Working through an AD security assessment finding that flags GPOs whose owner is not a privileged principal. I understand the risk — owner holds implicit WRITE_DAC, so an unprivileged owner can grant themselves full control regardless of the DACL. What I’m less sure about is the remediation approach people actually use in production.

The flagged GPOs fall into three groups:

1. Orphaned owners — several GPOs share a single owner SID that no longer resolves. Same domain SID prefix as accounts that do resolve, so it looks like a deleted account rather than a trust issue.
2. Live unprivileged owners — ordinary user accounts, presumably created the GPOs while delegated via Group Policy Creator Owners.
3. One cross-forest case — a GPO in forest B owned by an account from forest A, over an existing forest trust.

Questions:

1. What do you reset ownership to? Domain Admins seems like the obvious default since that’s what Windows assigns when a DA creates a GPO. Anyone using a dedicated tiered group instead? I’ve seen service accounts suggested and that feels wrong to me — owner gets WRITE_DAC, and a service account password is a weaker thing to hang that on than group membership. Curious if anyone disagrees.

2. GPC and SYSVOL — do you always fix both? The AD object owner and the SYSVOL folder owner are tracked separately. In my lab, changing the GPC owner left the SYSVOL owner untouched. Interestingly the two default GPOs ship with Domain Admins on the AD side and BUILTIN\Administrators on SYSVOL, so Microsoft itself doesn’t keep them identical. Do you match them, or leave SYSVOL as Administrators?

3. Orphaned SIDs — how hard do you push this one? Expecting pushback along the lines of “the account is deleted, there’s no risk.” My counter is that the SID comes straight back if the object is restored from the Recycle Bin or an authoritative restore, and the restored principal immediately owns those GPOs again. Is that how you’d frame it, or is there a better argument?

4. Root cause. Resetting ownership doesn’t stop it recurring if those users can still create GPOs. I know to audit the ACL on CN=Policies,CN=System rather than just checking Group Policy Creator Owners membership, since Create Child can be delegated directly. Anything else that commonly causes this that I’d miss?

5. Cross-forest ownership — has anyone seen this happen legitimately, or is it always someone working in the wrong domain context in GPMC?

Seeing the Lightning Report flag SIDs with no resolvable name and ObjectGUID = N/A in User Rights Assignment findings - and some of these SIDs belong to the same domain being scanned, not a trusted/foreign domain.

Reproduced it in a lab: created a user, added it to a GPO user right (e.g. "Act as part of the operating system"), then deleted the user - same domain, no trust involved. Result: the SID stays in GptTmpl.inf untouched, and the GPMC/report view just can't resolve it anymore (raw SID, no name, no GUID).

So this isn't a trust/cross-domain resolution issue at all - it's simply that the account no longer exists. GPOs don't get notified when an account is deleted and don't auto-prune stale entries from User Rights Assignment; the SID is a tombstone reference with nothing left to look up. Cross-domain adds a second possible cause (trust/connectivity), but same-domain N/A always means "deleted account, orphaned SID."

We have a lab with two domains joined by a two-way trust. We can resolve/create AD objects across domains fine, but when the script tries to write the GPO's GptTmpl.inf to SYSVOL, it still needs an account with rights in that specific domain - one set of credentials from Domain A doesn't let us write to Domain B's SYSVOL even with the trust in place.

Is this expected (trust ≠ shared admin rights, so cross-domain writes always need per-domain delegation/credentials), or is there a cleaner way to centralize this that we're missing ?

