PowerShell & Security MVP who is passionate about helping others succeed w/ Active Directory, Entra, Defender, & Microsoft 365. Always learning! โ๏ธ๐จโ๐ฉโ๐งโ๐ฆโ
Charlotte ๐จโ๐ป GitHub and โก๏ธ
- Tweets 17,504
- Following 1,587
- Followers 3,379
- Likes 40,413
Sam Erde retweeted
Defender for Identity sensor v3 on ADFS, ADCS, and Entra Connect sync is now in preview! ๐ฅณ
Make sure you have at least one, reachable DC running the v3 sensor as well ;)
6
26
122
9,552
Sam Erde retweeted
ISOC in Microsoft Defender is a benefit for M365 E5 and E7 customers, it is not a new product. Those lucky customers will save 44% off 3P security log ingestion.
I spent all day reading and broke it down here to bring it to you straight:
patriotconsulting.com/blogs/โฆ
XDR and SIEM now in one platform. Meet the new ISOC in Microsoft Defenderโa SOC built for agentic security. Here to help you investigate and respond more efficiently. msft.it/6019ag5T1
7
40
305
626,000
Iโm getting my em dash back!
Being able to read and actually understand the output from Claude models is going to be a nice change as well. ๐คญ
Opus 5.5 communicates more naturally, addressing some of the most common feedback we heard on Opus 5.
It puts the most important information up front and follows the writing rules you give it, which makes long sessions easier to follow.
3
414
In which we talk about Active Directory and other things you might monitor with Maester. ๐ต๏ธโโ๏ธ
Developers wouldn't ship without tests.
Identity teams ship changes to a 30-year-old directory every single day with nothing but a change ticket and hope.
Maester now tests on-prem Active Directory: 269 checks, read-only, runs from your workstation.
Built by Mike Soule, who joins @SamErde and me on this week's Entra.Chat to go through what it covers and how to run it safely.
Let's bring Sec DevOps practices to Active Directory!
There's no good reason not to have a baseline.
Watch the full episode on entra.chat
#ActiveDirectory #Maester #PowerShell #IdentitySecurity
2
8
1,082
Had a blast presenting at #HIPConf26, and who better to share the experience with than @merill!๐ We shared unique ways to look beyond security baselines with #Maester.
Huge thanks to @SemperisTech and the community for making HIP my new favorite event!
hipconf.com/resources/beyondโฆ
1
2
11
1,083
Sam Erde retweeted
Today, we announced the 2nd set of finalists for the Golden #Clippy Awards.
Yes, this is the trophy below.
Of the 10ish awards, no award better personifies our culture and mission than this one. We work very hard, and try to support each other, but we often have people who don't get the recognition they deserve.
Many of this year's nominees are people who we're like "how the hell were they not already a MVP?" like @NathanMcNulty last year or @SamErde.
Let's welcome these amazing nominees, who I consider to be good friends, and very talented people.
Let's also try to not let legacy technology people like @techspence win ok? ๐
Register now: workplaceninjas.us
Happy Monday!
Today, we announce the finalists for our 2nd Golden #Clippy and perhaps my favorite: "The Next-Gen #Ninja" which highlights a new Microsoft MVP who has been making a great impact on the community. Let's discuss these 6 amazing people:
๐ @MarkHunterOrr, who we met in Dallas last year, and impressed plenty of people at the #hackathon, and overall, throughout the event, is a very impressive guy. Outside of being a great dad, he has been building tools and making a difference every day.
๐ช @bigchrisatx feels like he's been an MVP for 15 years, but he just finally got one. A super smart guy, who has a heart of gold and some major skills in the #AVD and #Windows 365 space.
๐ผ Maxime Guillemin has been making a major impact despite being young in his country of Belgium. The hard work has finally paid off as he's in a new role at one of our sponsors, Splashtop Inc. along with being a new dad. A master of #MSSecurity #Copilot and #MSIntune, we're very proud of him for finally becoming a MVP.
๐ป @techspence , despite us giving him a hard time, is an absolute rockstar. Someone who is doing nearly 100 penetration tests per year on #ActiveDirectory, it's hard to believe he's a new MVP.
๐ @WelkasWorld , the "Queen of #Purview", has continued to have a meteoric rise in the community. She's not only one of the most brilliant Purview people in the world, but she's been rising the ranks at Threatscape, and challenging herself with more dynamic sessions and content around the world.
This is a very competitive category this year with 5 very deserving people. It is ANYONE's game to win, but who WILL win? Debate in the comments, who do you got?
#MVPBuzz
Don't forget to register and join us to crown one of these brilliant people!!
workplaceninjas.us
1
4
14
3,044
Sam Erde retweeted
๐ Secure Bits ๐ก
๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ถ๐ป ๐๐ฒ๐ณ๐ฒ๐ป๐ฑ๐ฒ๐ฟ ๐ณ๐ผ๐ฟ ๐๐ฑ๐ฒ๐ป๐๐ถ๐๐ ๐ป๐ผ๐ ๐ด๐ผ๐ฒ๐ ๐ฏ๐ฒ๐๐ผ๐ป๐ฑ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐
You can now enable Windows event auditing on ๐๐ ๐๐ฆ, ๐๐ ๐๐ฆ and ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐๐ป๐๐ฟ๐ฎ ๐๐ผ๐ป๐ป๐ฒ๐ฐ๐ servers automatically. The servers have to run the ๐๐ฒ๐ป๐๐ผ๐ฟ ๐๐ฏ.๐
to get the audit configuration automatically.
