Masterclass AD Security Adv. SADDD-L2

Masterclass Advanced Active Directory Security (AD4) - SADDD-L2 - Revision of best practices from the MasterClass Securing Active Directory FastPass - LAPS for domain controllers - NOT possible, but it works! We show you how to secure the DSRM password in a rolling and encrypted way, including the password history!! - DSRM user: From emergency admin to domain admin: What can trigger a simple registry hack and what you really need to do to stop it... - Unified Write Filter - A little-known solution for Windows 10/11 clients: Kiosk Mode for Professionals and Privileged Admin Workstations - PAWs with "Sheriff cards" - Tenant capable Active Directory - How you can filter out organisational units (OUs) for admins that shouldn't be able to see them: Object List - No one dares - We show you how to do it and how the professionals do it, too! - MBAM & BitLocker: Bitlocker on Steroids - Microsoft BitLocker Administration and Monitoring 2.5 - Even when extended support ends in 2026 - MBAM is really worth looking at! - Hiding TIER-0-Admins via PowerShell: What I can't see, I can't touch - Hiding your crown jewels - Bloodhound: Sniffing out privilege: Installing and using Bloodhound - Hunt by privilege! - PAM feature with Server 2016: JEA & JIT, Just enough Administration with JustInTime; with Server 2016 came the little-known PAM feature: Privileged access management for users: Time-to-Live for admins that manage tickets - When you need less: Authentication Silos & Authentication Policies, who, how, where and when ... - Set up, maintain and administer tier models in detail, tier and ESAE model in practice - Windows Defender for Identity - Lithnet Active Directory Password Protection - DNS-SEC - Highly-secure DNS operation - Trust Anchors - DNS over https (DoH) - SMB encryption AES 256, operate SMB highly securely - UNC hardening - From DNS Admin to DomainAdmin: from small to big - LocalAccountTokenFilterPolicy - LDAP-S, signing and channel binding, what it's all about and why LDAP-S is not LDAP signing ... LDAP-S and SSL V2, V3 and TLS V1 - What now - LDAP-S in detail - "Notes from the field" - our experience from 10 years of hardening Active Directory (LAPS, Protected Users, KRBTGT Reset, PingCastle) - Any questions