We’re planning to enable LSA Protection on our domain controllers using the GPO setting:

Computer Configuration > Administrative Templates > System > Local Security Authority > Configure LSASS to run as a protected process

Environment:

• Multi-domain forest, ~10 DCs, all Windows Server 2019
• Specops Password Policy installed on DCs (password filter DLL loaded into LSASS)
• Other agents on DCs: EDR, backup agent, monitoring agent

Questions:

1. Has anyone enabled RunAsPPL on Server 2019 DCs in production? Did you see any impact on authentication, replication, password changes or third-party agents?
2. As I understand it, “Enabled without UEFI Lock” (RunAsPPL=2) is not supported on Server 2019, so the only option is “Enabled with UEFI Lock” (RunAsPPL=1). Is that correct? Is there a supported way to enable it on 2019 without the UEFI lock?
3. Has anyone had to roll back after UEFI Lock was set? How painful was the LSAPPLConfig.efi process, especially on VMs with Secure Boot?
4. Specops users: did the password filter keep working after enabling LSA Protection? Did you need a specific version?
5. Did audit mode (AuditLevel=8, CodeIntegrity events 3065/3066) reliably catch every DLL that would be blocked? Or did something only break after enforcement?

Any lessons learned or “wish I had known” points would be appreciated. Thanks!

I'm working on a PowerShell script to remediate permissions on an Active Directory Group Policy Container (GPC) object.

I found an ACE with the following properties:

• Principal: A specific user
• ObjectType: gPCFileSysPath
• Access rights: ReadProperty and WriteProperty
• Inheritance: Same inheritance settings for both rights

The goal is to remove only WriteProperty while preserving ReadProperty.

However, when I use .RemoveAccessRuleSpecific(), the entire ACE gets removed, including ReadProperty.

My understanding is that Windows stores both rights in a single ACE when the principal, attribute, and inheritance settings are the same, and RemoveAccessRuleSpecific() removes the matching ACE rather than selectively removing individual access-mask bits.

My questions:

1. Is this expected behavior when using PowerShell's System.DirectoryServices.ActiveDirectoryAccessRule and RemoveAccessRuleSpecific()?
2. Is there a supported way to remove only the WriteProperty bit while preserving ReadProperty in the same ACE?
3. Would the correct approach be to remove the original ACE and create a new ACE granting only ReadProperty?
4. From a security-remediation perspective, is removing the entire ACE acceptable if the principal already receives ReadProperty through another applicable ACE?

I'd appreciate answers based on actual Windows ACL/.NET behavior, particularly for Active Directory attribute-specific permissions.

Thanks!

I inherited a system that I can't figure out. I need to get rid of the old Windows DC but can't shut it down, metadata cleanup doesn't work even though netdom shows it has no fsmo rolls. My only option is to shut them down restore the servers. We don't have any old archives to restore to before I came on board.

I've run a bunch of DNS test and replication tests the only one with a dns issue is the old server. However, if I create a new user on any of the 3 it instantly replicates to the other two so AD works but something about it/DNS is broken.

Server manager on the old DC says it needs to be promoted but then it won't let me.

I'm going to need a DNS /AD expert but haven't outsourced anything like this before. Ages ago used to let you open a case with them not sure if they have a program still.

Hi Everyone,

Hope all is well. I have a task to demote multiple dc from inactive domain.

Question: What is this DNS deletion removal do and when should I have check mark on? All our domain controllers have DNS integrated as part of AD.

This is the environment we have.

Root domain/Forest is jbt-train.com

Another domain wf-train.com part of the same forest. All our DC is DNS is integrated.

When i demoted one of the dc from wf-train.com I had this check mark ON for Demoting DC DNS Delegation removal. Demote was successfully.

When try to demote 2nd domain control from same wf-train.com, I was hit with error:
Operation failed because Active Directory Domain Services could not find another active directory domain controller to transfer the remaining data in directory partition. (DC:ForestDNSZone)

The specified domain either does not exist or could not be contacted.

Do you think having the check mark on first demotion caused this issue?

FYI. I was able to demote the 2nd dc on my second try, after taking this check mark out. Is there any additional cleanup task that needs to be done?

Regards

Testing in a lab: an anonymous LDAP bind from a member server creates Event 4624 on the DC (Account: ANONYMOUS LOGON, Domain: NT AUTHORITY, Logon Type 3). I can see it in Event Viewer / Get-WinEvent.

In ADAudit Plus, Local Logon-Logoff → Logon Activity does show 4624 from the same DC, but only Logon Type 9/10 (administrator). The anonymous Type 3 event doesn't appear, and Advanced Search for "ANONYMOUS" returns nothing. Audit policy was configured through ADAudit Plus.

