Forum Discussion
Secure Score Dropped including the last 6 months
I have registered a customer Secure Score for at least 6 months. Suddenly the score dropped from about 92% to 84% and checking the history looks like we never met the score above 90% but we have evid...
We have seen some fluctuations - there have been some new Identity related recommendations introduced recently though that aren't shared in the usual what's new web page.
Accounts with non-default Primary Group ID
Domain Controllers with computer account password unchanged for more than 45 days
GPO assigns unprivileged identities to local groups with elevated privileges
GPO can be modified by unprivileged accounts
GPO contains passwords Group Policy Preferences files
Built-in Active Directory Guest account is enabled
Unsafe permissions on the DnsAdmins group
Ensure that all privileged accounts have the configuration flag “this account is sensitive and cannot be delegated”
Change password of krbtgt account
Change password of built-in domain Administrator account
Accounts with non-default Primary Group ID
Domain Controllers with computer account password unchanged for more than 45 days
GPO assigns unprivileged identities to local groups with elevated privileges
GPO can be modified by unprivileged accounts
GPO contains passwords Group Policy Preferences files
Built-in Active Directory Guest account is enabled
Unsafe permissions on the DnsAdmins group
Ensure that all privileged accounts have the configuration flag “this account is sensitive and cannot be delegated”
Change password of krbtgt account
Change password of built-in domain Administrator account
Thank you, I'll ask our team to check these, we do monthly Secure Score recommendations, some of the recommendations we remediated popped up as regressed. We also logged a Service Health Issue on one of the effected Tenants and logged a Microsoft support ticket on another Tenant. I'll feedback soon as i get something. We had one Tenant drop from 70% to 50% in less than 3 weeks.