Posts

Microsoft announced Device Association for Windows Autopilot Device Preparation on August 27, 2026. It is one of those features that sounds incremental until you understand what problem it actually solves. The problem it solves Traditional Autopilot ties the provisioning experience to the user signing in. That works well in most scenarios, but it breaks down when you need the device — not the user — to determine which policy and experience gets applied. ...

On August 20, 2026, Microsoft disclosed CVE-2026-69836 — a remote code execution vulnerability in Microsoft Entra ID with a CVSS score of 10.0. The maximum possible. Then it got complicated. What the vulnerability is The root cause is CWE-502: deserialization of untrusted data. Entra ID was processing attacker-supplied input and converting it into active object structures without sufficient validation. The CVSS vector is about as bad as it gets: Network-reachable — no physical or local access needed No authentication required No user interaction — fully automated exploitation possible Low attack complexity High impact on confidentiality, integrity, and availability An attacker who successfully exploited this could execute arbitrary code within Microsoft’s Entra ID infrastructure — meaning potential access to token issuance logic, service principal configurations, and federation trusts. ...

Found this while browsing: EntraFalcon by Compass Security. A lightweight PowerShell tool that scans your Microsoft Entra ID tenant and generates an interactive HTML report covering privileged objects and role assignments, risky or misconfigured service principals, guest user exposure, Conditional Access gaps, and general identity posture findings. No extra app registration needed — it uses your existing authenticated session via Microsoft Graph PowerShell. That makes it quick to run in environments where creating new app registrations requires approval. ...

What it does Extracts BitLocker recovery keys from all locally protected volumes and saves them to a timestamped file at C:\Temp\BitLockerKeys_YYYYMMDD_HHMMSS.txt. Useful for: Auditing BitLocker key availability before a device is reprovisioned Manual verification when keys have not escrowed correctly to Entra ID / Intune Local key recovery in offline or unmanaged environments Requirements Windows 10/11 or Windows Server with BitLocker module available PowerShell run as Administrator BitLocker active on at least one volume Source Script available on GitHub: ...

Stumbled across this while browsing: WOFA — Windows Organized Feed for Admins. It is essentially a clean, machine-readable aggregation of Windows security update data sourced from MSRC and CISA KEV. What it gives you at a glance: CVE count per OS version (Windows 10, 11, Server 2016 through 2025) Actively exploited CVEs flagged separately Latest Patch Tuesday build versions per release CISA KEV (Known Exploited Vulnerabilities) flags per version JSON feed and RSS available for automation As of today (August 2026), it is tracking 11,711 CVEs across 13 OS versions, with 153 actively exploited. Windows Server 2025 has CVE-2026-56155 flagged as a KEV — worth checking if your Server 2025 fleet has the July 2026 update applied. ...

Free template. This policy is provided as a starting point for IT and security teams. Adapt it to your organisation’s needs, jurisdiction, and tooling. Attribution appreciated but not required. Document Information Reference POL-SEC-001 Version 1.0 Issue Date June 2026 Scope All employees and contractors Classification Internal Use Owner IT Department / Cybersecurity Next Review June 2027 1. Purpose This policy establishes the rules for the acceptable use of external online tools and third-party services when handling corporate documents and files within the work environment. ...

Free template. This policy is provided as a starting point for IT and security teams. Adapt it to your organisation’s needs, jurisdiction, and tooling. Attribution appreciated but not required. Document Information Reference POL-SEC-002 Version 1.0 Issue Date August 2026 Scope All employees and contractors Classification Internal Use Owner IT Department / Cybersecurity Next Review August 2027 1. Purpose This policy defines the organisation’s position on the use of Brave browser on corporate endpoints and establishes the rules for browser software management across the work environment. ...

Free template. This policy is provided as a starting point for IT and security teams. Adapt it to your organisation’s needs, jurisdiction, and tooling. Attribution appreciated but not required. Document Information Reference POL-SEC-003 Version 1.0 Issue Date August 2026 Scope All employees and contractors Classification Internal Use Owner IT Department / Cybersecurity Next Review August 2027 1. Purpose This policy defines the rules for the use of Google Chrome on corporate endpoints, specifically addressing the risk of employees signing into Chrome with personal Google accounts and storing corporate credentials, financial data, and sensitive information within those personal accounts. ...

Overview Certighost is an Active Directory Certificate Services vulnerability disclosed on July 24, 2026 by researchers H0j3n and aniqfakhrul. It allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise, including DCSync and krbtgt extraction. Patched in the July 2026 Patch Tuesday as CVE-2026-54121. If your Enterprise CA has not been updated, patch now. CVE: CVE-2026-54121 Researchers: H0j3n, aniqfakhrul Patched: July 14, 2026 Disclosed: July 24, 2026 Impact: Full domain compromise from low-privileged user Affected component: Active Directory Certificate Services - Enterprise CA Background AD CS is Microsoft’s PKI implementation. It issues X.509 certificates used for authentication. A client requests a certificate from an Enterprise CA, then presents it to the KDC via PKINIT to obtain a Kerberos TGT. ...

