RC4 Deprecation in Active Directory: Timeline and Phases
Microsoft's 2026 rollout for RC4 in Kerberos: phase dates, the AES default for unspecified accounts, legacy services to verify, and an operational migration path that avoids outages.
Field Guides
Field Guides
Field Guides
How-tos, real-world troubleshooting, and field notes from identity architecture programs.
Browse by topic
Filter all guides by topic.
12 published guides
Kerberos / NTLM
7Active DirectoryDomain ControllersGolden TicketHardeningIncident ResponseKerberosMicrosoft SentinelRODCZabbix
KRBTGT rotation in Active Directory: operational runbook without outages
A runbook for safely rotating the KRBTGT password: prerequisites, replication, double reset, Kerberos validation, operational rollback, and telemetry.
NTLM Audit in Active Directory: From Audit to Enforcement
An operational path to measure real NTLM usage, separate legitimate dependencies from misconfigured Kerberos fallbacks, and reach progressive blocking with rollback criteria.
Protected Users in Active Directory: what it is, limits, adminCount, and rollout without lockout
Protected Users in Active Directory is a hardening control for human admin accounts: learn what it blocks, how adminCount works, and how to roll it out without lockout.
Active Directory RC4 remediation: service accounts from RC4 to AES without password reset
Practical Active Directory lab: can a legacy RC4-only service account issue AES Kerberos tickets after a pwdLastSet toggle and msDS-SupportedEncryptionTypes change, without a password reset?
SPN in Active Directory: What It Is, How to Check and Register It
Practical SPN guide for Active Directory: real failure patterns, missing/duplicate SPNs, KCD/RBCD edge cases, key Event IDs, and a remediation path to reduce NTLM fallback.
Why Kerberos-to-NTLM Fallback Is a Problem in Active Directory (and How to Eliminate It for Real)
Kerberos-to-NTLM fallback is not a compatibility detail: it is usually the symptom of a missing SPN, an IP-based connection, a misconfigured service, or a legacy dependency the environment has not surfaced yet. This article shows how to recognize it, why Protected Users makes it visible, and which real-world cases to fix first.
GPO / SYSVOL
4GPO Enforced: What It Means and How It Differs from Block Inheritance
Operational guide on GPO Enforced and Block Inheritance in Active Directory: how they really work, what mistakes they create in production, and how to manage exceptions, rollback, and governance without triggering policy drift.
SYSVOL Permissions in Active Directory: Baseline and Drift
Expected NTFS and Share permissions on SYSVOL and NETLOGON, difference between nominal and effective permissions, common drift patterns in enterprise environments, and PowerShell commands for verification and remediation without impacting DFSR replication.
GPO Security Filtering vs Delegation: What's the Difference?
Practical guide to GPO Security Filtering and Delegation in Active Directory: how to separate targeting from administration to avoid audit, hardening, and governance mistakes.
How to Audit GPO and SYSVOL Permissions in Active Directory
How to assess Active Directory Group Policy security by reviewing SYSVOL NTFS and Share ACLs. Includes a real scenario, audit checklist, PowerShell commands, and operational remediation.
Hardening
1How to Prioritize Active Directory Hardening Findings: A Decision Framework
If this were my company, I would not start with the loudest finding: I would start with real exposure, blast radius, dependencies, and clear proof that risk decreased.