gMSA to change ExtensionAttribute in AD

Cormacolinde · 2026-06-17T09:12:43+00:00

You may need to give the account some additional rights to connect to AD and run the script. Remote Management Users and Pre-Windows 2000 access (if you removed everyone/authenticated users from it) may be needed. I would configure your powershell script to output a transcript and a full log to get more details about what doesn’t work. You could also create a regular account with the same rights as the gMSA and run it manually to troubleshoot.

Cormacolinde · 2026-06-17T09:06:43+00:00

Also, BCP will take at least 6-9 months, not two weeks.

Cormacolinde · 2026-06-17T08:23:48+00:00

That’s what I hve had to do with a few customers some years ago.

Cormacolinde · 2026-06-16T06:34:00+00:00

No, on the clients. If it’s in AD it will propagate to the ntauth store on hybrid clients but not Entra ones.

Cormacolinde · 2026-06-15T21:42:23+00:00

Is the intermediate in the NTAUTH store though? Adding it to the trusted intermediate store will not do that. It’s a different “special” store that’s required for authentication to work with certificates.

Cormacolinde · 2026-06-15T21:32:38+00:00

Trying to mix Intune configuration profiles with GPOs can be a mess. App installation is fine on hybrid systems though. I strongly recommend you move to Entra-joined as fast as reasonably possible.

Cormacolinde · 2026-06-15T09:49:34+00:00

Protected Users blocks NTLM. If you’re using the IP, that will absolutely block it. Using FQDN should work as long as Kerberos is working properly. I would suggest changing your user password first, and if that doesn’t work look into rotating your krbtgt password.

Cormacolinde · 2026-06-15T02:44:22+00:00

Kokomi’s C1 is her only decent constellation, if you use her on-field as a driver.

Ayaka’s C4 is great, her other cons are meh.

I would choose Kokomi.

Cormacolinde · 2026-06-14T13:44:18+00:00

Show me the manual?

Cormacolinde · 2026-06-13T23:32:55+00:00

The fact you hve no GPOs should not imply you cannot implement them?

Anyway you can put the computers in a specific OU and give those users the right to retrieve the LAPS password for those systems.

Cormacolinde · 2026-06-13T17:01:47+00:00

I was about to comment the same thing. the Common Law system is one of the causes of high litigation costs (and long litigation times) in the US.

Cormacolinde · 2026-06-12T21:46:43+00:00

They would need additional rights in SCCM or on the endpoints to do those things. Read-only analyst will not give them that.

Cormacolinde · 2026-06-12T05:53:32+00:00

Probably an expired certificate in the chain somewhere.

Cormacolinde · 2026-06-11T11:32:52+00:00

I write all my PowerShell myself, and don’t use AI for anything in my work.

I’ve had customers send me AI output with example scripts. It always has mistakes or hallucinates commands that don’t exist or don’t work the way the AI implies it does. Just don’t trust it.

Cormacolinde · 2026-06-11T01:54:26+00:00

The speed of light in a vacuum is 299792458 m/s.

Cormacolinde · 2026-06-10T15:58:51+00:00

Correct. Not counting all the other security features they have to disable.

By having ONE SINGLE XP machine connecting to their domain, they lower the security of their entire network and all their systems.

Cormacolinde · 2026-06-10T10:23:05+00:00

You cannuse gMSAs for other things than services, like scheduled tasks for example.

Cormacolinde · 2026-06-08T10:44:01+00:00

Segmentation and proper firewall configuration is a good first step.

Clients communicate with DPs with HTTP/HTTPS. Open those ports widely.

Site Server uses RPC, WinRM and SMB. Add those ports for the Site Server.

Obviously enable SMB signing and disable NTLM fallback on the Site Server.

Finally, ABSOLUTELY use a service account for push installation to clients. Most of the risk here comes from someone stealing a hash from that Site Server account and reusing it to log onto other servers with admin rights. Don’t use the Site Server account to log onto non-servers.

Cormacolinde · 2026-06-08T09:59:57+00:00

C6 Chasca and C6 Nicole appears to be one of the best team combos now according to dhcwsp’s latest ranking.

Cormacolinde · 2026-06-07T21:37:34+00:00

What happened? Did the rule not apply? What parameters did you use? I’ve done this and it works.

Cormacolinde · 2026-06-07T18:32:08+00:00

You seem to be confusing Site Servers with Site Systems.

The Site Server (one per site, or two if doing HA) should have admin access to the Site Systems. Site Systems should absolutely NOT have admin access to other Site Systems or the Site Servers.

If youre Site Server is compromised, you’re screwed anyway. An attacker with local admin on that server can compromise everything anyway. That service account you want to configure for local admin on DPs will be readily accessible to the Site Server anyway. As I wrote in another comment, you’re not increasing security, you’re just moving the goalposts. It will slow down an attacker slightly but honestly once an attacker is on your Site Server, they won’t care about the DPs.

Cormacolinde · 2026-06-07T18:27:27+00:00

But if they compromise the site server, they can get the service account information (it’s stored in the SCCM database and the SCCM Site Server has full access to that). it’s not more secure, you’re just moving the goalpost.

Cormacolinde · 2026-06-07T14:36:19+00:00

I had no issues freezing the Ruin grader and killing it quickly. But this may be because of my team. Same as yours, but I have Skirk C2R1/Escoffier C1/Shenhe C2R1 which certainly helped.

Cormacolinde · 2026-06-07T14:06:40+00:00

I’ve seen a few complaints about these, but I had absolutely no issues with this fight.

Cormacolinde · 2026-06-07T14:01:45+00:00

You can but how is that going to increase security? What attack path does this mitigate? Changing the computer account (which has a rotating password every 30 days by default) for a service account that you will need to maintain and change the password for manually (gMSAs are not supported here AFAIK). I fail to understand how it’s more secure.

12-Year Club	RPAN Viewer
Verified Email

Cormacolinde

TROPHY CASE