PowerShell & Security MVP who is passionate about helping others succeed w/ Active Directory, Entra, Defender, & Microsoft 365. Always learning! โ๏ธ๐จโ๐ฉโ๐งโ๐ฆโ
Charlotte ๐จโ๐ป GitHub and โก๏ธ
Joined April 2009
- Tweets17.5K
- Following1.6K
- Followers3.4K
- Likes40.6K
Sam Erde retweeted
It's time to drop support for Windows PowerShell, and move to PowerShell 7. Yes, even if it doesn't yet ship in-box with Windows Server. Just install it by default - you can still use WinRM, no need to switch to SSH. .NET Framework is *ancient* and lacks a decade of improvements
Sam Erde retweeted
This month's Patch Tuesday release addresses a critical #security vulnerability in the #Microsoft Network Device Enrollment Service (NDES). This is a Remote Code Execution (RCE) vulnerability rated critical with a CVSS score of 8.1. If you use NDES with the #msintune certificate connector, update soon. msrc.microsoft.com/update-guโฆ
Sam Erde retweeted
It's been a long time coming but PSWSMan v3 for #PowerShell has been released powershellgallery.com/packagโฆ. This is a major upgrade that moves away from the C omi library to a C# WSMan stack. No more root required, better Enter-PSSession experience, and lots more features enabled.
Sam Erde retweeted
๐ค Why should the AI Administrator role in #MicrosoftEntra be considered Control Plane (Tier 0)? At first glance, it might seem particularly privileged just to manage #AgentIdentities. But there's an aspect that often gets overlooked. (1/7) ๐
Sam Erde retweeted
Cybersecurity has "assume breach" as a key concept.
AI safety/security probably needs a coherent "assume misalignment" concept.
Sam Erde retweeted
#MDDR 2026 is out โ a must-read for everyone in #MicrosoftSecurity. Password spray still leads by volume, but post-authentication attacks keep gaining ground: token theft shows up as a distinct post-compromise tactic. Check out the full report:
aka.ms/MDDR2026
Sam Erde retweeted
Microsoft will make most Microsoft Learn GitHub repo's private by the end of the year. It's a wider problem, which I don't think has been thought through, so here are mine > ourcloudnetwork.com/microsofโฆ
As someone who has personally spent many hours of their time, both creating completely new official Learn articles and creating pull requests to fix mistakes in existing articles, it's a shame to see that recognition disappear.
#Entra #Learn #Microsoft
Sam Erde retweeted
If you're unable to run Active Directory PowerShell scripts because RSAT is not on your computer and you don't have admin rights to install it, there are still options.
Example: this line in PowerShell will get you the FQDN of a global catalog domain controller:
Sam Erde retweeted
Defender for Identity sensor v3 on ADFS, ADCS, and Entra Connect sync is now in preview! ๐ฅณ
Make sure you have at least one, reachable DC running the v3 sensor as well ;)
Sam Erde retweeted
ISOC in Microsoft Defender is a benefit for M365 E5 and E7 customers, it is not a new product. Those lucky customers will save 44% off 3P security log ingestion.
I spent all day reading and broke it down here to bring it to you straight:
patriotconsulting.com/blogs/โฆ
XDR and SIEM now in one platform. Meet the new ISOC in Microsoft Defenderโa SOC built for agentic security. Here to help you investigate and respond more efficiently. msft.it/6019ag5T1
Sam Erde retweeted
Today, we announced the 2nd set of finalists for the Golden #Clippy Awards.
Yes, this is the trophy below.
Of the 10ish awards, no award better personifies our culture and mission than this one. We work very hard, and try to support each other, but we often have people who don't get the recognition they deserve.
Many of this year's nominees are people who we're like "how the hell were they not already a MVP?" like @NathanMcNulty last year or @SamErde.
Let's welcome these amazing nominees, who I consider to be good friends, and very talented people.
Let's also try to not let legacy technology people like @techspence win ok? ๐
Register now: workplaceninjas.us
Happy Monday!
