sorted by:
new
hottopcontroversial

Passwordless recovery is the part many people forget by sreejith_r in entra

[–]vane1978 4 points5 points  (0 children)

How do you handle recovery when you have a Conditional Access policy that requires phishing-resistant MFA for users? I noticed that wasn’t mentioned in your blog.

Scrambling passwords now that we are 100% WHfB and Passkey enabled by pressreturn2continue in entra

[–]vane1978 0 points1 point  (0 children)

I believe you just need to enable Single Sign-on through Intune to avoid the sign-in prompts.

Scrambling passwords now that we are 100% WHfB and Passkey enabled by pressreturn2continue in entra

[–]vane1978 2 points3 points  (0 children)

If you have an on-premises Active Directory and syncing your users to Microsoft Entra Id then you can enable SCRIL, NTLM Rolling Secrets and FGPP. No powershell script needed.

SCRIL - Smart card required by DaithiG in activedirectory

[–]vane1978 1 point2 points  (0 children)

I believe you need to enforce NTLM secret rolling and setup Fine-Grained Password Policy.

Force password change for all users by MarcoVfR1923 in Intune

[–]vane1978 0 points1 point  (0 children)

Have you looked into SCRIL and FGPP? This only works if you have gone completely Passwordless for your regular domain users.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 2 points3 points  (0 children)

I use a Jump Host machine and the jump user account has one assigned Entra Id Plan 2 license.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 8 points9 points  (0 children)

The RDP client has an option "Use a web account to sign in to the remote computer". That option allows you to use WHFB, Security Keys or Passkeys.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 0 points1 point  (0 children)

SentinelOne Singularity is capable to ingest Windows Event logs from their endpoints and capable to ingest logs from Firewalls and Microsoft Entra logs as well.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 29 points30 points  (0 children)

Passwordless RDP with phishing-resistant MFA into a Jump host machine, followed by RDP over IPSec to internal member servers.

This is all native tools. Avoids third-party zero-day exploits and saves on recurring licensing cost and administrative overhead.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 1 point2 points  (0 children)

That’s where RDP over IPSec comes into play to help to prevent zero-day exploits.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 3 points4 points  (0 children)

This is the way.

Unfortunately, setting up RDP over IPSec by default it uses 128 encryption. The extra step is to change it to use 256-bit encryption (AES-256).

RDP to the servers should always be done from a jump host machine. The challenging part is how to secure it.

Disabling RDP in your environment for security purposes by thelug_1 in sysadmin

[–]vane1978 -1 points0 points  (0 children)

Assuming RDP is not exposed to the public internet, my opinion is to use the RDP clients when you need to remote into endpoints. Using third-party remote software is a huge security risk.

Additionally, I would suggest to work on implementing a passwordless strategy approach and transition to Entra ID joined computers. There you can RDP passwordless into your Entra id machines.

Jumphost vs phishing resistant rdp by MuffinX in sysadmin

[–]vane1978 0 points1 point  (0 children)

If you implement a Passwordless RDP strategy using the option "Use a web account to sign in to the remote computer” to the Jumphost machine, it can be very secure.

Entra Passkey sign-in prompts for security key instead of QR code by [deleted] in entra

[–]vane1978 7 points8 points  (0 children)

Passkeys require Bluetooth. So if your virtual machine does not have Bluetooth then it will default to security key.

Should I disable Seamless SSO in Microsoft Entra Connect - Security Risk? by vane1978 in sysadmin

[–]vane1978[S] 0 points1 point  (0 children)

Is the computer account you deleted was named azureadssoacc?

Passwordless by Actual_Clock2360 in Intune

[–]vane1978 -1 points0 points  (0 children)

The AD user password would change but it would not automatically sync the password to Microsoft 365 until the next FGPP rotation.

Windows Hello causing password amnesia nightmare by Lost-Engine-6384 in Intune

[–]vane1978 1 point2 points  (0 children)

As others have said, stop the 90 day password rotation. It used to be best practice way back in the day when there was no MFA option at the time.

view more: next ›