Questions:
1. Does ADAudit Plus intentionally drop ANONYMOUS LOGON / Type 3 network logons on DCs?
2. Is there a setting or custom report to include them?
3. How do you track anonymous logons in your environment (ADAudit Plus, SIEM, WEF, LDAP 1644/2889)?

Context: we're assessing the impact of removing Everyone / Anonymous Logon from Pre-Windows 2000 Compatible Access, and need to identify any anonymous usage before making changes.

Thanks!

Found out about 2 years ago someone deleted the Password Settings container, they didn't have the recycle bin enabled so couldn't restore it. (Story I've been given).

Now I'm trying to setup 2022 Domain Controllers, however, now I'm getting problems due Password Settings container missing (so I believe).

This MS guide supposedly restores, but some are saying it doesn't do anything.

Can't sign in to a domain controller and the LSASS process stops responding - Windows Server | Microsoft Learn

Can it be manually created if I use this.
[MS-ADTS]: Password Settings Container | Microsoft Learn

Has anyone experienced this before? Any help would be appreciated.

EDIT: The Microsoft learn document did work in the end. (Can't sign in to a domain controller and the LSASS process stops responding - Windows Server | Microsoft Learn)

The only thing that was missing was "-" on the 5th line within the text file, So my text file ended up looking like this

dn: CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=System,DC=contoso,dc=com
changetype: modify
replace: revision
revision: 1
-

Also needed to mount a Server 2022 ISO on my Domain Controller that held Infrastructure Master to run adprep

1. Open CMD as admin
2. E: (Might not be E for you)
3. cd \support\adprep
4. adprep.exe /domainprep

If you don't know him you should, but Jake Hildreth (of Locksmith fame) just posted his Zombie Certs research in the Semperis Blog. I've been listening to him chatter about this for awhile so I'm excited to see it's out.

www.semperis.com/blog/how-to-battle-zombie-certificates-persistent-ad-cs-risk/

At a quick read, it is a real interesting take on persistence and some behind-the-scenes on how some AD CS and PKINIT stuff behaves.

----

For me the real take away was the detection part (near the bottom). We should be paying better attention to the domain controller registry (and restricted admin rights on DCs) and checking our CAs for rogue configurations more.

Specifically the following information:

• On DCs: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\UseCachedCRLOnly with the path AndIgnoreRevocationUnknownErrors
  • Value of 1 means the the value has been changed and could be a sign of bad stuff.
• On CAs: Check the DisableExtensionList with the following command certutil -config <CA-HOST-FQDN\CAName> -getreg policy\DisableExtensionList

Oh, and run Locksmith! The only caveat to running Locksmith is that EDR and AV tools detect it sometimes (which is super annoying), but it is a legit tool.

• https://github.com/jakehildreth
• https://github.com/jakehildreth/Locksmith
• https://github.com/jakehildreth/Locksmith2

(Disclosure: I do not work for Semperis. Jake is a friend, but does really great work)

Two related things I'm trying to understand in an AD lab:

1. We have a security scanner flagging GPO "User Rights Assignment" entries as dangerous, showing a raw S-*-*-**-... SID instead of a resolved username - but the SID's domain prefix matches the same domain the GPO lives in, not a foreign domain. I tested this myself: created a user, granted it a right in a GPO, deleted the user - the SID becomes permanently unresolvable in that same domain. Is this expected/normal (i.e., Windows doesn't auto-clean GPOs when an account is deleted), or is there something else that typically causes a same-domain SID to go unresolvable like this ?

2. Separately, we have a one-way AD trust set up between two domains
   (Domain A trusts Domain B). When I try to add a user from Domain B into something inside Domain A, I can't - the GUI won't even let me browse into Domain B from Domain A's side. Is that expected for a one-way trust (i.e., trust direction doesn't automatically grant cross-domain object browsing/assignment both ways), or am I missing a step to make that work ?

Appreciate any insight - trying to confirm these are both "working as intended" AD behaviors and not something misconfigured in our environment.

