EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

206 articles
Block Outbound NTLM: Tier 0 Domain Controller Coercion-Relay Attacks, Stopped at the GPO Layer
ADGPONetwork

Block Outbound NTLM: Tier 0 Domain Controller Coercion-Relay Attacks, Stopped at the GPO Layer

PetitPotam and its relatives all need one thing: a domain controller sending outbound NTLM. One GPO setting denies it, closing the entire coercion-and-relay attack class.

Entra ID Risk Policy Retirement October 2026: Conditional Access Migration Has No Auto-Path
AzureConditional AccessRisk Protection

Entra ID Risk Policy Retirement October 2026: Conditional Access Migration Has No Auto-Path

Legacy sign-in risk and user risk policies in Entra ID Protection retire October 1, 2026, and Microsoft's own migration guidance is entirely manual — nothing carries over to Conditional Access automatically.

Entra ID Disabled Account, Still Signed In, Revoke Sessions: The Leaver Process Gap
AzureIdentityMonitoring

Entra ID Disabled Account, Still Signed In, Revoke Sessions: The Leaver Process Gap

Disabling an Entra ID account does not end an active session. Here is the hybrid-sync, token, and CAE gap behind it, and how to close it.

Active Directory Authentication Policies, Silos, Tier 0: The Kerberos Control Almost Nobody Deploys
ADKerberosPrivileged Access

Active Directory Authentication Policies, Silos, Tier 0: The Kerberos Control Almost Nobody Deploys

Authentication policies and silos cap Kerberos TGT lifetime and pin Tier 0 accounts to approved devices — a 2012 R2 feature most domains never enabled.

PrimaryGroupID Spoofing: Hidden Domain Admins Active Directory Audits Miss
ADAccountsPermissions

PrimaryGroupID Spoofing: Hidden Domain Admins Active Directory Audits Miss

Setting primaryGroupID to 512 makes an account a full Domain Admin without touching the group's member attribute — invisible to most audit exports.

Failed Sign-In Burst Detection Entra ID: Why Identity Protection Won't Catch It
AzureRisk ProtectionIdentity

Failed Sign-In Burst Detection Entra ID: Why Identity Protection Won't Catch It

A burst of failed sign-ins against one account often triggers nothing in Entra ID Identity Protection. Here's why, plus the KQL query and Smart Lockout tuning that close the gap.

CVE-2026-69836 Entra ID Vulnerability: The CVSS 10.0 RCE With Nothing to Patch and Everything to Hunt
AzureIdentityRisk Protection

CVE-2026-69836 Entra ID Vulnerability: The CVSS 10.0 RCE With Nothing to Patch and Everything to Hunt

CVE-2026-69836 is a CVSS 10.0 unauthenticated RCE in Entra ID, already fixed by Microsoft. Here's what happened, and what defenders should still check.

Weak ACL GPO, Tier 0 OU, Active Directory: The Pivot That Undoes the Tier Model You Just Built
ADGPOCompliance

Weak ACL GPO, Tier 0 OU, Active Directory: The Pivot That Undoes the Tier Model You Just Built

Your Tier 0 OU blocks inheritance, but the GPOs linked to it are a second, independent ACL boundary that is rarely audited once the tier model ships.

NetSessionEnum, Remote SAM Hardening, BloodHound Reconnaissance, Active Directory: Blinding the Attack Graph
ADNetworkGPO

NetSessionEnum, Remote SAM Hardening, BloodHound Reconnaissance, Active Directory: Blinding the Attack Graph

Remote SAM stays open to Everyone on every domain controller, and stale SrvsvcSessionInfo ACLs survive in-place upgrades — the defaults behind BloodHound's HasSession and AdminTo edges.

RDP Network Level Authentication, Restricted Admin Mode, Active Directory: The Three Settings That Decide Who Owns Your Session
ADNetworkGPO

RDP Network Level Authentication, Restricted Admin Mode, Active Directory: The Three Settings That Decide Who Owns Your Session

NLA, the RDP security layer, and Restricted Admin mode are three separate controls that are usually audited as one. One of them protects your credentials on the remote host while handing attackers a pass-the-hash primitive into it.

Entra ID Guest Conditional Access Policy External Collaboration Settings — the Six Defaults That Work Against You
AzureGuest ExternalConditional Access

Entra ID Guest Conditional Access Policy External Collaboration Settings — the Six Defaults That Work Against You

Entra ID guest conditional access policy external collaboration settings default to permissive: guests can invite guests, browse the directory, and never expire. Six sourced gaps, with detection and fixes.

PrintNightmare, Point-and-Print, GPO Hardening, Active Directory: The Two-Value Fix Nobody Finished
ADGPOCompliance

PrintNightmare, Point-and-Print, GPO Hardening, Active Directory: The Two-Value Fix Nobody Finished

Stopping the spooler on your DCs removed one privileged target and left the driver-installation path open on every workstation. PrintNightmare is a two-value fix — here is the half most fleets never finished.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page