Active Directory

You nailed it.

Or the exact sequence to rebuild a compromised Active Directory environment from a known good backup.

The playbook adapts to the Text Act, but the policy secures the mandate.

That distinction really clears things up.

Exactly.

And its primary job was to hold the print queue, host all the localized driver files for every single make and model of printer in that building, and manage access control through legacy active directory group policy.

Because if a user sent a document to the printer, their laptop didn't just speak to the printer directly.

No, not at all.

And this requires confronting a historical misconception that has calcified into an assumed dependency.

What's the misconception?

The misconception is that DHCP, the dynamic host configuration protocol, must logically co-locate with active directory domain controllers.

Because in legacy environments, they almost always live in the exact same physical box.

This week, the stars have aligned, and the Hybrid Identity Podcast is at the Hybrid Identity Conference here in Nashville.

Active Directory has been around for more than 25 years, 26 actually, and organizations spend, or should spend, a lot of time reducing vulnerability from misconfigurations, security updates.

For example, a couple of days ago, a big one was announced for DNS.

Just for your reference, CVE-2026-69730 with a critical score of 9.8. and simply the accumulated cruft of being in production for years or decades.

NTLM is actually older than AD.

It's easily taken advantage of and it's being used in your forest all the time.

To talk about this, my guest today is Linda Taylor, Principal Software Engineer at Microsoft, with over two decades of experience in Windows, specializing in Active Directory, authentication, and enterprise security.

She currently works in Windows authentication, fixing customer bugs, addressing security vulnerabilities, and advancing Kerberos and NTLM.

Once we have that cracked password of that user account, we'll go to the domain controller and coerce it to say, hey, authenticate back to me and we can get the domain controller to log into us.

And we will relay that to Active Directory certificate services and then have Active Directory certificate services give us the certificate for the domain controller.

So then now we have credential material that we can become the domain controller.

And with that, then we can talk to another domain controller and prove that we are another domain controller just like them and convince it to give us all the passwords.

Got it.

We're tricking the domain controller that we're somebody that they should log into.

And then we're just taking that and relaying that on to your Active Directory certificate services, which are often misconfigured that allow us to then gain what's called the certificate for the domain controller.

Got it.

A little bit less impressive is the labs where they're like, I have a Proxmox server that runs my Plex server and it runs my local NAS and it runs these things.

It's still cool, but it's not as focused as somebody who I have set up two domain controllers in an Active Directory environment and I have set up 16 virtualized workstations that all have scripts running that talk to the domain controllers and we have a SQL server running and all these things and I can go in there and practice attacks.

Right.

Like, that's super cool.

Then Vonecheck built an ASLR bypass that gets code execution on x86-64 with error display turned off, which is the recommended production setup.

that exploit is limited to its customers here's the shift though palo alto's unit 42 now reporting a successful intrusion at a european government entity within two hours of initial exploitation the attackers had password hashes and mfa secrets they set up an ntlm relay tunnel into active directory and attempted domain admin escalation the Their command output was wrapped in machine-parsable delimiters until an AI agent was reading the results and choosing the next move.

Separately, tracking a suspected Lazarus-linked North Korean campaign, scanning 216 unpatched hosts across government, finance, aviation, and logistics from 21 compromised nodes.

deliberately paced the slip under the threshold-based alerting, and PHP has warned of the third RCE, that's CVE-2026-115-560.

Second group, to my right, Tim Howes came over from Michigan and had built the LDAP directory server.

Standard called LDAP, it actually, the standard one, and that's what powers Active Directory and by extension out to Okta, but that company or that server failed.

Meanwhile, there was this other group down the hall, back corner, a couple of guys.

I actually think at some point, not we, I'm like a little woodchuck kid, but I think the executive, I think we might have sold the company.