Today, we announce the finalists for our 2nd Golden #Clippy and perhaps my favorite: "The Next-Gen #Ninja" which highlights a new Microsoft MVP who has been making a great impact on the community. Let's discuss these 6 amazing people:
๐ @MarkHunterOrr, who we met in Dallas last year, and impressed plenty of people at the #hackathon, and overall, throughout the event, is a very impressive guy. Outside of being a great dad, he has been building tools and making a difference every day.
๐ช @bigchrisatx feels like he's been an MVP for 15 years, but he just finally got one. A super smart guy, who has a heart of gold and some major skills in the #AVD and #Windows 365 space.
๐ผ Maxime Guillemin has been making a major impact despite being young in his country of Belgium. The hard work has finally paid off as he's in a new role at one of our sponsors, Splashtop Inc. along with being a new dad. A master of #MSSecurity #Copilot and #MSIntune, we're very proud of him for finally becoming a MVP.
๐ป @techspence , despite us giving him a hard time, is an absolute rockstar. Someone who is doing nearly 100 penetration tests per year on #ActiveDirectory, it's hard to believe he's a new MVP.
๐ @WelkasWorld , the "Queen of #Purview", has continued to have a meteoric rise in the community. She's not only one of the most brilliant Purview people in the world, but she's been rising the ranks at Threatscape, and challenging herself with more dynamic sessions and content around the world.
This is a very competitive category this year with 5 very deserving people. It is ANYONE's game to win, but who WILL win? Debate in the comments, who do you got?
#MVPBuzz
Don't forget to register and join us to crown one of these brilliant people!!
workplaceninjas.us
Sam Erde retweeted
๐ Secure Bits ๐ก
๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ถ๐ป ๐๐ฒ๐ณ๐ฒ๐ป๐ฑ๐ฒ๐ฟ ๐ณ๐ผ๐ฟ ๐๐ฑ๐ฒ๐ป๐๐ถ๐๐ ๐ป๐ผ๐ ๐ด๐ผ๐ฒ๐ ๐ฏ๐ฒ๐๐ผ๐ป๐ฑ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐
You can now enable Windows event auditing on ๐๐ ๐๐ฆ, ๐๐ ๐๐ฆ and ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐๐ป๐๐ฟ๐ฎ ๐๐ผ๐ป๐ป๐ฒ๐ฐ๐ servers automatically. The servers have to run the ๐๐ฒ๐ป๐๐ผ๐ฟ ๐๐ฏ.๐
to get the audit configuration automatically.
๐ ๏ธ ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ผ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
Microsoft Defender portal โ Settings โ Identities โ General โ Advanced features โ ๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป
๐ช๐ต๐ฎ๐ ๐๐ต๐ฒ ๐๐ฒ๐ป๐๐ผ๐ฟ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ๐:
- Directory services advanced auditing: audit entries in the SACL of the domain root object
- NTLM auditing: the required registry values
- Domain object auditing: the SACL on the Configuration partition
- AD FS: object-level auditing on the AD FS configuration container, plus the Audit Application Generated policy (Success and Failure)
- AD CS: the required value in the CA audit filter in the CA registry configuration
- Entra Connect: the Audit Logon policy (Success and Failure)
- The local Windows audit policies
The sensor writes the settings to the local system policy of the server and repeats the check once every 24 hours.
โ ๏ธ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐๐ผ๐ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
- AD FS: event auditing in AD FS Management and verbose logging stay manual (Set-AdfsProperties -AuditLevel Verbose)
- If Sensor v2.x is still in use, you have to do it manually
- GPO settings can conflict with the local settings that the sensor applies
๐ ๐๐ต๐ฒ๐ฐ๐ธ ๐๐ผ๐๐ฟ ๐ฐ๐๐ฟ๐ฟ๐ฒ๐ป๐ ๐๐๐ฎ๐๐ฒ ๐ณ๐ถ๐ฟ๐๐:
New-MDIConfigurationReport -Path "C:\Reports" -Mode Domain -OpenHtmlReport
(DefenderForIdentity PowerShell module)
Do your AD FS, AD CS and Entra Connect servers already run the v3.x sensor?
Author: Martin Strnad
#DefenderForIdentity #ActiveDirectory #ADCS #ADFS #EntraConnect #SecureBits #HorizonSecured
Sam Erde retweeted
A guided migration that includes "includes configuration assessment, provisioning agent setup, staged activation, and validation."
