Kai Fjørtoft

Lead Architect, Identity & Access Management at Intility. Tweets are my own.

[adam @molotov_moktail]

My greatest fear is that I am this delusional about something in my life and nobody loves me enough to set me straight

[Sean Metcalf @PyroTek3]

Windows Server 2025 Active Directory Updates Thread!

Server 2025 is in preview, so I took a look at updated features, specifically Active Directory, with a focus on security features.

Article:
What's new in Windows Server 2025 (preview)
https://t.co/MiE8Mi928K

#AD2025🧵

[Matt Zorich @reprise_99]

This is your yearly reminder to go and deploy Microsoft Entra ID Password Protection to improve your password complexity in on-premises Active Directory if you're licensed for it. Over the years, I have collected a list of misconceptions about how this product works, see below:

[Jim Sykora @ TROOPERS @JimSycurity]

@lkarlslund Yep, by default, any authenticated user can ready any GPO. This is by design and it's only when folks mess with GPO delegation (and usually security filtering) that it gets messed up.

How & Why does this happen?

GPOs are complex.
1/ 🧵

[Steve Lee @Steve_MSFT]

#PowerShell 7.4 GA is out! Read more about it here: https://t.co/QMb9QINGaO. Thanks to the team and community for making this possible!

[Jen Gentleman 🌺 @JenMsft]

For those that need it, there's an option starting to roll out to Dev Channel so you can add seconds to the clock in the taskbar ⌚

https://t.co/4p0eJuFrSn

[Windows Update @WindowsUpdate]

Microsoft is releasing Out-of-band (OOB) updates to address a known issue which might cause sign in failures or other Kerberos authentication issues. https://t.co/3til5aSjFR

[Microsoft Exchange @MSFTExchange]

15 DaysToGo – We strongly encourage customers to move away from using Basic authentication with SMTP AUTH when possible. Other options for sending authenticated mail include using alternative protocols, such as the Microsoft Graph API. https://t.co/Ed6XXawDvA

[Windows Update @WindowsUpdate]

An out-of-band update has been released to address issues related to VPN connectivity, Windows Server Domain Controllers restarting, Virtual Machine start failures, and ReFS-formatted removeable media failing. https://t.co/mx9Le4ZXcV

[Jeff Hicks @JeffHicks]

QotD -> "Start with what is right rather than what is acceptable."

[April C Wright @aprilwright]

690k people fell for this shit
And your company is worried about APT
#socialengineering #osint #opsec

[Joe Stocker @ITguySoCal]

(1/x) M365 changes to be aware of
1) End-users can purchase PowerBI on their on personal credit cards to bypass IT
2) End-users can purchase Windows 365 Cloud PC VMs on their own personal credit cards to bypass IT
3) End-users can create security groups (even if you disabled it)

[Abhijeet Sinha @abhijeetksinha_]

2 new Azure AD roles are now available - Auth Policy Admin and Domain Name Admin. Now you do not need Global Admin to manage tenant-wide MFA settings or domain names.

@StuartKwan, @TurnOnMfa

https://t.co/dl2syx0WNE

https://t.co/adZgUGgcfD

[Richard @Veantur]

I cannot understand why I need a Global Admin to create an Org-wide team in @MicrosoftTeams? The last user I want to license for any Office 365 app, is a global admin. It's like saying your Domain Admin need Outlook access and a mailbox to create a distribution Group...

[Scott Schnoll @schnoll]

#collabtalk
Q1: It flew under the radar, but one of the best announcements at #MSIgnite was cross-tenant mailbox migrations - https://t.co/FiYrY0m1Ay

We're spinning up preview programs for cross-tenant SPO/ODB migration and SMTP domain sharing, and cross-tenant people search.

[Steve Syfuhs @SteveSyfuhs]

It's Monday evening, the weather is great, and we're in the middle of a pandemic. Lets talk Kerberos! Or rather, it's little known nephew FAST and Armoring.