Kerberos & Authentication
Defending against Kerberoasting and AS-REP roasting
Shrink Kerberoasting and AS-REP roasting exposure: inventory SPNs, remove stale ones, move to gMSA and AES, deploy a honey SPN and detect RC4 4769 spikes.
Foundation
Guides tagged
#service-accounts
Passwords & Service Accounts
Migrating service accounts to gMSA and dMSA
Step-by-step migration from static service accounts to gMSA and Windows Server 2025 dMSA: KDS root key, retrieval rights, per-app notes and rollback.
Intermediate
Passwords & Service Accounts
Service account hardening: gMSA, SPNs and LAPS
A practical guide to replacing risky service accounts with gMSA/dMSA, cleaning SPN exposure, fine-grained password policies, and Windows LAPS.
Foundation