AD Domain ServicesArchitecture & Design

AD internal vs external trust hardening

September 12, 2025
AD internal vs external trust hardening Active Directory trusts are one of those features that “just work” right up until they become the quietest, widest attack path in your environment. The hardening mindset is simple: a trust is not a convenience link, it is an authentication boundary decision. This article compares…
Read more
AD Domain ServicesReplication, Sites & Domain Controllers

Managing AD metadata cleanup post-DC decommission: A Playbook

September 9, 2025
Active Directory behaves as if that DC never existed. This guide goes beyond “delete in ADUC” and covers DNS SRV/CNAME integrity, KCC recomputation, lingering objects, and RODC specifics. Focus: metadata cleanup Covers: ADUC/ADSS/ntdsutil Also: DNS SRV, KCC, DFSR, RODC Quick nav Why this matters now Definition & blind spots Under the hood Production-ready Runbook Inherent…
Read more
AD Domain ServicesArchitecture & Design

SID filtering in complex AD layouts: the one-bit boundary that decides what crosses your forest

September 9, 2025
Quick definition: SID filtering is a trust-side control that removes foreign SIDs—including values in SIDHistory—from a user’s authorization data as it traverses a trust. It prevents privilege escalation by honoring only the SIDs the trusting side expects. Answer box (at a glance) External/domain trusts: Quarantine=Yes by default → accept only SIDs from the directly trusted…
Read more
AD Domain ServicesArchitecture & Design

Indexing mechanisms that make Active Directory searches fly (and when not to use them)

September 5, 2025
If “search is slow” keeps popping up, the root cause is usually query shape and whether the directory can answer it with an index. In Active Directory, the right index can cut a search from seconds to milliseconds—but the wrong one just bloats NTDS.dit. Internal links throughout point to Windows-Active-Directory.com references (WAD), and external links go to Microsoft’s first-source…
Read more