Read: 8 mins. Is it possible for Microsoft Windows to export a Certificate with its Private Key whose key had been marked as non-exportable? Yes. This also presents a security concern.
Read: 26 mins. Splunk is a GREAT tool to aggregate and correlate information from a variety of sources, and its SPL queries can help surface what you may need. In this post, we extend our previous Active Directory Account Lockout Troubleshooting article with Splunk Dashboards. SimpleXML source codes are provided to create visual representations of Windows Security event log data to aid with lockout investigations. They can also help identify data or behavior patterns and how many accounts are failing authentication over a specific time period.
Read: 4 mins. The Compare-Object cmdlet is a very useful tool to find differences between data sets. It can help with logging changes, acting only on specific sets of data, speeding up processing time, and reducing complexity. In this article, we will cover what the "SideIndicator" property means, how to pass through all Properties from the source data, create a custom property with evaluated information, and output only results that exist in both data sets.
Read: 3 mins. A sensitive, internal meeting was held within Microsoft Teams, and someone had accidentally recorded it. The organizer was extremely unhappy when nobody admitted to it, particularly since any attendee was able to download a copy of the recording. An urgent request to the Office 365 and Information Security teams was put out to investigate. How did we go about in doing so?
Read: 22 mins. A Windows account keeps getting locked out and breaks a business-critical application that is responsible for a large volume of revenue. Angry customers have called into customer service to complain, and your manager has asked you for help. How do you find the source for the lockouts? Here is a comprehensive guide to aid you with resolving the issue. BONUS: Look up when an account was modified, disabled, enabled, unlocked, or had its password reset -- and by whom