KnowledgeBase: Windows Hello for Business satisfies Smartcard is required for interactive logon requirements

One of the main strategies for securing privileged accounts in Active Directory Domain Services seems to enable the Smartcard is required for interactive logon option on members of the Domain Admins security group. Typically, that required deploying (virtual) smartcards, but there is a far easier way that is currently being wildly adopted: Windows Hello for … Continue reading "KnowledgeBase: Windows Hello for Business satisfies Smartcard is required for interactive logon requirements"

What's New in Microsoft Defender for Identity in November 2021

Microsoft Defender for Identity helps Active Directory admins defend against advanced persistent threats (APTs) targeting their Active Directory Domain Services infrastructures. It is a cloud-based service, where agents on Domain Controllers provide signals to Microsoft's Machine Learning (ML) algorithms to detect and report on attacks. Its dashboard allows Active Directory admins to investigate (potential) breaches … Continue reading "What's New in Microsoft Defender for Identity in November 2021"

On-premises Identity-related updates and fixes for November 2021

Even though Microsoft’s Identity focus moves towards the cloud, they are not forgetting their on-premises roots. Windows Server 2016, Windows Server 2019 and Windows Server 2022 still receive updates. These are the Identity-related updates and fixes we saw for November 2021: Windows Server 2016 We observed the following updates for Windows Server 2016: KB5007192 November … Continue reading "On-premises Identity-related updates and fixes for November 2021"

VMSA-2021-0027 updates for VMware vCenter Server 6.5 and 6.7 address two vSphere Web Client vulnerabilities (CVE-2021-21980 and CVE-2021-22049)

Earlier this week, VMware released an update that addresses an arbitrary file read vulnerability in the vSphere Web Client (CVE-2021-21980) and an SSRF vulnerability in the vSphere Web Client (CVE-2021-22049). These two vulnerabilities can be used to compromise virtual Domain Controllers running on VMware vSphere ESXi 6.5 and vSphere ESXi 6.7. About the vulnerabilities arbitrary … Continue reading "VMSA-2021-0027 updates for VMware vCenter Server 6.5 and 6.7 address two vSphere Web Client vulnerabilities (CVE-2021-21980 and CVE-2021-22049)"

VMware has recalled all released versions of vSphere 7.0 Update 3

VMware’s vSphere ESXi 7.0 U3, U3a, and U3b and VMware vCenter 7.0 U3b are no longer available for download due to several critical issues identified in them. Issues experienced in the field Organizations running vSphere 7.0 Update 3 have reported the following critical issues: ESXi 7.0 Update 3 hosts can experience a PSOD when virtual … Continue reading "VMware has recalled all released versions of vSphere 7.0 Update 3"

TODO: Mitigate the Information Disclosure vulnerability caused by improperly configured Azure Migrate applications

Last week, Microsoft issued security guidance on a security issue within Azure Active Directory. In this guidance, Microsoft instructs Azure AD admins to rotate the password for Azure Migrate applications, when these applications have been created prior to November 2, 2021. About the vulnerability CVE-2021-42306 is a vulnerability in the way Azure AD stores the … Continue reading "TODO: Mitigate the Information Disclosure vulnerability caused by improperly configured Azure Migrate applications"

TODO: Change the credentials for Azure Automation Run-As accounts

Last week, Microsoft issued security guidance on a security issue within Azure Active Directory. In this guidance, Microsoft instructs Azure AD admins to rotate the password for Azure Automation Run-As accounts, when these accounts have been created between October 15, 2020 and October 15, 2021. About the vulnerability CVE-2021-42306 is a vulnerability in the way … Continue reading "TODO: Change the credentials for Azure Automation Run-As accounts"

I’m speaking at the 2021 Hybrid Identity Protection Conference

This December, I’m joining many of my technical friends at the Hybrid Identity Protection Conference. About the Hybrid Identity Protection Conference The Hybrid Identity Protection Conference is Semperis Inc.’s event to bring together the leading experts in the field of Identity and Access Management. The event offers a unique opportunity to spend time with peers, … Continue reading "I’m speaking at the 2021 Hybrid Identity Protection Conference"

I'm presenting a webinar with the Petri IT Knowledgebase and StealthBits

On December 2 at 7 PM CEST, I'm presenting a webinar with Petri IT Knowledgebase and StealthBits on securing Active Directory. About Petri.com The Petri IT Knowledgebase has served as one of the world’s leading content and community resources for IT professionals and system administrators for more than 15 years. First launched by fellow Microsoft … Continue reading "I'm presenting a webinar with the Petri IT Knowledgebase and StealthBits"

You may encounter authentication issues after installing the November 2021 Cumulative updates

While installing updates is one of the basic information security measures, many organizations hold off on installing updates for Windows Server within 48 hours. This month, we saw another reason why it’s a smart idea to test updates in pre-production environments before deploying them to production domain controllers. After installing the November 2021 cumulative and/or … Continue reading "You may encounter authentication issues after installing the November 2021 Cumulative updates"