3 ms·

Most exploits don't actually need to be all that crafty. They just ask someone to click a link and run some javascript. Could someone use this to pivot in a net

Most exploits don't actually need to be all that crafty. They just ask someone to click a link and run some javascript. Could someone use this to pivot in a network? Yes. Almost every large enterprise has bigger problems than this. People need to be looking at the new model that they came up with for Windows 10 and Azure AD join if they want to stay on Windows clients. The traditional domain model makes the potential impact of breach far too widespread. Windows Server AD should be used as a server management technology with resources being in resource domains that are just big enough to manage things that are related as a unit. Everybody and everything in the same domain is an antipattern now a days because of credential theft techniques. Most places don't have the expertise to maintain AD. It's too complicated and the loss of a single domain admin cred means that you have to rebuild it if you want to get back to a trustworthy state. Ehh. It's Friday and I want some cake.

QAPereo 9y ago
For packing that much information into a pleasantly readable paragraph? You deserve cake.
EvanAnderson 9y ago
Resource forests, if you want actual security boundaries. Domains aren't security boundaries. Having said that, some good old fashioned network segmentation would be a "win", too. Default deny ACLs should be the norm, and hosts sshould only be able to communicate with hosts they actually need to, full stop. (The reactions I get from developers, however, are typically less than pleasant when they learn that environments I administer have such policies, however.)
- youdontknowtho 9y ago
  True dat. I've gotten where I use forest and domain interchangeably even thought what you say is true. I only advise people build single forest single domains these days. Complex forest topologies are also a bad thing.

QAPereo 9y ago

For packing that much information into a pleasantly readable paragraph? You deserve cake.

EvanAnderson 9y ago

Resource forests, if you want actual security boundaries. Domains aren't security boundaries. Having said that, some good old fashioned network segmentation would be a "win", too. Default deny ACLs should be the norm, and hosts sshould only be able to communicate with hosts they actually need to, full stop. (The reactions I get from developers, however, are typically less than pleasant when they learn that environments I administer have such policies, however.)

youdontknowtho 9y ago
True dat. I've gotten where I use forest and domain interchangeably even thought what you say is true. I only advise people build single forest single domains these days. Complex forest topologies are also a bad thing.