Group Policy Abuse Explained

With many GPOs across large AD environments, critical changes can slip under the radar. DSP simplifies GPO change auditing, alerts on suspicious edits, and helps restore altered policies.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.

Semperis introduces Lightning Intelligence, a SaaS tool that continuously scans AD and Entra ID, replacing Purple Knight's manual runs, with multi-forest dashboards and no agent required.

Kerberoasting lets any domain user crack Kerberos service tickets for SPN-registered accounts offline, recovering plaintext passwords—often for high-privilege accounts. Covers defenses and detection.