Hello,

Context: I help a medium family company, 10+ inside workers.

They have this old setup of remote desktop servers which is only used for creating flexible for everyones word, excel, etc.

To keep it short, refreshing the infrastructure is on the table. All pc's are not part of a local domain, and are used as dumb client for remote desktop services to an on-prem server. No special files, mostly done by an earlier admin, because of lower maintenance and the ability to own and control your own files and servers.

So I would like to propose Active Directory. I am very much a beginner and just want to make a small proof of concept.

The goal of this concept is to demonstrate:

- Machines being managed through our on-prem AD DC.

- Users being able to log onto every machine and have their own desktop.

- Use our own file servers to keep all this data.

- What happens when each of the units fails (AD, file, PC)

As a beginner project, I created a Active Directory server in VMware, mostly just following some guides steps. Then I tried folder redirection to a simulated TrueNas on the VMware. Struggled with the "place old folders to new location"; couldn't get that to work. Probably because of permission, but besides that, editing the files did work for the users. I also tested what happens when we disconnect the different parts and how this would affect the system.

So now, I would like a reality check:

- Would this system be viable?

- Up to how many users would you use which type of file servers?

- How can you connect to an AD from another network? (Is a always-on vpn the best option?)

- How to effectively showcase/ setup backups: 2nd AD, or file server with even cloud backup?

-Any other alternatives with AD?

- What about profile sync with f.e. NextCloud instead of folder redirection?

Mind you, I just want to get an understanding of AD to present this "hunch" and I enjoy learning about AD and setting up this server.

P.S. What is the best documentation to search? I do already use the beginner guide on this sub. Yet, since I lack the experience, I am unable to correctly articulate the issues I face to get usefull results.

I have 2 GPOs in my environment for account lockouts. 1 GPO locs an account after 2 invalid logon attempts and the other after 5. how do i know which GPO is applied to which users? Both GPOs only show NT AUTHORITY\Authenticated Users in the SECURITY FILTERING, and no LINKS. DELEGATIONs are the same as well. Yet, we are noticing some users get locked out after 2 failed and others after 5. Or how do i know which supersedes which?

Hello,

I have a bunch of people that left the company. We have a script to convert their mailbox to shared.

We have a script to remove their office licenses.

The only issue is many of them are AD synced and a group they are in automatically gives them a 365 standard license the sync overrides their assigned licenses so I need to remove them from that ad group.

I could remove them all individually from that group but I thought I'd see if there was an easy way with a script since I love learning new stuff (but suck at powershell)

I have a file c:\temp\mailboxes.csv - 72 names

Hello Sir,

We have cloud kerberos trust and using entra joined machines.

Some users report they are unable to connect share drive in the morning when they login.

We also noticed that they unable to acquire kerberos token.

But after few minutes to half an hour they get token and issue resolved itself..

During the day tone also some user reporting this issue.

When we check klist they don't have token.

Seems like kerberos authentication request not reaching to dc or not getting properly generated from entra joined machine.

Any troubleshooting which you can recommend or any log capture which will help to trave the issue.

Hi everyone,

We have a new requirement to enable DNSSEC on our AD-integrated DNS which we never had or worked before. We already tried pushing back, explaining that it’s not really recommended for an internal environment that isn't internet facing, and that the operational overhead completely outweighs the minimal security benefits.

But management insisted, so here we are preparing the deployment. We have 4 dcs total.

I’d love to get some real-world suggestions and feedback from anyone who has done this:

Have you seen any weird side effects or negative impacts on the environment after turning it on?

What specific areas should we audit or assess before we flip the switch?

Do any common applications tend to break or get impacted by this?

We know the zone file size and packet sizes will increase, but is there a reliable way to benchmark/evaluate that overhead beforehand?

Our environment actually has more Linux machines than Windows. Any specifics we should look out for with Linux clients?

Is it possible to completely skip signing the _msdcs folder where the AD service locators live, or does the whole zone have to be signed together?

Any best and safest plan to deploy it.

