Jorge's Quest For Knowledge

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

Some days ago I was reading REDDIT and stumbled across this post, where someone mistakenly deleted a DNS application partition. I responded to that post by providing steps on how to recover. In addition I also wanted to refresh my memory and see if i had written down was correct or not. All I wrote in that REDDIT post was correct with the addition of having forgotten 1 important step! WARNING:…

First things first… HAPPY NEW YEAR! Some time ago, almost 7 years ago, I wrote a PowerShell script to reset the KrbTgt Account Password of both RWDCs and RODCs. This is UPDATE 8 – FINALLY!!!!!!!! There was lots of coding and functional and stress testing of the new and updated components, and both took some serious time. In addition, I also wanted to move the documentation from individual blog…

When using either Group Managed Service Accounts (gMSAs) or Delegated Managed Service Accounts (dMSAs) (currently only possible Windows Server 2025 DCs), in addition to some account metadata, the KDS Root Key(s) available in the AD forest play a very important part in the password (re)calculation by the writable DCs (RWDCs) when servicing a managed password request from any server that uses the…

I have not done this for quit some time, but because of a silly mistake I made in my test lab, I needed to rename the domain controller. Because of how it went, I wanted to share the experience of how it went wrong and also how I solved it. Many years ago, if you wanted to rename a domain controller you had to use NETDOM. Then after some it was also possible to rename through the GUI, which made…

Just wanted to check this out myself, see what happens and add some more info. All credit is for Christoffer Andersson for discovering this issue and reporting it to MSFT. Now when you look at the documentation from Microsoft in What’s new in Windows Server 2025 For Active Directory Domain Services, you will see the following line of text (and also in Figure 1): An upgraded DC continues to use…

Previously in Entra ID, only Applications, Users, M365 Groups supported soft delete. Recently Microsoft has extended the list to now also include Cloud Security Groups as you can see below in figure 1. SOURCE: https://learn.microsoft.com/en-us/entra/architecture/recover-from-deletions Figure 1: List Of Objects In Entra ID Supporting Soft Delete When looking at “Users”, it both means native…

Today, exactly 20 years ago I started blogging and created my “Jorge’s Quest For Knowledge” blog, which has been and still is being read by many people around the world. My biggest drive and passion to do this is to research and acquire knowledge, and then share it with others around the globe so that those people can use the information to their best usage in their day-to-day jobs. The very…

Are you using managed service accounts (stand-alone, group or delegated), and you want or need to view and understand the configuration of those? Look no further! I have written 3 PowerShell scripts, one for each managed service account type, to display the configuration of each managed service account. When you look at the data and know how to interpreter it, you will also understand if the…

Almost 15,5 years ago I wrote a blog post about how to manage the DSRM Administrator Account Password. That old blog post can be found here. A few days earlier back then I wrote a blog post how and when you could log on with the DSRM Administrator account. That old blog post can be found here. Looking at todays new capabilities and threats, I felt it was needed to rewrite those blog posts,…

Microsoft released Windows Server 2025 some time ago and one of the cool features is “delegated Managed Service Accounts (dMSA)”. With a dMSA, in general, you can migrate an existing (legacy) service account used for a service, scheduled task or application pool and have that dMSA do whatever that (legacy) service account is doing. In other words, the dMSA takes over the functionality of the…

This is a cross posting from the Semperis blog where this blog post was initially posted on 2025-07-10 and also written by me. The link to the Semperis blog post is: How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration ================================================================== Author: Jorge de Almeida Pinto, Semperis Senior Incident Response Lead Key…

On July 10th I received an e-mail from Microsoft I was re-awarded again with the MVP Award for the Identity & Access and PowerShell Areas. This year is the 20th time I have received this award! Thank you Microsoft for the award, and thank you Semperis for supporting this adventure. Let’s go for yet another year!…

Within any AD domain many organizational units (OUs) and containers exist that have child objects. Previously in AD, OUs were not protected from (accidental) deletion. It was therefore a common fact mistakes were made and an OU with (many) child objects was deleted with all kinds of possible consequences. After some time, Microsoft implemented the “Protect from accidental deletion” option for…

PS: the irony of this blog post about W2K25 DCs on may 25th of the year 2025 😉 Yuval Gordon, a security researcher at Akamai, wrote an awesome blog post about Delegated Managed Service Accounts (dMSA) and how that feature in an AD domain with at least 1 Windows Server 2025 RWDC could be misused. At its core the migration of a legacy service account to a dMSA could be misused for privilege…