Directory Insights in 10 minutes: Password Not Required - The Hidden Risk

Directory Insights in 10 minutes: Password Not Required - The Hidden Risk

Episode Overview

In this episode of Directory Insights in 10 Minutes, we’re exposing a dangerous yet overlooked Active Directory misconfiguration—PasswordNotRequired.

Most AD admins assume password policies protect all accounts. They don’t. This attribute allows accounts to override domain password policies, making them vulnerable to blank passwords and easy takeovers.

What is the "Password Not Required" Attribute?

  • A hidden AD attribute that allows accounts to exist without a password.
  • Bypasses domain password policies, including length, complexity, and history requirements.
  • Affects privileged accounts, service accounts, trust accounts, and regular users.

Why is This a Risk?

  • Attackers (or insiders) can reset the password to blank and gain instant access.
  • Any account with this misconfiguration is an easy target for privilege escalation.
  • Most AD admins don’t even know this setting exists—but attackers do.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(18)

Hybrid Identity is Broken: Rethinking AD, Entra ID & the Bridge in Between

Hybrid Identity is Broken: Rethinking AD, Entra ID & the Bridge in Between

Welcome to another episode of Guardians of the Directory, where we pull back the curtain on the real-world challenges in securing and managing Active Directory and hybrid identity environments. In thi...

21 Aug 202541min

Blueprinting Zero Trust From: Strategy to Execution with Jerry Chapman

Blueprinting Zero Trust From: Strategy to Execution with Jerry Chapman

Welcome back to Guardians of the Directory! In this episode, Craig Birch is joined once again by Zero Trust expert Jerry Chapman for a deep dive into the Zero Trust Blueprint—a practical model to help...

26 Jun 202530min

AdminSDHolder in Active Directory: Hidden Risks and Persistent Threats

AdminSDHolder in Active Directory: Hidden Risks and Persistent Threats

In this episode of Directory Insights in 10 Minutes, Craig Birch breaks down the often-misunderstood AdminSDHolder object in Active Directory and why it's a high-value target for attackers. Learn how ...

1 Mai 20256min

Admin Accounts with SPNs — Hidden Risk Behind Kerberoasting

Admin Accounts with SPNs — Hidden Risk Behind Kerberoasting

🔍 Admin Accounts with SPNs — Hidden Risk Behind Kerberoasting | Directory Insights in 10 MinutesIn this episode, Craig Birch breaks down a major Active Directory security blind spot: Kerberoasting vi...

15 Apr 20255min

Kerberos Pre-Auth: Hidden AD Risk

Kerberos Pre-Auth: Hidden AD Risk

In this episode of Directory Insights in 10 Minutes, Craig Birch breaks down one of the most overlooked Active Directory misconfigurations: the "Do not require Kerberos pre-authentication" setting.🔍 ...

9 Apr 20257min

Directory Insights in 10 Minutes: Remediating DES Encryption in Active Directory

Directory Insights in 10 Minutes: Remediating DES Encryption in Active Directory

Welcome to another episode of Directory Insights in 10 Minutes, powered by Guardians of the Directory. In this quick-hitting session, host Craig Birch walks through the process of identifying and reme...

1 Apr 20254min

Directory Insights in 10 Minutes Reversible Password Encryption – A Hidden Risk

Directory Insights in 10 Minutes Reversible Password Encryption – A Hidden Risk

Summary:In this episode of Directory Insights in 10 Minutes, we dive into a critical yet often overlooked Active Directory misconfiguration—Allowing Password Storage with Reversible Encryption.This se...

18 Mar 20254min

Populært innen Teknologi

lydartikler-fra-aftenposten
teknisk-sett
tomprat-med-gunnar-tjomlid
rss-ki-praten
shifter
elektropodden
rss-ai-forklart
rss-alt-som-gar-pa-strom
pedagogisk-intelligens
nasjonal-sikkerhetsmyndighet-nsm
smart-forklart
rss-polypod
rss-fish-ships
fornybaren
rss-bouvet-bobler
rss-kunstig-intelligens-med-elisabeth-maren-og-morten
hans-petter-og-co
rss-fisketimen
teknologi-og-mennesker
rss-digitaliseringspadden