EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
Active Directory GPO Security Settings: Four Checks
ADGPOConfig

Active Directory GPO Security Settings: Four Checks

Review four GPO controls for LLMNR, WSUS, LSASS, and UNC paths. Verify client state and remediate each exposure without overstating audit findings.

Entra ID Password Protection: Custom Lists and the Expiration Trap
AzureADIdentityPassword

Entra ID Password Protection: Custom Lists and the Expiration Trap

Review Entra ID Password Protection, custom banned terms, AD DS Audit versus Enforced mode, and the cloud password expiration trap.

LAPS Deployed Broken Coverage Gaps: Audit and Remediation
ADComputersPassword

LAPS Deployed Broken Coverage Gaps: Audit and Remediation

Audit deployed LAPS for coverage gaps, legacy attributes, excessive password readers, and exposure. Verify rotation and repair each failure separately.

AD Password Policy Compliance: Why ANSSI and CIS Checks Differ
ADPasswordCompliance

AD Password Policy Compliance: Why ANSSI and CIS Checks Differ

Compare ANSSI and CIS password-policy checks attribute by attribute, verify the AD domain policy, and remediate against a clearly identified baseline.

Computer Object ACL Abuse Active Directory: DACL Review Guide
ADComputersPermissions

Computer Object ACL Abuse Active Directory: DACL Review Guide

Review computer object ACL abuse Active Directory risks: GenericAll, DACL and owner changes, RBCD, shadow credentials, detection and remediation.

CVE-2026-69524 CVE-2026-69546 Active Directory RCE: Patch Checks
ADIdentityComputers

CVE-2026-69524 CVE-2026-69546 Active Directory RCE: Patch Checks

Review two September AD DS race-condition RCEs: verified update mappings, domain-controller patch checks, and practical investigation limits.

CVE-2026-69676 Kerberos Remote Code Execution: Patch and Detect
ADKerberosMonitoring

CVE-2026-69676 Kerberos Remote Code Execution: Patch and Detect

CVE-2026-69676 permits Kerberos RCE from low-level authenticated access. Verify the correct Windows update and collect useful investigation evidence.

CVE-2026-72982 Netlogon Remote Code Execution: Verify the Fix
ADComputersNetwork

CVE-2026-72982 Netlogon Remote Code Execution: Verify the Fix

Check CVE-2026-72982 Netlogon remote code execution fixes by Windows Server version, verify DC patch status, and understand detection limits.

How to Configure and Secure Active Directory Trusts
ADTrustsConfig

How to Configure and Secure Active Directory Trusts

A step-by-step guide to configuring and hardening Active Directory trusts: types, transitivity, SID filtering, selective authentication, and lifecycle hygiene.

Entra ID Authentication Bypass CVE-2026-62916: What a Cloud CVE Means for Your Tenant
AzureIdentityConditional Access

Entra ID Authentication Bypass CVE-2026-62916: What a Cloud CVE Means for Your Tenant

CVE-2026-62916 is a Critical Entra ID authentication bypass Microsoft already fixed service-side. What the CVRF advisory confirms, and what to verify anyway.

Entra ID Redirect URI Hijacking: Wildcard Reply URLs and the Implicit Flow
AzureApplications

Entra ID Redirect URI Hijacking: Wildcard Reply URLs and the Implicit Flow

Wildcard reply URLs, HTTP redirect URIs, and the implicit grant flow combine to let attackers steal live Entra ID tokens from app registrations.

MFA Not Enforced All Users Conditional Access Entra: The Critical Gap Admin-Only Policies Miss
AzureConditional AccessIdentity

MFA Not Enforced All Users Conditional Access Entra: The Critical Gap Admin-Only Policies Miss

MFA required for admins is not MFA required for everyone. See how the all-users Conditional Access MFA gap hides behind admin-only policies, how to detect it, and how to close it.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page