Jorge's Quest For Knowledge

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

Some days ago I was reading REDDIT and stumbled across this post, where someone mistakenly deleted a DNS application partition. I responded to that post by providing steps on how to recover. In addition I also wanted to refresh my memory and see if i had written down was correct or not. All I wrote in that REDDIT post was correct with the addition of having forgotten 1 important step! WARNING:…

First things first… HAPPY NEW YEAR! Some time ago, almost 7 years ago, I wrote a PowerShell script to reset the KrbTgt Account Password of both RWDCs and RODCs. This is UPDATE 8 – FINALLY!!!!!!!! There was lots of coding and functional and stress testing of the new and updated components, and both took some serious time. In addition, I also wanted to move the documentation from individual blog…

When using either Group Managed Service Accounts (gMSAs) or Delegated Managed Service Accounts (dMSAs) (currently only possible Windows Server 2025 DCs), in addition to some account metadata, the KDS Root Key(s) available in the AD forest play a very important part in the password (re)calculation by the writable DCs (RWDCs) when servicing a managed password request from any server that uses the…

I have not done this for quit some time, but because of a silly mistake I made in my test lab, I needed to rename the domain controller. Because of how it went, I wanted to share the experience of how it went wrong and also how I solved it. Many years ago, if you wanted to rename a domain controller you had to use NETDOM. Then after some it was also possible to rename through the GUI, which made…

Just wanted to check this out myself, see what happens and add some more info. All credit is for Christoffer Andersson for discovering this issue and reporting it to MSFT. Now when you look at the documentation from Microsoft in What’s new in Windows Server 2025 For Active Directory Domain Services, you will see the following line of text (and also in Figure 1): An upgraded DC continues to use…

Previously in Entra ID, only Applications, Users, M365 Groups supported soft delete. Recently Microsoft has extended the list to now also include Cloud Security Groups as you can see below in figure 1. SOURCE: https://learn.microsoft.com/en-us/entra/architecture/recover-from-deletions Figure 1: List Of Objects In Entra ID Supporting Soft Delete When looking at “Users”, it both means native…

Today, exactly 20 years ago I started blogging and created my “Jorge’s Quest For Knowledge” blog, which has been and still is being read by many people around the world. My biggest drive and passion to do this is to research and acquire knowledge, and then share it with others around the globe so that those people can use the information to their best usage in their day-to-day jobs. The very…

Are you using managed service accounts (stand-alone, group or delegated), and you want or need to view and understand the configuration of those? Look no further! I have written 3 PowerShell scripts, one for each managed service account type, to display the configuration of each managed service account. When you look at the data and know how to interpreter it, you will also understand if the…

Almost 15,5 years ago I wrote a blog post about how to manage the DSRM Administrator Account Password. That old blog post can be found here. A few days earlier back then I wrote a blog post how and when you could log on with the DSRM Administrator account. That old blog post can be found here. Looking at todays new capabilities and threats, I felt it was needed to rewrite those blog posts,…

Microsoft released Windows Server 2025 some time ago and one of the cool features is “delegated Managed Service Accounts (dMSA)”. With a dMSA, in general, you can migrate an existing (legacy) service account used for a service, scheduled task or application pool and have that dMSA do whatever that (legacy) service account is doing. In other words, the dMSA takes over the functionality of the…

This is a cross posting from the Semperis blog where this blog post was initially posted on 2025-07-10 and also written by me. The link to the Semperis blog post is: How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration ================================================================== Author: Jorge de Almeida Pinto, Semperis Senior Incident Response Lead Key…