Project
Microsoft's directory service for Windows networks, managing accounts, groups, and policies, and handling authentication via domain controllers.
Intcube CTO David Fuhr says 27 municipalities hardened Windows Server and Active Directory together over 12 weeks, after the firm planned for 10 to 15. He says what one- and two-admin teams lack is motivation, and that a group schedule with start and end measurements supplies it.
Reality
A fast SOC cut off the intrusion in minutes. The red team still reached the domain controller and the control network, because every control that failed afterwards was a permission somebody granted and nobody had reviewed.
Perspective Coverage
3 publishersReality
Fortra patched CVE-2026-79901, a CVSS 9.9 BoKS keytab flaw that lets any authenticated Active Directory user rebuild Unix service-account passwords offline. Patching replaces the generator, but passwords it already minted stay predictable until rotated.
Reality
According to Microsoft Threat Intelligence, every stage after the consent prompt runs on software the environment already trusts, which puts the choke point on Teams federation policy and remote-support install rights.
Reality
Kaspersky's responders found no encrypted files and no malware on disk across the Windows estate of a Middle East manufacturer in April 2026. The impact arrived through one Group Policy Object linked at the domain root.
Reality
Australia's ASD ACSC wrote the guidance with CISA, the NSA, Canada's CCCS and the British and New Zealand cyber centres, pairing the 17 most common Active Directory compromise techniques with mitigations.
Reality
Microsoft's accounts posture assessment lists every Active Directory user account with no logon in the past 90 days and refreshes the score every 24 hours. Service accounts are excluded from that list.
Reality
Microsoft's September 17 post pins three current campaigns on excessive permissions, open authentication flows and sanctioned admin tooling, and says the change AI brought is the speed at which those combine.
Reality
The actor compromised a cloud environment first and built the framework inside it. The scanning and address rotation ran with little human involvement. The credentials collected belonged to other companies.
Reality
Microsoft says it is investigating reports that the update leaves domain-joined Windows 11 25H2 machines rejecting valid credentials after reboot, and administrators are pointing at Machine Identity Isolation in enforcement mode.
Reality
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
Reality
FreeIPA 4.13.3 lists seven security issues. The one that sets upgrade order needs no Active Directory at all, just LDAP write privileges inside the IPA domain, which is enough to impersonate a privileged service principal.
Reality
Pen Test Partners demoed a passback attack on an unauthenticated printer interface: change the LDAP host, force a lookup, and the device sends its own bind password in cleartext. Every mitigation listed is configuration.
Reality
Stratus Security's CTO says the scanner his firm wrote for its own engagements pulled them out of one client's backlog, and the previous tester missed them because ticket comments are not in anyone's standard methodology.
Reality
Essential entities face up to EUR 10 million or 2 percent of global turnover, and management bodies can be barred from executive roles, which makes access control the one Article 21 requirement a team can finish and evidence inside a month.
Reality
A publication ban lifted this week on the case Profero opened in April, when its responders pulled a 101MB RAT that had reportedly reached dozens of Israeli companies through a security vendor's own endpoint component.
Reality
Unit 42 traced two campaigns that open with a Teams chat and an immediate voice call from an external tenant, which puts the question of who can ring your staff in the same bucket as who can sign in as them.
Reality
The chain Microsoft describes starts with a fake Cloudflare check on a compromised page and ends in a WebSocket tunnel into the LAN. Every gate that stops it sits on the endpoint or the egress path.
Reality
Microsoft Threat Intelligence says this ClickFix variant ends in Active Directory reconnaissance and a reverse-tunnel implant, giving a single tricked employee a route into the network.
Reality
A July 2026 joint alert on North Korean IT workers and the 2025 M&S breach sit at opposite ends of the identity lifecycle: hiring and recovery. Neither required breaking authentication.
Reality