Unfortunately the security defaults haven’t meaningfully changed since 2003! The more advanced protections introduced over the last two decades are mostly off

Unfortunately the security defaults haven’t meaningfully changed since 2003! The more advanced protections introduced over the last two decades are mostly off by default. As a random example, a trust established between two AD forests using only Windows Server 2022 domain controllers will default to RC4 encryption instead of AES! It takes a lot of thankless work to properly secure an AD domain, and often it’s a impossible task because of incompatibilities with - checks list - Microsoft software released as recently as 2020.