Did You Really Secure LDAP – or Just One-Third of It? (Part 1 of 6)
LDAP security is three separate jobs: encrypt the connection, strengthen the authentication method, and secure the account. Enabling LDAPS completes only the first job.
-
-
Is Your Domain Controller Leaking Passwords? (Part 2 of 6)
Cleartext or unsigned LDAP simple binds expose reusable passwords. Event IDs 2887 and 2889 identify the affected volume, clients, and accounts before enforcement.
-
Is Your “Encrypted” LDAP Actually Protected? (Part 3 of 6)
LDAPS and StartTLS can protect LDAP traffic equally when correctly enforced. Protection fails when StartTLS falls back to cleartext or weak TLS remains enabled.
-
Why Send a Password You Can’t Take Back? (Part 4 of 6)
SASL with Kerberos replaces a reusable LDAP password with a short-lived ticket. Signing and channel binding then protect that authentication from tampering and relay.
-
When Did That Service Account Last Rotate? (Part 5 of 6)
gMSA and dMSA reduce service-account risk through automatic password management and machine-bound use. They still require protected LDAP transport and least privilege.
-
Are You Hoping Your LDAP Is Secure – or Do You Know? (Part 6 of 6)
A complete LDAP migration starts with auditing, then secures the channel, bind, and account before enforcing signing and channel binding and validating the result.
-
There are three ways BYOD quietly becomes your biggest security liability — and only one of them shows up on a device audit.
BYOD risk usually comes from an outdated policy, limited visibility into app behavior, and misplaced trust in how employees handle corporate data on personal devices.
-
The layer Microsoft’s docs never show you.
Privileged Access Groups work in layers: security groups hold permissions, PIM makes membership eligible, activation grants time-bound access, and some directory roles require a second activation.
-
Blocking USB Storage Does Not Block USB Security Keys
A USB storage block targets mass-storage devices. FIDO2 security keys use the Human Interface Device protocol, so they require separate endpoint and Entra ID policy design.
-
When MFA Registration Gets Confusing, Here’s Why
Most MFA registration problems are not really MFA problems. One user is brand new and needs to register their first method. Another already has MFA, Windows Hello for Business, FIDO2, etc. and just wants to update…
