The Daily Feed
“Freshly brewed IT security, since 2023”
Tools
ADHardenKit: Hardening AD Without Breaking It
LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.
Every AD hardening checklist has the same items on it: require LDAP signing, require SMB signing, restrict NTLM, use Kerberos with AES only. In theory you just turn them on. In practice almost every one of them can break something that used to work, and the error shows up somewhere else. Require LDAP signing and a print server can't find the directory anymore. Enforce SMB signing and a NAS drops out at 3 a.m. Restrict NTLM, and a business application stops with an error message that tells you nothing.
So checklists often get applied halfway, or applied on a Friday and rolled back on Monday.
I wanted a tool that does it in the right …