Symptom When attempting to uninstall FortiClient via Add/Remove Programs or an MDM platform, the uninstaller throws an error similar to: “The network resource is unavailable” or “Windows Installer cannot find the original package” This happens because the Windows Installer is looking for the original FortiClient.msi in a path that no longer exists. Option 1 — Force Uninstall via GUID Step 1 — Get the product GUID Open PowerShell as Administrator: ...

1. The Reality of Active Directory Every AD environment accumulates history. Migrations, acquisitions, staff turnover, legacy applications — they all leave traces. The result is almost always the same: enabled accounts that nobody remembers, service accounts with passwords set years ago, and exceptions that were “temporary” and never cleaned up. This is exactly the low-hanging fruit attackers look for first. Why spend time trying to break into a well-protected account with MFA when there is a 20-year-old enabled account sitting next to it — or a service account with a 5-year-old password and access to something critical? ...

1. The Problem — RMM Tools as Ransomware Infrastructure Remote Monitoring and Management (RMM) tools like AnyDesk are legitimate software used by IT teams worldwide. That legitimacy is exactly why ransomware groups abuse them — they blend into normal enterprise traffic and are often missed by security controls focused on known malware signatures. According to the Ransomware Tool Matrix, 32 ransomware groups use AnyDesk for persistence — making it the most abused tool in the RMM category. The technique is simple, reliable, and requires no custom malware. ...

TL;DR September 1, 2026 — Passkeys become default. Users enabled for SMS/Voice are auto-enabled for passkeys and prompted to register. February 1, 2027 — Microsoft-provided SMS and Voice MFA fully retired. No opt-out. Users with no other MFA method will be blocked until they register a passkey. Action required now — Audit who in your tenant uses SMS/Voice and start migrating them to passkeys. 1. What Are Passkeys? Passkeys are phishing-resistant, passwordless credentials that replace both passwords and weak MFA methods like SMS OTP. Instead of a shared secret, they use a cryptographic key pair: ...

1. Overview CVE-2026-26128 is a Kerberos authentication reflection bypass discovered by Synacktiv that completely bypasses the patch introduced for CVE-2025-33073. It allows an attacker to obtain SYSTEM-level access on most Windows builds. CVE CVE-2026-26128 Discovered by Synacktiv Patched March 2026 Patch Tuesday Related CVE-2025-33073, CVE-2025-58726, CVE-2026-24294 Impact Local Privilege Escalation → SYSTEM Affected All Windows versions except Windows 11 24H2 (default config) 2. Background The broader context of this vulnerability sits within a chain of authentication reflection research: ...

1. What is NTLM Coercion? NTLM coercion is an attack technique where an adversary with network access forces a Windows machine — typically a Domain Controller — to authenticate against an attacker-controlled host. That authentication travels in NTLM format and can be captured and relayed (NTLM relay) to access other domain resources, or cracked offline. The classic scenario: The attacker runs a coercion tool (Coercer, PetitPotam, PrinterBug) against a DC. The DC automatically attempts to authenticate against the attacker’s IP. The attacker captures the NTLMv2 hash and relays or cracks it. Depending on privileges, this can lead to full domain compromise. 2. Common Coercion Vectors Vector Protocol Notes Print Spooler (MS-RPRN) RPC / SMB Most historically exploited EFS (MS-EFSRPC) RPC Requires EFS to be active DFS (MS-DFSNM) RPC / SMB Common on DCs with DFS enabled WebClient (WebDAV) HTTP Requires the service to be running 3. What Changed in Windows Server 2025 Windows Server 2025 (and Server 2022 23H2 onwards) introduced significant changes that reduce the default attack surface: ...

1. Summary A publicly disclosed technique, referred to as “Onelogon”, demonstrates a bypass of the Zerologon (CVE-2020-1472) remediation on Active Directory Domain Controllers. The bypass does not target a new flaw in the Netlogon Remote Protocol (MS-NRPC) itself — it targets legacy compatibility exceptions that administrators may have left enabled after the original Zerologon patch cycle (August 2020 – February 2021). Where these exceptions are present and misconfigured, an attacker can re-establish an unauthenticated or weakly authenticated Netlogon secure channel, impersonate a computer account, and in some documented cases escalate to full domain compromise (credential dumping via DCSync-style replication, extraction of NTDS.dit). ...

Síntoma El usuario abre FortiClient, introduce sus credenciales y no consigue conectar a la VPN corporativa. El error más común es: “Unable to connect to server” Troubleshooting 1. Verificar configuración del gateway Es la causa más frecuente. En FortiClient ir a Edit connection y confirmar que el nombre del servidor y el puerto están correctos. El puerto casi siempre es 443. 2. Verificar conexión a internet Confirmar que el equipo tiene acceso a red antes de continuar. ...