Automation & ToolingPowerShell for AD DSScripts & Templates

Using GPO to enforce firewall rules in Windows

Using GPO to enforce firewall rules means you stop treating Windows Firewall as a per-machine setting and start treating it as centrally managed policy. In an Active Directory environment, the relevant node is Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security. Microsoft’s current guidance applies this model…
Read more
Automation & ToolingPowerShell for AD DSScripts & Templates

Using attribute editor to manage userAccountControl in AD

Active Directory’s normal user property pages are fine for routine administration, but they hide an important reality: many account states are driven by raw LDAP attributes under the surface. The Attribute Editor tab in Active Directory Users and Computers (ADUC) gives you direct access to those attributes, including userAccountControl, which is the bitmask that governs enabled or disabled…
Read more
Automation & ToolingPowerShell for AD DSScripts & Templates

Copy, update Active Directory user attributes with PowerShell

What “replicating user attributes” really means in AD Active Directory doesn’t have a special “copy attributes” feature for users—the directory stores an object (the user) with a set of schema-defined attributes, and your changes are just LDAP modify operations against those attributes. PowerShell “replication” in this context usually means one of these operator tasks: Add /…
Read more
Automation & ToolingScripts & Templates

Detecting Kerberoasting with PowerShell and logs

Detecting Kerberoasting with PowerShell and Logs Kerberoasting is an Active Directory attack technique where an attacker requests Kerberos service tickets (TGS) for accounts that have Service Principal Names (SPNs), then cracks the ticket offline to recover the service account password. Because it uses legitimate Kerberos flows, the key to detection is understanding what…
Read more