Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM
4°08'15.0N 162°03'42.0E
Joined August 2014
- Tweets23.6K
- Following732
- Followers37.3K
- Likes42.8K
Pinned Tweet
To my black family, friends, and people seeing this:
I love you
You matter
I'm here for you
#BlackLivesMatter
Tomorrow at 1pm Eastern Time
This week, we’re talking desktop AI—join us for Wednesday's webinar at 1:00PM for “Leash Your LLM: Rolling Out Claude and Copilot Securely.” These tools can act across your files, inboxes, and business apps, so a thoughtful rollout matters. Register now! hubs.la/Q04CZ1QF0
I'll be there!
Is Active Directory indefensible? @merill and I are debating it at Workplace Ninjas US, Jan 11–13, 2027 in Scottsdale. 🍿
@nathanmcnulty is head referee :)
Day 1 is a bunch of fun activities. Day 2 and 3 are full of endpoint, identity & security sessions.
Early bird pricing is over but you can DM me for a $50 off code.
workplaceninjas.us
@wpninjasus
And run Locksmith2 to identify security issues and get guidance on how to fix the issues!
github.com/jakehildreth/lock…
Read, learn, implement.
techcommunity.microsoft.com/…
TIL: Microsoft Copilot keeps conversation history and personalization memory, stored in the user’s Exchange mailbox, so retention and eDiscovery apply.
Prompt history, data artifacts, and memory data are stored in hidden folders in the user's Exchange online mailbox, similar to Teams messages.
This means that an attacker with full access to mailboxes can pull this information.
techcommunity.microsoft.com/…
Vulnerability in node.js component in SDDC Manager 9.1.1 results in RCE rated Critical (9.8). Patch is pending - there are workarounds.
Today we released a new Critical Severity VMware Security Advisory. Check out support.broadcom.com/web/ecx…. #VMware #VMwareByBroadcom
1
10
2,469
Most of the time it's an AD account with a poorly chosen password. Or a regular user account with elevated privileges in Entra ID.
And MOST organizations still aren't using an admin system to perform admin functions which puts the admin account credentials at risk.
Don't connect "smart TVs" to the internet.
Use a device like Apple TV or Roku.
❗️ Samsung and Vizio smart TVs kept contacting the servers that track what you watch after users opted out, Northeastern University researchers found.
On Vizio the opt-out had no visible effect, even with the TV idle.
1
8
1,171
Starting on November 4th, Entra ID users will be able to create agent identity blueprints unless this capability is disabled. I strongly recommend you disable this capability so you don't have users creating agent identity blueprints.
There's a setting to turn this off in Entra ID under User Settings: "Users can register agent blueprints".
Switch it to "No" to prevent users from being able to do this.
Agent identity blueprints are templates that define identity configuration and credentials for AI agents. This is similar in capability to app registrations but for agent identities.
Allowing all users to create blueprints has similar risk to allowing all users to register applications (default is enabled as well). When a user creates an agent identity blueprint, they become the owner of it until removed. This provides full control access to the blueprint.
Agent ID Developer and Agent ID Administrator will still have the ability to create them.
More details here (including searching for existing blueprints):
lazyadmin.nl/office-365/micr…
If you’re @InfoSec_World this week, I hope to see you at my session on Wednesday at 11am on attacking & defending Entra ID.
The Defender's Paradox:
When the Attacker is on the Outside, they only
need to be right once.
Once the Attacker is Inside, they need to be right
100% of the time and now the Defender only
needs to be right once to catch them!
Too many times I have found a scheduled task on Domain Controllers running as DA or System that calls a script located on a share that's controlled by admins (not AD Admins). When this is configured via a GPO, any AD user can look it up.
Escalation is sometimes way too easy.
Real life internal pentest attack path…
Starting assume breach style on a domain joined endpoint, after recon I found a file share with batch files that looked to be important.
They had “production” in their names.
It wasn’t obvious what these were for but I could modify them as a regular user.
I wrote this down and moved on.
Later, after obtaining a local admin account that got me access to a server, I discovered scheduled tasks that were calling those batch files.
Guess the privilege level of the account used to run those batch files?
Domain Admin 💀
It’s the seemingly innocuous things that many times end up being a really big deal.
The IT team was not expecting anyone would ever go to that file share. They wouldn’t ever need to.
But they took it for granted because any user could, if they wanted to.
So I did.
I love how Lyft is like Priority Pickup in 4 minutes and standard is 8 and then you go for Priority and the wait is 8 minutes.
Crazy!
5
1,597
I get this and agree. I will say though that if the choice is between an available air pump that costs (like $1) and no available air pumps, I’m fine with paying when I need it.
2
8
1,621
Of course moving to Entra from Active Directory assumes you have a good handle on all the applications that are AD dependent (LDAP, RPC, NTLM, Kerberos, etc.).
You should be moving towards cloud federating these to future proof your environment.
Active Directory may be 26 years old, but if your strategy is just “move to Entra” you’re in for a rude awakening.
If you think managing Active Directory is difficult, just wait until you’re managing identities across all of Entra ID, SaaS apps, cloud roles, service principals, Conditional Access policies, and dozens of integrations.
Entra is a whole new ball of wax, and I see IT admins jumping in optimistically only to find out it’s not as easy as they were sold.
You don’t instantly eliminate identity complexity by moving to the cloud. But that’s exactly how it’s being sold to IT teams.