How to Prevent a Man-in-the-Middle Attack: AD Security 101

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.

Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.

Shows how to find systems where Domain Admins are likely logged in by querying the ServicePrincipalName attribute over LDAP, with a PowerShell module to automate the process.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Why the common 'switch from LDAP to LDAPS' recommendation is mostly ineffective: AD members always use port 389, common workarounds fail, and the post explains what actually hardens AD LDAP.

LDAP reconnaissance lets attackers query AD for users, groups, computers, and privileges to find weak points. The post covers detection plus tools like AdFind and SharpHound.