It's almost like the Entra team asked "How can we make this easier for our customers?" and then did it ๐ก
Big kudos to the Entra team for this ๐ฅณ
Microsoft releases Entra Connect v2.6.91.0 with security fixes and recommends upgrading to this version as soon as possible!
โ
This release also includes a guided migration workflow from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync.
โ
The workflow includes configuration assessment, provisioning agent setup, staged activation, and validation.
โ
To download the Microsoft Entra Connect Sync tool:
โ
1. Sign in to Microsoft Entra admin center.
2. Navigate to Entra ID > Entra Connect > Get Started > Manage.
3. Select the "Download Connect Sync agent".
4. Select the "Accept terms & download" button.
5. Run the tool on the Entra Connect server and follow the wizard.
โ
Note: The release is only available for download via the Microsoft Entra admin center, and auto-upgrade is not available.
โ
Learn more:
- learn.microsoft.com/en-us/enโฆ
- alitajran.com/upgrade-microsโฆ
โ
#Microsoft365 #EntraID #EntraConnect
Sam Erde retweeted
Even better news - Server 2016 reaches end of support in January 2027!
Windows 11 24H2 Home and Pro reach end of support in October
bleepingcomputer.com/news/miโฆ
bleepingcomputer.com/news/miโฆ
Sam Erde retweeted
๐ Microsoft Entra Connect (Azure AD Connect) version 2.6.91.0 is now available
Everything you need to know is in the images below.
๐ This release includes security fixes. Microsoft recommends upgrading as soon as possible.
โ ๏ธ Before you upgrade: 2.6.91.0 adds Microsoft Graph permissions. If you have app-scoped Conditional Access policies targeting Microsoft.Azure.SyncFabric or Microsoft 365 Reporting Service, review them first or the sync may be blocked.
Microsoft Entra Connect Sync is no longer available from the Microsoft Download Center. The .msi must be downloaded from the Microsoft Entra admin center:
entra[.]microsoft[.]com > Identity > Hybrid Management > Microsoft Entra Connect > Connect Sync > Get started > Manage tab
๐จ Reminder: on September 30, 2026, every server below 2.5.79.0 stops synchronizing until it is upgraded. Two weeks left.
๐ Official release notes:
learn.microsoft.com/en-us/enโฆ
๐ Previous versions list, you can download older versions there:
l.itpro.tips/entraconnectsynโฆ
Sam Erde retweeted
#Azure and #MicrosoftGraph #PowerShell tokens can be persisted in the #macOS Keychain and exfiltrated by other scripts. In my blog, I unpack research about:
๐ฏ Same-user-context risk
๐ก๏ธ Process-scoped mitigations & detections
๐ ๏ธ A defensive audit script
๐ cloud-architekt.net/macos-caโฆ
Sam Erde retweeted
I agree with this assessment 100%. The problem, to be blunt, is that for too long there has been no consequence to not doing the right thing. AI will not change that at all other than exposure of the core issue.
AI (LLMs) is also not going to fix this. Applying proper consequences and incentives, which creates the right incentive structure (proper carrot and hard stick) for doing the right thing.
FBI assistant cyber director says the security basics of yesterday work today. AI doomers say we are facing extinction.
There is a stark difference between critical infrastructure failures and extinction. Will we have a colonial pipeline event that shuts down a public resource? Thatโs probable, and it was probably before AI because the same incentives and the same neglected controls still exist.
When something like this happens, itโs not a told you so moment. No one in the security industry will be surprised. We wouldnโt be surprised yesterday or tomorrow.
Anthropicโs report is not surprising. The level of care orgs put into security is relevant to the level of perceived risk + risk appetite. We certainly arenโt going extinct over these events.
Now look what youโve done. You went and scared the non-techies and they think terminator is here, when the real issue may be minority report.
Sam Erde retweeted
Do you have your Control Plane under control? ๐จ #EntraOps 1.0 is now available ๐ - an open-source platform to govern and monitor your Enterprise Access Model in #MicrosoftEntra: entraops.com.
Here is whatโs new in this release ๐
