TL;DR
Spoke at Black Hat for the first time, spent the run-up convinced the room would find my demo old news, and got a lesson in imposter syndrome instead.
Old and battle-tested is exactly why people stop looking, and Active Directory is the proof: 25+ years in, researchers are still pulling full domain takeover out of Kerberos.
Two AD vulnerabilities worth knowing by name: KerberLoss and ResetNightmare. Both already patched. Whether your domain controllers took those patches is a separate question.
Episode 056: Andy and Eric Siron on how they actually got into this work, the advice that held up, and the advice that did not.
RC4 enforcement went permanent with the July update, and the domain-wide rollback key went with it.
Quick Win: hunt KDCSVC enforcement errors on every DC, plus the years Kerberos spent classified as auxiliary military equipment on the US Munitions List.
From the Console
I recently was able to mark something off of my bucket list…. kind of. Near the beginning of August, I had the pleasure of speaking at Black Hat for the first time. Ideally, this would have been via a CFP (call for presenters) selection, but it was part of a sponsorship deal. Still… speaking at Black Hat in a sponsored showfloor session was cool with me as well.
As regular podcast listeners will know, I speak at cybersecurity and MSP shows quite regularly and as covered in episode 049 of the podcast I spoke at Infosecurity Europe 2026 earlier in the year about how threat actors leverage locally hosted LLMs (via tools like Ollama) to do automated spear phishing generation at scale. I ended up doing much the same topic, but with some core changes.
See, Black Hat is known for being highly technical, almost to the point of intimidation in my opinion as a speaker. I knew that for the average SysAdmin in the trenches, the Local LLM spear-phishing demo would be a bit shocking to see on stage. With the technical crowd at Black Hat… I wasn’t so sure. In fact, I was a bit nervous about that going in.
So what’d I do? I made the content more technically complex. Additional demo paths, alternate scenarios. MORE time spent in the CLI and VERY few slides. Even with all of that, I was, admittedly, still worried that the (now) known attack techniques attackers are running via local LLMs would be old news to the crowd. Pair that with the fact that many of the other show floor theater sessions were very sparsely attended and…. yeah… I was getting a bit nervous.
Despite all of that, I had excellent turnout for my technical session and was even surprised at the number of people taking pictures of the attack as it progressed with some even recording it. I don’t share all of this to brag….no, there is a clear lesson to be had here and it centers on imposter syndrome in our industry. Tech fosters a culture that makes people hesitate to share knowledge or ask questions out of fear that they SHOULD already have the answer, and will, thus be seen as dumb.
In hindsight, my reaction leading up to the session was imposter syndrome. I was doing it, and I was wrong.
The part I’ll leave you with today is some advice I received from a friend working in tech education MANY years ago and it holds true today:
Don’t be afraid to share your knowledge with others out of fear that they won’t find it interesting or that you think it’s already general knowledge and that you’re behind. Instead, remember that everyone is at different stages of their tech careers and either need the information that you’re willing to share for this stage of their professional lives, or maybe they gain a new viewpoint on something they already knew because of your unique delivery style or lived experience.
And now…. back to our regularly scheduled programming.
The latest on the SysAdmin Weekly Podcast
Episode: How People Actually Get Into SysAdmin Work (Episode 056) Topic: Eric and I trade full origin stories, then put the career advice we were handed on trial. Some of it held up for thirty years. Some of it was nonsense the whole time.
Why this one is a good listen:
The nerd hour segment is the technical companion to what I wrote up top. It walks through the Black Hat demo itself: the local models doing the spear phishing generation, the second script that made every lure Microsoft 365 specific, and the pass through an HTML parser that turns raw model output into something that lands in an inbox looking like an ordinary SharePoint share notification.
The advice audit is the part worth your time. “The key to IT is laziness” came from my first mentor, meant automate anything you do more than once, and has held up for thirty years. “Always,” “never,” and “well, this is a best practice” did not, and the reason is the useful part: chase most of those “best practices” back far enough and you find one person on the internet citing another person on the internet with no original source anywhere. Ask who decided, and ask who made them authoritative.
