To AAD Join or Not … That is the Question
As we all know, the cloud paradigm shifts in IT continue. When I worked in corporate IT - heck, when I started blogging out here - on-prem was really all there was. Active Directory, GPOs and WINS were all the ... continue reading
Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)
On April 24, 2022, a privilege escalation hacking tool, KrbRelayUp, was publicly disclosed on GitHub by security researcher Mor Davidovich. KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn ... continue reading
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Microsoft processes 24 trillion signals every 24 hours, and we have blocked billions of attacks in the last year alone. Microsoft Security tracks more than 35 unique ransomware families and 250 unique threat actors across observed nation-state, ransomware, and criminal ... continue reading
Expansion of FIDO standard and new updates for Microsoft passwordless solutions
Howdy folks, Happy World Password Day! Today, I’m super excited to share some great news with you: Together, with the FIDO Alliance and other major platforms, Microsoft has announced support for the expansion of a common passwordless standard created by ... continue reading
Tarrask malware uses scheduled tasks for defense evasion
As Microsoft continues to track the high-priority state-sponsored threat actor HAFNIUM, new activity has been uncovered that leverages unpatched zero-day vulnerabilities as initial vectors. The Microsoft Detection and Response Team (DART) in collaboration with the Microsoft Threat Intelligence Center (MSTIC) ... continue reading
Troubleshooting Windows containers apps on Azure Kubernetes Service
Alright, it’s time to bring together everything we learned so far in this series. Previously, we looked at the simplest way to collect logs, how to use the Log Monitor tool, and how to make things simpler with Windows Admin ... continue reading
Step-by-step: Creating a new test environment for gMSA on AKS
Microsoft recently announced a new feature that will help customers move existing applications to Azure Kubernetes Service (AKS) – Group Managed Service Accounts (gMSA). In a nutshell, gMSA allows applications that are Active Directory (AD) dependent to be containerized. By ... continue reading
Deep dive: How Azure AD Kerberos works
If you have ever explored the differences between Active Directory (AD DS) and Azure Active Directory (Azure AD), you would have found that Azure Active Directory doesn't support the Kerberos authentication protocol, but Active Directory does. Kerberos is used to ... continue reading
Windows 10 or Windows 11 GPO ADMX – Which one to use for your central store?
Hi community, My name is Helmut Wagensonner. I’m a Customer Engineer at Microsoft and this blog should help you to understand, which Administrative Templates (admx) to choose for your Windows 11 / Windows 10 mixed environment. Remember how it was ... continue reading
Top 20 most visited blog posts for IT Pros in 2021
From our first post on the 17th of September 2018, where Rick Claus introduced Microsoft's "Cloud Ops Advocate" team, we've published nearly 600 articles on this ITOps Talk blog! To end the year, we wanted to highlight some of our ... continue reading
