What is Active Directory Security?

Part 1 of the CISA/NSA top ten misconfigurations series for AD: default configurations, improper privilege separation, and lack of internal monitoring, with remediation guidance.

Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.

Seven Active Directory misconfigurations to find and fix, starting with non-default principals holding DCSync rights and AdminSDHolder permission tampering; each item includes detection pointers and remediation steps.

A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

A guest post on AD security for state, local, and education organizations: why detection matters before, during, and after incidents, the threats SLED faces, and a hardening action plan.