Did Anyone at Microsoft Ignite 2018 Know the Answer To This Question?

Folks,

Last week, thousands of IT professionals, managers, CISOs and CIOs were in Orlando, attending, well, Microsoft Ignite 2018 !

Image Courtesy Microsoft. Source: https://www.microsoft.com/en-us/ignite

Not surprisingly, the Microsoft Ignite Conference had SOLD OUT!  There were 900+ sessions, 100+ instructor-led technology workshops, 60+ Microsoft Immersion workshops, and 50+ hands-on labs with access to expert proctors! That's great!

Did I mention that likely hundreds of Microsoft's own experts were also there, and collectively, they covered numerous vital areas such as Securing the Enterprise, Simplified IT Management, Identity‚ Access & Compliance, Enterprise Security etc.


So, with over 1000 sessions, 1000s of attendees, access to "expert proctors", and 100s of Microsoft's very own IT experts, one would hope THERE MUST'VE BEEN AT LEAST ONE PERSON AT MICROSOFT IGNITE 2018 who could have answered A VERY SIMPLE QUESTION -

       Question: What's The World's Most Important Active Directory Security Capability?

( URL: http://www.active-directory-security.com/2018/07/the-worlds-most-important-active-directory-security-capability.html )

This is paramount, and here's why. In case you're wondering why anyone, and everyone who attended Microsoft Ignite 2018 should care about this question AND know the answer, its because in any Microsoft Windows Server based IT Infrastructure, NOT A SINGLE ONE of the many vital areas listed above i.e. Securing the Enterprise, Simplified IT Management, Identity‚ Access & Compliance, Enterprise Security etc. etc. can be adequately addressed without involving Active Directory Security.


In fact, here's proof - 

Not a single one of the following fundamental cyber security / Windows security questions can be answered without knowing the answer to the question above and possessing that capability -

1. Who can reset the passwords of any/every Domain Admin in an organization?


2. Who can disable two-factor authentication on privileged and other domain user accounts?


3. Who can change the membership of the Domain Admins group, or of any domain security group?


4. Who can use Mimikatz DCSync to completely compromise the credentials of all domain user accounts?


5. Who can delete an(y) Organizational Unit (OU) in a(ny) of the organization's Active Directory domains?


6. Who can link a malicious group policy to an OU to instantly compromise all domain computer accounts in that OU?


7. Who can modify the attributes of a mission-critical service's service connection points to instantly render it useless?


8. Who can set the "Trusted for Unconstrained Delegation" bit on a server's domain account to compromise security*?


9. Who can create, delete and manage domain user accounts, domain security groups, OUs etc. in Active Directory?


10. Who can control/change privileged access as well as delegated access within and across the entire Active Directory?

Each and every single organization whose IT personnel / CISOs attended Microsoft Ignite 2018 (including Microsoft itself) must have precise answers to each and every one of the above listed fundamental cyber security questions at all times.




So, if anyone who attended Microsoft Ignite 2018 (including Microsoft's own experts) knows the answer to this 1 question, please be my guest and answer the question by leaving a comment at the end of that blog post, and you'll earn my respect.

If you don't know the answer, I highly recommend reading, one, two and three, because without knowing the answer to this question (and without possessing this capability,) you cannot secure anything in an Active Directory based Windows network.

The last time I checked, virtually the whole world runs on Active Directory.

Best wishes,
Sanjay