AD Domain ServicesArchitecture & Design

How to design AD for Zero Trust: Practical first steps

October 3, 2025
Designing AD for Zero Trust: Practical First Steps Designing AD for Zero Trust (practical first steps) means reshaping your on-premises Active Directory (AD) so that every access request is explicitly verified, least-privileged, and resilient to compromise. Zero Trust is a security model that assumes no implicit trust—inside or outside your network—and continuously validates identity…
Read more
GPO FundamentalsGroup Policy & Endpoint Policy

Automating inactive user account cleanup: beyond “run a script every 90 days”

September 19, 2025
A production-grade playbook for hybrid Active Directory and Microsoft Entra ID (Azure AD) inactive user account cleanup: signals, staged actions, reversibility, and governance—backed by copy‑paste runbooks. On this page Quick definition Why the usual approach breaks First principles Production-ready technical core Implications & trade-offs Expert mental models Misunderstandings &amp…
Read more
AD Domain ServicesArchitecture & Design

Removing 'password never expires' accounts

September 17, 2025
Removing “Password Never Expires” Accounts in Active Directory The “Password never expires” setting (the DONT_EXPIRE_PASSWORD userAccountControl flag) is one of those legacy conveniences that quietly turns into a long-term security and compliance problem. This article shows how to find these accounts, decide what “good” looks like per account type, and remove the…
Read more
Identity Protection & RiskMicrosoft Entra ID

Risk-based lockout policy tuning

September 17, 2025
Risk-based lockout policy tuning: Cloud vs on-prem comparisons, deep mechanics, and technical implementation Risk-based lockout policy tuning is the practice of adjusting lockout behavior based on the assessed risk of an authentication attempt, rather than relying on a fixed “X failed passwords = lockout” rule. The goal is simple: slow attackers down hard while keeping…
Read more
AD Domain ServicesArchitecture & Design

Active Directory 25-year evolution: what changed, what stayed true, and what comes next

September 5, 2025
Comparative guide AD modernization Hybrid identity Zero trust Kerberos Forest recovery Classic AD → Modernized AD → Hybrid future From castle-and-moat to zero trust and hybrid identity: the AD journey. Quick jump: definition · core mechanisms · classic vs modernized · modernization runbook · implications · mental models · misunderstandings & fixes · forward look · field…
Read more