Use SIDs, not display names, when reconciling Windows access
A SID uniquely identifies a security principal or security group. The Windows SID model includes domain-relative RID allocation and well-known SID values.
Read the explainerDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 231 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Account for special identity groups in every Windows ACL review
Special identity groups provide a Windows mechanism for assigning access based on authentication or operating context. The reference distinguishes identities such as Anonymous Logon, Authenticated Users, and authentication-authority asserted identities.
Read the guide
Migrate eligible services to device-bound dMSA identities
A dMSA can migrate a traditional service account to managed randomized keys while disabling the original password. dMSA authentication is bound to machine identities explicitly mapped in Active Directory.
Read the playbook
Prove dMSA migration through account and event evidence
AD automatically manages dMSA credentials instead of requiring manual password administration. The setup workflow covers creation, migration completion, and review of dMSA event logs.
Read the briefing
Keep protected machine accounts disabled until Microsoft resolves rotation
Microsoft states that Credential Guard protected machine accounts are temporarily disabled because of a Kerberos machine-password rotation issue. FAST and managed service accounts increasingly depend on machine-account identity.
Read the checklist
Wait for KDS root-key convergence before creating gMSAs
Domain controllers require a KDS root key before they can generate gMSA passwords. Controllers can wait up to 10 hours after key creation so AD replication can converge before gMSA use.
Read the explainer
Configure gMSA Kerberos delegation without relying on the missing tab
The ADUC Delegation tab does not appear for standalone or group managed service accounts. Microsoft documents PowerShell and direct userAccountControl approaches for configuring the required delegation state.
Read the guide
Delegate AD administration at the narrowest OU boundary
Delegation assigns selected administrative tasks without making every operator a domain-wide or forest-wide administrator. Administrative control can be delegated at specific organizational-unit levels in the domain tree.
Read the playbook
Separate metric progress from weight in the Identity Security Initiative
Metric progress represents exposure improvement on a scale from 0 for high exposure to 100 for no exposure. Metric weight represents relative importance and effect on the initiative score; the interface shows High, Medium, Low, or Risk accepted.
Read the briefing
Capture domain-controller system state with two supported methods
The forest-recovery procedure creates domain-controller system-state backups with Windows Server Backup or wbadmin.exe. Microsoft documents separate GUI and command-line procedures for the same recovery input.
Read the checklist