AD Domain ServicesDirectory Objects & Identity Data

How to handle user SID-related tasks

September 12, 2025
Handling user SID-related tasks: from first principles to field-tested operations Security identifiers (SIDs) are the nucleus of identity and authorization in Windows and Active Directory. Every access check, every token, every ACL decision hinges on these opaque strings. If you run AD at any real scale, you’ll spend real time handling user SID-related tasks: looking up SIDs…
Read more
AD Domain ServicesArchitecture & Design

AD internal vs external trust hardening

September 12, 2025
AD internal vs external trust hardening Active Directory trusts are one of those features that “just work” right up until they become the quietest, widest attack path in your environment. The hardening mindset is simple: a trust is not a convenience link, it is an authentication boundary decision. This article compares…
Read more
AD Domain ServicesReplication, Sites & Domain Controllers

Managing AD metadata cleanup post-DC decommission: A Playbook

September 9, 2025
Active Directory behaves as if that DC never existed. This guide goes beyond “delete in ADUC” and covers DNS SRV/CNAME integrity, KCC recomputation, lingering objects, and RODC specifics. Focus: metadata cleanup Covers: ADUC/ADSS/ntdsutil Also: DNS SRV, KCC, DFSR, RODC Quick nav Why this matters now Definition & blind spots Under the hood Production-ready Runbook Inherent…
Read more
AD Domain ServicesArchitecture & Design

SID filtering in complex AD layouts: the one-bit boundary that decides what crosses your forest

September 9, 2025
Quick definition: SID filtering is a trust-side control that removes foreign SIDs—including values in SIDHistory—from a user’s authorization data as it traverses a trust. It prevents privilege escalation by honoring only the SIDs the trusting side expects. Answer box (at a glance) External/domain trusts: Quarantine=Yes by default → accept only SIDs from the directly trusted…
Read more