Top all-time · #11515
Active Directory & Azure AD/Entra ID Security
Personal blog · adsecurity.orgsecuritysystems
Active Directory & Azure AD/Entra ID Security is a personal blog at adsecurity.org about security and systems. Since 2017, 7 different Hacker News readers have linked it 8 times. It is still writing: the last post was on 2026-05-20, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link this Active Directory and Entra ID security blog for posts on attack techniques such as Kerberoasting and Kerberos password changes. Commenters cite it when discussing those topics.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /?p=45972 people · 2 mentions · first linked 2025-12-22
What Hacker News says?
Most of my time on it these days is supporting others, or using my aging 2014 MBA. What I remember is I started to get more locked down with each update. Personally I would prefer an "expert" mode in preferences or something of the sort. But yeah, I made a rash judgement on something I don't often use. I owned up to it. Anyway, for what it's worth the only reference to that command online is from Apple discussion bo…
Comment linking /wp-content/uploads/2015/01/PowerShell-ExecutionPolicy.png
on “Termux and Android 10”Submitted Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory as a story · 4 points
HN discussionDisaster recovery specialists tend to focus on things like restoring from tape drives in a hurry. I do general IT consulting, and all that was required was some "general security knowledge". There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line. If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory netw…
Comment linking /?p=2288
on “Patreon laid off their security team”This article is somewhat incorrect. Kerberoasting abuses Ticket Granting Service tickets (TGSs, which are used to request access to a registered service in Active Directory), not Ticket Granting Tickets (TGTs, which are used to prove identity to a Domain Controller and request TGSs). However, the general attack described is still correct. TGS are (AES or RC4) encrypted with the NT password hash of the service accoun…
Comment linking /?p=3513
on “Kerberoasting”TL;DR Security done this way is expensive, using four physical devices: A gaming desktop, a secure workstation, a NAS, an ESXi server. The hardest part at first was the discipline to use each workstation for its intended purpose and breaking bad habits, IE not browsing the web from the gaming machine etc. As a pentester, here are some of the things that I use and do to reduce my personal attack surface. I separate o…
Comment linking /?p=3299
on “Professionals: How do you make sure your computer hasn't been hacked?”> I also disagree there. Just change it exactly once every two weeks or so. Just don't do it more than once within 10 hours. See: https://adsecurity.org/?p=4597 That link says wait a week before the second change. There is a good reason for that, because kerberos is so assymetric and just because there are badly written apps out there, you'll cause failed logins for them if you do it too fast. Normally I consider th…
Comment linking /?p=4597
on “Microsoft will kill obsolete cipher that has wreaked decades of havoc”> I've done kerberoasting and aseproasting a handful of times only, but from what I recall, RC4 can be cracked within reasonable time regardless of your password complexity That's not quite right. If the password is sufficiently strong, you won't crack it even when RC4 is used. The password space is infinite. You might be thinking of the LM hash, where you are guaranteed to find the password within minutes, because…
Comment linking /?p=4597
on “Microsoft will kill obsolete cipher that has wreaked decades of havoc”
