AD Domain ServicesArchitecture & Design

Federation strategies using Entra

December 19, 2025
Federation is still a critical tool in hybrid identity—but the “best” federation strategy depends on what you’re trying to achieve: modern SSO for SaaS, partner access, legacy app support, or a phased retirement of AD FS. This guide explains practical federation patterns using Microsoft Entra ID, how to choose between them, and how to implement them safely. …
Read more
AD Domain ServicesArchitecture & Design

Zero Trust architecture with Entra at the core

December 19, 2025
Zero Trust Architecture with Microsoft Entra at the Core Zero Trust is not a product you “turn on.” It’s an operating model for security where every access request is treated as hostile until proven otherwise. The big shift is psychological and architectural: you stop trusting network location (VPN, office LAN, “inside”) and you start trusting verified identity +…
Read more
AD Domain ServicesArchitecture & Design

How to detect Golden Ticket attacks

November 14, 2025
How to Detect Golden Ticket Attacks in Active Directory A Golden Ticket attack is one of the most damaging post-compromise techniques in Active Directory: an attacker forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account secret, then impersonates any user (often Domain Admin) to access domain resources while blending into “normal”…
Read more
AD Domain ServicesArchitecture & Design

Simulating AD attacks with Purple Team labs

November 14, 2025
Purple teaming in an Active Directory (AD) context is the discipline of running controlled, authorized attack simulations (red) while observing, tuning, and validating detection + response (blue). Done well, it turns vague goals like “improve AD security” into measurable outcomes: which attacks did we detect, how fast, with what signal quality, and what changed because of it. This guide…
Read more
AD Domain ServicesAuthentication & Protocols

Identifying unsecure SPN configurations

October 31, 2025
Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…
Read more
AD Domain ServicesArchitecture & Design

Detecting unauthorized domain replication

October 31, 2025
Unauthorized domain replication is one of the fastest ways for an attacker to turn “some access” into “total access.” If someone can trigger directory replication (or abuse replication rights) they can extract credential material (including password hashes) and move laterally at scale—often without noisy malware on domain controllers. What “unauthorized…
Read more