Event banner
Event details
19 Comments
Thank you for joining us this week for the Windows Server Summit! Q&A is now closed, but all sessions are available on demand so you can watch and learn when it is convenient for you. We hope you enjoyed the event.
- Is the RPC auditing/firewall feature-set enhancement making it into Windows Server 2025? Have an internal enhancement that seems like it would be related to this demo as a layer in the security puzzle - support and third parties confirmed this appears to not be fully implemented. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-rpc-events such as 5712 (worked with support and found that these events were not actually implemented in the operating system on Windows Server 2019 / 2022 domain controllers, also helpful on clients, but more sensitive there for certain.)
- Is this there a list of software applications and systems that support MSA and GMSA objects. That would really be useful in generating remediation plans for my customer.
- Peter I haven't come across a published list of software, say from something like ISVs, that support MSA/gMSA. I would suspect if something existed it would be a community project, but likely only to encompass software and vendors that are known.
- Pingcastle is awesome and so is PurpleKnight
- Second that. Huge shout out to Semperis for these tools and community offer.
- Azure Stack HCI expects an OU with GPO inheritance disabled. When deploying Azure Stack HCI in the same AD as prod, or better in a seperate AD, would it make sense to apply Security GPO Baselines still? Or can we rely on Azure Policies doing this?
- That's a great question Karl. As far as securing the server estate outside of Domain Controllers, especially for specialized systems such as HCI, I'd have to get back to you as far as an answer. I know that there is overlap between Azure Policy and Group Policy, but securing HCI is outside of the realm in which I really work these days.
- Thank you for going the extra mile. I am really curious since, my preferred scenario, setting up a seperate domain for Azure Stack HCI only, we could still consider GPO baseline for protecting the domain controllers "serving" Azure Stack HCI cluster, if not the nodes itself. I can imagine that hosts are protected by Azure Policy but the DCs could be "out of scope". Hope you see my curiosity and, can name it concerns?
- There are far more paths into AD for an attacker than most people realise....
- Absolutely Peter, and it's tough to even scratch the surface in 30 minutes.
- The one if find an awful lot of is stale unused accounts with excessive privileges left lying around....
Welcome! An ounce of prevention is worth a pound of detection is starting now. If you have any questions or feedback for our product teams, please post them here in the Comments.
