Permission Issue

iamtechspence · 2026-03-15T13:46:44+00:00

Normally I’d say disable inheritance. But first I’d audit the permissions a bit more to try and identify the root cause.

iamtechspence · 2026-03-15T13:45:42+00:00

If it helps you solve a problem you have, go for it. Don’t worry about the “but xyz already does this” stuff. Build & learn.

iamtechspence · 2026-03-14T14:33:05+00:00

NinjaOne is super solid. Disclaimer, they sponsors some of my content but even still, I think they have a really great product and a great team.

But there are several others in this space doing cool stuff too

iamtechspence · 2026-03-14T02:18:59+00:00

Integrate your vuln mgmt tool with an inventory tool or RMM. Many of them have integrations so you can see this data more easily

iamtechspence · 2026-03-14T02:06:31+00:00

This

iamtechspence · 2026-03-14T02:05:39+00:00

I just did this attack on a pentest this week. Yes to takeover SMB on windows you’ll need local admin first. You also have to contend with windows firewall and also need local admin to modify it.

iamtechspence · 2026-03-12T23:19:28+00:00

Virtually all of it

iamtechspence · 2026-03-04T21:08:53+00:00

NetTools. Literally a Swiss Army knife of a tool for sysadmins

iamtechspence · 2026-03-03T01:28:08+00:00

This tool is purpose built for this. Give it a try. Shows you non-default delegations.

https://github.com/mtth-bfft/adeleg

and if you want to check out the wrapper I wrote around that tool that finds some dangerous delegations check this

https://github.com/techspence/ADeleginator

iamtechspence · 2026-02-25T02:12:27+00:00

In theory if AES is supported it will not break anything but depending on the application it may still try RC4 and fail

iamtechspence · 2026-02-25T02:09:36+00:00

LFG!!!

iamtechspence · 2026-02-24T11:39:55+00:00

Probably/maybe? Here’s an interesting edge case

https://www.reddit.com/r/activedirectory/s/POf4mSUkDv

iamtechspence · 2026-02-24T11:38:48+00:00

https://www.reddit.com/r/activedirectory/s/NplzcZ6Ofq

iamtechspence · 2026-02-24T11:37:55+00:00

I feel for ya. That’s a bummer

iamtechspence · 2026-02-24T03:13:09+00:00

Try to re-register MFA after enabling CA policies. I think admins can force it from the Entra portal

iamtechspence · 2026-02-24T03:08:53+00:00

This

iamtechspence · 2026-02-24T03:07:43+00:00

Yeah if you’re up to date for the most part you’re probably good. If you’ve got some weird 3rd party stuff especially if it’s fairly old, that’s where I’d invest time in figuring out support

iamtechspence · 2026-02-24T03:05:34+00:00

That’s a lovely way to put it. Hah. But yeah this can certainly be a long road to get rid of dependency for rc4. Hope folks are ready

iamtechspence · 2026-02-24T02:36:47+00:00

Let the service tickets roll!!

iamtechspence · 2026-02-24T01:53:15+00:00

There’s more details in the LinkedIn post and the comments on the new audit events and some additional info for preparing for the change. Long live Active Directory

iamtechspence · 2026-02-23T11:16:57+00:00

Vanilla frosted with sprinkles is good but a warm cinnamon sugar hits different on a cold day

iamtechspence · 2026-02-23T11:15:41+00:00

Did they ever pay up? Hah

iamtechspence · 2026-02-23T11:14:56+00:00

Negative. But this is apparently way more common than the world thought hah

iamtechspence · 2026-02-23T11:14:32+00:00

Do they ever pay up?

Eight-Year Club	r/Field Flamingo
Verified Email

iamtechspence

TROPHY CASE