All Episodes

May 15, 2025 4 mins

Directory Insights in 10 Minutes – Episode 1

Welcome to the very first episode of Directory Insights in 10 Minutes, brought to you by Guardians of the Directory.
This series cuts through the noise — no fluff, no filler — just real-world, actionable insights for securing Active Directory and Entra ID.

In this kickoff episode, Craig Birch reveals the #1 most overlooked AD misconfiguration — one that ships insecure by default, is present in nearly every environment, and continues to provide attackers with a clear path to domain dominance.

🔍 What You’ll Learn:

• Why the built-in Administrator account (RID 500) is vulnerable out of the box
• How attackers abuse Kerberos delegation to impersonate high-privilege accounts
• Why Microsoft’s guidance is buried in 2,000+ pages of documentation
• The one checkbox that shuts down this attack path instantly
• Why putting accounts in the Protected Users group isn’t enough

🛠️ Quick Fix:1️⃣ Open the RID 500 account properties
2️⃣ Under the Account tab, check:
    ✅ “Account is sensitive and cannot be delegated”
3️⃣ Apply this setting to all privileged accounts
4️⃣ Include this check in your AD hardening baseline✅ Quick Takeaways:

  • The built-in Administrator account is a default privilege escalation path

  • Kerberos delegation + RID 500 = full impersonation

  • A single setting can eliminate this risk — but most admins miss it

  • Make this part of your secure provisioning process for every admin account

💬 Join the Conversation:
Have you seen this in your AD environment? Drop us a comment. Let’s talk about closing one of the oldest open doors in AD.

📌 Powered by Guardians of the Directory

Mark as Played

Advertise With Us

Popular Podcasts

Stuff You Should Know
24/7 News: The Latest

24/7 News: The Latest

The latest news in 4 minutes updated every hour, every day.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.