Trimarc integration into TrustedSec: Sean Metcalf outlines recurring AD and Entra ID weaknesses 18 months on
Sean Metcalf of TrustedSec reviews the roughly 18 months since Trimarc merged into TrustedSec. The post is a business and service update rather than a threat report. The Active Directory Security Assessment (ADSA) and the Microsoft Cloud Security Assessment (MCSA, now the M365 assessment) continue under the TrustedSec brand. Metcalf now works as Identity Security Architect, focusing on research and a new service offering that checks whether organizations are prepared to deploy Microsoft Copilot. He also lists the Active Directory and Entra ID misconfigurations his team still finds most often.
Detalhes técnicos
Recurring Active Directory issues named in the article:
- Admin and service accounts with old passwords.
- A KRBTGT account with an old password.
- The default domain administrator account having a Kerberos SPN.
- Accounts in privileged groups that do not belong there.
- Group Policy permission issues.
- Improper Kerberos delegation.
- Active Directory Certificate Services (AD CS) security issues; the author recommends running Locksmith2.
Recurring Entra ID issues named in the article:
- PIM not fully used for eligible rather than active role members.
- Members in Tier 0 roles who do not belong.
- Admins not required to use MFA at every logon.
- Teams, SharePoint and OneDrive sharing settings.
Remediação
The article implies remediation by fixing the issues listed above:
- Rotate old admin, service and KRBTGT passwords.
- Remove unnecessary privileged group and Tier 0 role members.
- Use PIM with eligible assignments.
- Require MFA for admins at every logon.
- Review AD CS configuration with Locksmith2.
- Review sharing settings.
TrustedSec also offers remediation services.
Linha do tempo
-
Trimarc integration into TrustedSec: Sean Metcalf outlines recurring AD and Entra ID weaknesses 18 months on
ler a análise desta fonte ocultar
Sean Metcalf of TrustedSec reviews the roughly 18 months since Trimarc merged into TrustedSec. The post is a business and service update rather than a threat report. The Active Directory Security Assessment (ADSA) and the Microsoft Cloud Security Assessment (MCSA, now the M365 assessment) continue under the TrustedSec brand. Metcalf now works as Identity Security Architect, focusing on research and a new service offering that checks whether organizations are prepared to deploy Microsoft Copilot. He also lists the Active Directory and Entra ID misconfigurations his team still finds most often.
Technical Details
Recurring Active Directory issues named in the article:
- Admin and service accounts with old passwords.
- A KRBTGT account with an old password.
- The default domain administrator account having a Kerberos SPN.
- Accounts in privileged groups that do not belong there.
- Group Policy permission issues.
- Improper Kerberos delegation.
- Active Directory Certificate Services (AD CS) security issues; the author recommends running Locksmith2.
Recurring Entra ID issues named in the article:
- PIM not fully used for eligible rather than active role members.
- Members in Tier 0 roles who do not belong.
- Admins not required to use MFA at every logon.
- Teams, SharePoint and OneDrive sharing settings.
Remediation
The article implies remediation by fixing the issues listed above:
- Rotate old admin, service and KRBTGT passwords.
- Remove unnecessary privileged group and Tier 0 role members.
- Use PIM with eligible assignments.
- Require MFA for admins at every logon.
- Review AD CS configuration with Locksmith2.
- Review sharing settings.
TrustedSec also offers remediation services.