ACTIVE DIRECTORY IS STILL KING! Imagine the absolute pain, and not realizing one is _in_ that pain, of having started a business in the Cloud First/Cloud Native era, so about the last 15 years, and managing a 100 or 1,000, or 10,000 user network in what is essentially a Peer-to-Peer workgroup setup! 8-O Cloud Managed: Deploy 100 new Desktops Cloud Tool: Huh? Oh, you want me to do what? Okay ... Active Directory Managed: Join domain using PowerShell dropping the 100 new desktops into the Deployment OU, go have coffee, come back to 100 user ready systems. Oh, and in the AD scenario the 100 new users were set up in a similar manner. They come out with their AD permissions, Remote permissions, Exchange Server mail permission, SharePoint on-premises permissions, and so much more. And, guess what? Yeah, the user provisioning took a couple of minutes.

JUST IN: Microsoft has reportedly restricted employee use of Claude Fable 5 over concerns that confidential data could be retained by Anthropic.

How dead is Active Directory? According to NAIC census data as of December 2024, there were about 1.5 million businesses in the US with 10 employees. Even with conservative estimates, the amount of businesses that STILL have AD is not insignificant. Active Directory is alive and well and continues to be a major infrastructure component for many, many organizations. That means that Active Directory will continue to be attacked. That also means that learning to defend Active Directory will continue to be important.

DISASTER STRIKES! FIRE! DISASTER RECOVERY HERE WE GO! We had to walk this Disaster Recovery Plan process all the way through to their VMs that are now restoring on our DRaaS system so that they can get up and running by Tuesday AM. The Disaster Recovery Plan _MUST_ be thorough with a concise step-by-step because when the adrenalin is flowing, and folks are at 115% and stressed, the process will be a lot easier. Oh, and the Plan must be practiced on both sides. Us and them! VERY IMPORTANT NOTE: SMOKE AND SOOT VOIDS WARRANTIES! The fire was at the other end of the building but the soot is thick on everything. So far, our server ODM and Dell have both confirmed in writing that their warranties are void for all IT equipment under their brand. Fortunately, there's no water damage or fire damage. The firewall took care of stopping the fire on the other side of the building. And, Veeam is a treat. Plug in their backup drives, import, decrypt, and we're restoring. Easy peasy. That makes a stressful situation that much less stressful. :0) .@Veeam awesome job on the product folks!

35 ways to harden your Active Directory environment 1. MFA everywhere, without exceptions 2. Create a patch cadence you can stick with, and stick to it 3. You don’t need more domain admins, limit it like anyone who has it is cursed 4. You can’t protect what you don’t know exists, inventory is essential 5. Segment your network like your career depends on it 6. If it absolutely doesn’t need to be on the internet, it shouldn’t be 7. EDR alone will not save you, diversify your threat detection strategy 8. Application control can be one of the hardest controls to defeat, use it 9. Deception technology is essential for today’s modern threats, learn it and use it well 10. Email security tools are great, but don’t forget out of band processes are key especially for money transfers 11. Teach users the basics of social engineering red flags, don’t phish them yourself 12. If you don’t test your backups, you don’t have backups 13. If you don’t test your DR plan you don’t have a plan 14. If you don’t follow the 3-2-1 rule for backups you don’t have backups 15. Backups in Steve’s basement don’t count 16. Rotating passwords regularly for no good reason is counter productive and then less secure option 17. 99% of vulnerabilities don’t matter, spend your time identifying the ones that could hurt you and address those first 18. Vulnerability scanning doesn’t show the whole picture, pentesting is a must 19. Hunting for misconfigurations yourself is a necessary part of good systems engineering 20. The cloud is not more or less secure than on-prem, it’s your strategy that matters most 21. Service accounts should be treated like radioactive material, tightly scoped and constantly monitored 22. Under no circumstances should the built in admin account be a service account 23. Domain admins should not be service accounts either 24. Active Directory permissions drift over time, assume yours already has 25. If you can’t explain why something needs admin rights, it shouldn’t 26. If you can’t explain why someone needs admin rights, they shouldn’t 27. Separate admin work from daily work, identity debt is real 28. Don’t reuse local admin passwords, LAPS is easy, use it 29. Security tools don’t replace good engineering, they amplify it 30. If fixing it later is the plan, it’s not a plan 31. Boring but consistent security beats clever hacks every time 32. If you don’t know if you have misconfigured ADCS, you probably do 33. After every change in ADCS, run invoke-locksmith 34. After every delegation change in AD run Invoke-ADeleginator 35. Use AppLocker Inspector to audit your applocker policies. 🏷️Bookmark this so you can come back to it later.

My whole argument regarding AI boils down to this: >>> AI increases output much faster than it increases certainty <<< Yes, it generates more code, more prototypes, more pull requests and more “solutions”. But every generated line still needs ownership, review, testing, debugging and long-term maintenance by humans. And I think the market currently underestimates how expensive that last part really is.

Sysadmin life is both incredibly fulfilling and incredibly challenging all in the same 40 hour window. Sysadmins rule 🤘