๐ ๏ธ ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ผ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
Microsoft Defender portal โ Settings โ Identities โ General โ Advanced features โ ๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป
๐ช๐ต๐ฎ๐ ๐๐ต๐ฒ ๐๐ฒ๐ป๐๐ผ๐ฟ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ๐:
- Directory services advanced auditing: audit entries in the SACL of the domain root object
- NTLM auditing: the required registry values
- Domain object auditing: the SACL on the Configuration partition
- AD FS: object-level auditing on the AD FS configuration container, plus the Audit Application Generated policy (Success and Failure)
- AD CS: the required value in the CA audit filter in the CA registry configuration
- Entra Connect: the Audit Logon policy (Success and Failure)
- The local Windows audit policies
The sensor writes the settings to the local system policy of the server and repeats the check once every 24 hours.
โ ๏ธ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐๐ผ๐ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
- AD FS: event auditing in AD FS Management and verbose logging stay manual (Set-AdfsProperties -AuditLevel Verbose)
- If Sensor v2.x is still in use, you have to do it manually
- GPO settings can conflict with the local settings that the sensor applies
๐ ๐๐ต๐ฒ๐ฐ๐ธ ๐๐ผ๐๐ฟ ๐ฐ๐๐ฟ๐ฟ๐ฒ๐ป๐ ๐๐๐ฎ๐๐ฒ ๐ณ๐ถ๐ฟ๐๐:
New-MDIConfigurationReport -Path "C:\Reports" -Mode Domain -OpenHtmlReport
(DefenderForIdentity PowerShell module)
Do your AD FS, AD CS and Entra Connect servers already run the v3.x sensor?
Author: Martin Strnad
#DefenderForIdentity #ActiveDirectory #ADCS #ADFS #EntraConnect #SecureBits #HorizonSecured
1
13
57
2,751
Sam Erde retweeted
A guided migration that includes "includes configuration assessment, provisioning agent setup, staged activation, and validation."
It's almost like the Entra team asked "How can we make this easier for our customers?" and then did it ๐ก
Big kudos to the Entra team for this ๐ฅณ
Microsoft releases Entra Connect v2.6.91.0 with security fixes and recommends upgrading to this version as soon as possible!
โ
This release also includes a guided migration workflow from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync.
โ
The workflow includes configuration assessment, provisioning agent setup, staged activation, and validation.
โ
To download the Microsoft Entra Connect Sync tool:
โ
1. Sign in to Microsoft Entra admin center.
2. Navigate to Entra ID > Entra Connect > Get Started > Manage.
3. Select the "Download Connect Sync agent".
4. Select the "Accept terms & download" button.
5. Run the tool on the Entra Connect server and follow the wizard.
โ
Note: The release is only available for download via the Microsoft Entra admin center, and auto-upgrade is not available.
โ
Learn more:
- learn.microsoft.com/en-us/enโฆ
- alitajran.com/upgrade-microsโฆ
โ
#Microsoft365 #EntraID #EntraConnect
1
15
92
8,873
Microsoft just announced that they are dropping support for Windows PowerShell 5.1 in future releases of the Microsoft Graph PowerShell module. ๐ This is a GOOD thing for PowerShell and for the Microsoft.Graph module--and for us!!!๐ฅ
devblogs.microsoft.com/microโฆ
2
4
26
1,727
Longer post about why this is good news is here: lnkd.in/p/eBN6_pyJ
1
1
82
Sam Erde retweeted
Even better news - Server 2016 reaches end of support in January 2027!
Windows 11 24H2 Home and Pro reach end of support in October
bleepingcomputer.com/news/miโฆ
bleepingcomputer.com/news/miโฆ
5
5
32
4,002
Sam Erde retweeted
๐ Microsoft Entra Connect (Azure AD Connect) version 2.6.91.0 is now available
Everything you need to know is in the images below.
๐ This release includes security fixes. Microsoft recommends upgrading as soon as possible.
โ ๏ธ Before you upgrade: 2.6.91.0 adds Microsoft Graph permissions. If you have app-scoped Conditional Access policies targeting Microsoft.Azure.SyncFabric or Microsoft 365 Reporting Service, review them first or the sync may be blocked.
Microsoft Entra Connect Sync is no longer available from the Microsoft Download Center. The .msi must be downloaded from the Microsoft Entra admin center:
entra[.]microsoft[.]com > Identity > Hybrid Management > Microsoft Entra Connect > Connect Sync > Get started > Manage tab
๐จ Reminder: on September 30, 2026, every server below 2.5.79.0 stops synchronizing until it is upgraded. Two weeks left.
๐ Official release notes:
learn.microsoft.com/en-us/enโฆ
๐ Previous versions list, you can download older versions there:
l.itpro.tips/entraconnectsynโฆ
2
10
77
7,862
Celebrating the small wins: one more Entra documentation page has slightly less confusing verbiage now. "Azure administators" has been updated to "Microsoft Entra administators" in the SSPR policy docs. ๐๐
github.com/MicrosoftDocs/entโฆ
2
21
599
Sam Erde retweeted
#Azure and #MicrosoftGraph #PowerShell tokens can be persisted in the #macOS Keychain and exfiltrated by other scripts. In my blog, I unpack research about:
๐ฏ Same-user-context risk
๐ก๏ธ Process-scoped mitigations & detections
๐ ๏ธ A defensive audit script
๐ cloud-architekt.net/macos-caโฆ
12
32
2,059
๐PSPreworkout v2.2.0 is live on the PowerShell Gallery! New features, fixes, and polish to help you set up and tune your PowerShell environment faster.
๐Update-AllTheThings now updates GH CLI extensions and GitHub Copilot.
github.com/SamErde/PSPreworkโฆ #PowerShell #DevTools
2
6
801