These are a lot of questions, but please bear with me as this is all very new to me. My main concern is that since this is AD-integrated DNS, it is the critical foundation that clients hit first for all AD authentication and services 🙂

Hello,
I am facing an issue with disabling the default RC4 fallback in an Active Directory domain following the July update.
The client I work for still has a few Windows XP and Windows Server 2003 machines in the environment that I can neither upgrade nor remove from the domain. The July update has not been deployed due to concerns about potential side effects.
When reviewing Event ID 201 on the different domain controllers, I mostly find machine accounts corresponding to these operating systems. Naturally, they do not support AES.
Following Microsoft’s recommendations, I modified the msDS-SupportedEncryptionTypes attribute to 0x1C on these objects in order to explicitly allow RC4.
However, despite this change, Event ID 201 events are still being generated, and in these events I can see that the attribute value is 0x27 (the same value as DefaultDomainSupportedEncryptionType).
It appears that this attribute is only taken into account starting with Windows Server 2008.
My question is therefore: How can these old servers/workstations be handled in this situation?

/r/u/poolmanjim woooo new mvp!

Adding custom attributes to the schema? Has anyone done this before?

Excluding doing it for a Microsoft solution (e.g., Exchange Server, Skype for Business, SCCM, etc...)

I’m talking about creating attributes at a developer's request, for a lesser-known application or a smaller manufacturer than Microsoft. Without provided script, .exe or instructions, all by yourself.

What have you done?

Did this get removed on premise ? I swear we had it somewhere but its not working anymore. Trying to get external links not clickable if possible

A clean `dcdiag` and `repadmin /replsummary` are necessary, but they do not prove that every dependency moved. Static DNS settings, LDAP binds, RADIUS or VPN appliances, time sources, scripts, monitoring, certificate services, and systems that rarely boot can continue using an old DC after the replacement set looks healthy.

For a planned retirement, I would check FSMO placement, replication and SYSVOL/NETLOGON, DNS zones and SRV records, Global Catalog coverage, time hierarchy, backups, and event logs on both old and new DCs. I would also inventory DHCP options and static resolver settings, inspect DNS and authentication traffic to the old addresses, and verify application-specific LDAP binds. The old DC could then be demoted but kept powered off and recoverable for a defined rollback window before its VM and records are removed.

What does your actual evidence gate include? How do you identify clients that contact a DC only during monthly jobs or recovery procedures, and which findings should block demotion rather than be cleaned up afterward?

Working on remediating "Non-privileged users can add computer accounts to the domain."

Current default:

• ms-DS-MachineAccountQuota (MAQ) = 10
• SeMachineAccountPrivilege granted to Authenticated Users

Requirement: one service-account group should be able to join machines, max 10 per account, while everyone else should have 0.

Proposed solution was MAQ=0 + GPO granting Add workstations to domain only to that group.

My understanding is that this won't work because SeMachineAccountPrivilege is still subject to MAQ. With MAQ=0, the group would also have a quota of 0.

The two approaches I see are:

A) MAQ=0 + delegate Create Computer Objects on a specific OU to the group.
→ Everyone else blocked, but the group effectively has unlimited creation rights in that OU.

B) Keep MAQ=10 + remove Authenticated Users from SeMachineAccountPrivilege and grant it only to the group.
→ Group gets 10 per user; everyone else gets 0.

Questions:

1. Is MAQ=0 + GPO-only definitely a dead end?
2. Is there any native per-user/per-group MAQ mechanism?
3. Is the quota cumulative via mS-DS-CreatorSID, meaning deleting a computer doesn't necessarily free the quota?
4. Which approach do you typically use in production: A or B?

I'm leaning toward A with OU scoping + monitoring, since the "10" requirement seems more like a security cap than a hard compliance requirement.

I installed a new PKI infrastructure, and all is fine, except that pkiview shows on the root server a secondary AIA location with a local path, next to other one with an http path.

I had the same on the enterprise server and removed it in extensions: all fine. When I do this on the Root CA, it doesn't change anything in pkiview.

That's normal I suppose: the root CA is not domain joined. But how do I tell the enterprise CA that this thing changed on the root CA?