MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings

Kevin Robertson examines Active Directory's transitive machine account quota: AD applies a Q*(Q+1) formula capped at 110 by default, but recursive creation via Powermad could randomly exceed it.

Golden Ticket attacks forge Kerberos TGTs using the KRBTGT account hash to gain unrestricted domain access. Explains Kerberos and KRBTGT basics, how Mimikatz is used, and defensive tactics.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Explainer on AD Golden Ticket attacks: attackers forge Kerberos tickets to gain access to your organization's IT environment; the post covers basic security hygiene and building layered defenses against them.

Theory behind the Kerberos Bronze Bit attack (CVE-2020-17049), which abuses a KDC flaw to bypass delegation checks in resource-based constrained delegation attacks against Active Directory.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.