NTLM & Legacy Protocols
Require SMB signing and disable SMBv1 domain-wide
Enforce SMB signing on clients and servers, understand Windows 11 24H2 and Server 2025 defaults, audit SMBv1 use, and remove it without breaking file access.
Foundation
Guides tagged
#ntlm-relay
NTLM & Legacy Protocols
Enforce LDAP signing and channel binding on DCs
Roll out LDAP signing and channel binding with evidence: collect events 2887, 2889 and 3039, fix clients, then set LdapEnforceChannelBinding safely.
Intermediate
AD Certificate Services
Securing AD CS web enrollment against ESC8 and ESC11
Close NTLM relay to AD CS: find HTTP enrollment endpoints, enforce HTTPS and EPA, disable NTLM, remove Web Enrollment and enforce RPC encryption.
Intermediate
Domain Controller Hardening
Blocking authentication coercion on domain controllers
Shut down PrinterBug, PetitPotam, DFSCoerce and ShadowCoerce on DCs with RPC filters, service reduction and relay-proof targets, then verify it holds.
Advanced