AD CS Containment: Follow the Certificate, Not the Password
A password reset does not revoke an AD CS certificate. Trace ESC1 and ESC8 issuance, validate revocation delivery, and contain existing Kerberos access.
-
-
The Link Was Checked Too Late: CVE-2026-81963
CVE-2026-81963 is an exploited Windows Update link-following flaw. Trace the SYSTEM escalation model, safe mechanism lab, detection logic, and patch validation.
-
Create a GPO That Enables SMB Signing
How to create and apply a Group Policy Object that enables SMB signing in Active Directory, with validation steps and operational considerations.
