Post

The new local admin account policy is a welcome improvement, just like the hardened LDAP signing requirements enabled by default

Locating domain controllers is a tricky thing, but I had no idea it could be using NetBIOS under the hood. There's now a policy to control NetBIOS usage in DCLocator, and it's hardened by default to disable NetBIOS usage

29/4/25, 5:44 pm0 reposts7 likes

Mary Branscombe

@marypcbuk.bsky.social

so damn many things are still NetBIOS that Steve hasn't managed to burn out yet

I'm happy NetBIOS domain controller detection is getting disabled for a different reason: it makes cross-platform domain controller detection easier to implement in a way that matches the built-in Windows DCLocator behavior

There are a few Windows LAPS improvements, particularly to make it easier to communicate temporary passwords and type them without making mistakes. This appears to imply a common pain point with LAPS is that even if you get the password, you must manually type it in somewhere

It's always good to go over a list of common Active Directory security mistakes, like the famous ms-DS-MachineAccountQuota default value which I just keep hearing about but never really understood what it did.

About NTLM deprecation, there's nothing new that hadn't been announced previously. I don't know if it'll be discussed in another presentation as it's unclear when and how we'll see the IAKerb and local KDC extensions released

@syfuhs.net what's up with the NTLM deprecation? Is there a presentation from the Windows Server Summit that goes deeper into it?