Field Guides

How-tos, real-world troubleshooting, and field notes from identity architecture programs.

Browse by topic

By default you see the latest 10 guides. Select a topic to view the full archive for that tag.

Showing the latest 7 published guides.

Active Directory Delegation Governance Group Policy Hardening Security Filtering

GPO Security Filtering vs Delegation in Active Directory: critical differences for audits and hardening

Practical guide to GPO Security Filtering and Delegation in Active Directory: how to separate targeting from administration to avoid audit, hardening, and governance mistakes.

3 August 2026Read →

Active Directory Domain Controllers Group Policy Hardening Kerberos NTLM Protected Users Security

Protected Users in Active Directory: what it is, limits, adminCount, and rollout without lockout

Protected Users in Active Directory is a hardening control for human admin accounts: learn what it blocks, how adminCount works, and how to roll it out without lockout.

27 July 2026Read →

Active Directory Domain Controllers Encryption Event Viewer Kerberos

Active Directory RC4 remediation: service accounts from RC4 to AES without password reset

Practical Active Directory lab: can a legacy RC4-only service account issue AES Kerberos tickets after a pwdLastSet toggle and msDS-SupportedEncryptionTypes change, without a password reset?

14 July 2026Read →

ACL Active Directory Group Policy Hardening Security

SYSVOL permissions audit in Active Directory: who can really modify your GPOs?

How to assess Active Directory Group Policy security by reviewing SYSVOL NTFS and Share ACLs. Includes a real scenario, audit checklist, PowerShell commands, and operational remediation.

3 July 2026Read →

Active Directory Hardening Kerberos NTLM PowerShell Security SPN

SPN in Active Directory: practical guide with KCD and RBCD

Practical SPN guide for Active Directory: real failure patterns, missing/duplicate SPNs, KCD/RBCD edge cases, key Event IDs, and a remediation path to reduce NTLM fallback.

29 June 2026Read →

Active Directory Event Viewer Hardening Kerberos NTLM Protected Users Security SPN

Why Kerberos-to-NTLM Fallback Is a Problem in Active Directory (and How to Eliminate It for Real)

Kerberos-to-NTLM fallback is not a compatibility detail: it is usually the symptom of a missing SPN, an IP-based connection, a misconfigured service, or a legacy dependency the environment has not surfaced yet. This article shows how to recognize it, why Protected Users makes it visible, and which real-world cases to fix first.

22 June 2026Read →

Active Directory Encryption Entra ID Hardening Kerberos Linux Load Balancer NetApp ONTAP NTLM SPN vSphere

RC4 Deprecation in Active Directory: from Audit Phase to Full Enforcement

From January to July 2026, Microsoft will complete the removal of RC4-HMAC from the Kerberos protocol in Active Directory. Here is what actually happens in production, how to find accounts still tied to the old algorithm, and how to manage the transition without disrupting operations.

15 June 2026Read →