on Active Directory, Security, PowerShell

Knowing What Breaks Before You Turn Off RC4

Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.…

on PowerShell, Active Directory, Security, DevOps

From Plain Text Passwords to PowerShell SecretStore: Securing Your AD Test Environment

My AD test environment module still had service account passwords sitting in plain text. This adds PowerShell SecretStore for setup, storage and retrieval, without making the lab harder to spin up.…

on PowerShell, Active Directory, Windows, DevOps

Active Directory Test Data That Doesn't Suck

A PowerShell module that fills a lab domain with a thousand-plus realistic users, groups and OUs in about a minute, and tears them back down cleanly when you are done.…

on Active Directory, PowerShell, Security, Windows

Understanding Orphaned SIDs in Active Directory

Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.…

on Active Directory, Security

Modernizing Your Active Directory: A PowerShell Solution for Kerberos Encryption Migration

Kerberoasting depends on RC4 still being available. How to inventory encryption types across the domain and automate the move to AES without locking anyone out.…