Chapter 2: Securing hybrid Active Directory accounts
Remember what I said in the welcome? Hackers don't break in, they log in. This chapter is all about the accounts they log in with.
Labs
| Lab | Attack | Control |
|---|---|---|
| 2.1 Fine-grained password policy | Password spray against a high-value team | Fine-grained password policy (PSO) |
| 2.2 Microsoft Entra Password Protection | Wordlist built from company words | Microsoft Entra Password Protection |
| 2.3 The Protected Users group | Credential theft when a Domain Admin signs in | Protected Users group |
| 2.4 Read-only domain controller (RODC) | Stolen branch-office domain controller | RODC + Password Replication Policy |
| 2.5 Authentication policies and silos | Stolen admin password used on a sensitive server | Authentication policies and silos |