Object & ACL Security
AdminSDHolder and SDProp: cleanup and monitoring
Baseline the AdminSDHolder ACL, find orphaned adminCount=1 accounts, reset their ACLs safely, trigger SDProp on demand, and alert on AdminSDHolder changes.
Intermediate
Guides tagged
#adminsdholder
Object & ACL Security
Auditing Active Directory ACLs before an attacker does
How to find dangerous AD ACLs like GenericAll and DCSync rights, clean up stale adminCount flags, and use BloodHound defensively.
Foundation