NTLM & Legacy Protocols
Audit and restrict NTLM in Active Directory
A step-by-step NTLM reduction plan: audit with events 8001-8004, fix the causes, build an exception list, remove NTLMv1 and set LmCompatibilityLevel 5.
Advanced
Guides tagged
#authentication
Kerberos & Authentication
Disable RC4 in Kerberos: audit, fix and enforce AES
Remove RC4 from Kerberos safely: audit 4768/4769, fix accounts without AES keys, set msDS-SupportedEncryptionTypes and DefaultDomainSupportedEncTypes, enforce.
Intermediate
Kerberos & Authentication
Kerberos hardening: RC4, roasting and golden tickets
Enforce AES-only Kerberos, disable RC4 and DONT_REQ_PREAUTH, rotate krbtgt correctly, and detect Kerberoasting and golden ticket abuse.
Foundation