membership and Microsoft 365 expiration with documented Graph requests and six precise EtcSec checks.

redircmp redirusr default containers group policy: AD guide
ADComputersGPO

redircmp redirusr default containers group policy: AD guide

Audit AD default containers, redirect new accounts with redircmp and redirusr, migrate existing objects, and verify Group Policy scope.

Kerberos Ticket Lifetime After Account Disablement: Containment
ADKerberosConfig

Kerberos Ticket Lifetime After Account Disablement: Containment

Disabling an AD account does not end every Kerberos session. Measure ticket lifetimes, correlate Windows events and verify containment at each resource.

Sensitive terms in Active Directory description: review DA, admin, and privileged
ADAccountsPrivileged Access

Sensitive terms in Active Directory description: review DA, admin, and privileged

Audit sensitive terms in Active Directory description fields, distinguish role clues from secrets, and clean labels with verified detection limits.

LM Hash Storage Disabled Active Directory: Verify NoLMHash and Password Renewal
ADPasswordConfig

LM Hash Storage Disabled Active Directory: Verify NoLMHash and Password Renewal

Verify LM storage suppression and password renewal in Active Directory. Learn what NoLMHash controls and what EtcSec's network-policy checks actually measure.

Active Directory Forest Recovery Backup Validation: Trust the Restore
ADConfigMonitoring

Active Directory Forest Recovery Backup Validation: Trust the Restore

Validate an AD forest recovery with a trusted backup, rehearsed runbook and recorded checks. Understand backup age, krbtgt resets and Recycle Bin limits.

Cleanup Stale AdminCount Active Directory: A Safe Workflow
ADAccountsPermissions

Cleanup Stale AdminCount Active Directory: A Safe Workflow

Verify protected membership, clear confirmed stale adminCount flags, restore inheritance, and validate each account after SDProp.

Kerberos Token Bloat MaxTokenSize: Fix Group Sprawl Safely
ADKerberosGroups

Kerberos Token Bloat MaxTokenSize: Fix Group Sprawl Safely

Diagnose Kerberos context limits, review circular nesting, and repair group sprawl while preserving approved permissions and required access restrictions.

GPO Security Filtering MS16-072: Restore Read, Preserve Scope
ADGPOConfig

GPO Security Filtering MS16-072: Restore Read, Preserve Scope

Fix GPO security filtering after MS16-072 with computer Read permissions. Preserve targeted Apply and review orphaned, disabled, and delegated policies.

Credential Guard Disabled After Upgrade: Verify and Remediate
ADConfigComputers

Credential Guard Disabled After Upgrade: Verify and Remediate

Check why Credential Guard stays disabled after a Windows upgrade, verify its running state, and replace inherited exceptions safely.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page