Both of our first real disasters were data disasters, which turns out not to be a coincidence, and the stretch after that is the one I would point a newer admin at: normalizing “I don’t know” at every stage of a career rather than only once you have enough scar tissue to say it safely. Eric’s version of that is blunter than mine. It closes on whether cheap hardware and time to break things still exist as an entry path, and we land more optimistic than you might expect.
Watch on YouTube
Listen on Spotify
The Take
The tech industry moves fast. So much so that we often lump “old” and “legacy” software together. Both of those designations can byte (hah! see what I did there?) you if you’re not careful. Take “old” on-prem Active Directory for example. It’s been the bedrock of enterprise identity for 25+ years and, despite its age, is still widely used by SysAdmins around the world today.
An “old” but tried and tested piece of software like Active Directory is seen by many to have been battle-hardened over the years and while knowing that something has been hardened and secured via attrition is a good thing, it causes many to drop their guard. Many a time have I heard someone say things along the lines of:
“AD (Active Directory) has been around for AGES… surely they’ve found all the bugs and security issues by now”
Me denying that statement is NOT today’s “Take”, but I feel like my take for this week is that I think generalist SysAdmins have a tendency to drop their guard on older, tested, and “mature software”. I don’t think it’s from a lack of skill / knowledge, but more so the mere fact that most are so overworked with the day-to-day that the small respite from lightening the mental cybersecurity load is sorely needed and welcomed. I’m not necessarily saying that this is right or ok, but that I understand it, and would urge those admins to put systems in place to watch for vulnerabilities for ALL software in your environment, and not JUST the more modern software.
For an example of why, let’s go back to the recent Black Hat conference again. During my time at the event I was able to attend a few sessions, and one in particular caught my eye. Shai Laron from Semperis was giving a session talking about different ways that he and his team were able to abuse Kerberos tickets, mainly by fuzzing UPN / SPN calls using unicode characters.
Using this method, Shai and his team surfaced two separate vulnerabilities:
1. KerberLoss (CVE-2026-25177) - unicode in a Service Principal Name creates a name collision that AD’s uniqueness check does not catch. That gets you a denial of service against HOST-mapped services, SPN-jacking for constrained delegation abuse, and the ability to force any service in the forest to fall back to NTLM. Requires WriteSPN on any object. Patched March 10, 2026.
2. ResetNightmare (CVE-2026-27912) - set your own UPN to match another account’s sAMAccountName, request a ticket as them, and reset their password without ever knowing the old one. Any domain user can write their own UPN by default. This is the full domain takeover. Patched April 14, 2026.
NOTE: Both of the above CVEs have already been patched back in March and April of 2026.
Full writeup from Shai with the mechanics of both: Semperis - “Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover”
In short, in 2026 Shai and his team were able to completely own an established AD domain by essentially confusing Kerberos.
Here is a system that has been battle-hardened over 25+ years in the industry, and people are STILL finding vulnerabilities and exploits for it today. So, that seemingly old and “bulletproof” piece of software within your environment? Don’t ignore it, because it leads to getting hit with an exploit when you least expect it.
Community Signal
João Ferreira (Microsoft MVP) - “Enforcement phase for Kerberos RC4 protections begins with the July 2026 Windows security update” - Published July 15, 2026, and the timing matters more than the length. Audit mode and the RC4DefaultDisablementPhase rollback key were both removed with the July update. Ferreira’s list is short and correct: confirm your service accounts speak AES, close out the RC4 dependencies you found during the audit phases, and go read your DC event logs before someone else finds them for you.
Jerry Devore (Microsoft, Core Infrastructure and Security Blog) - “Active Directory Hardening Series, Part 4: Enforcing AES for Kerberos” - Refreshed August 2, 2026, and it is the most practical thing written on msDS-SupportedEncryptionTypes anywhere. The trick worth stealing is using Event 4768 to find your RC4 holdouts, because the ticket encryption type field reflects the session key issued with the TGT, which tells you which clients can only do RC4 rather than which ones you assumed could. Devore also names the four usual suspects: RC4-only keytab files, non-Windows integrated devices, Windows boxes with AES turned off by GPO, and anything predating 2008. Fair warning on sourcing, this is Microsoft’s own blog rather than independent community work, but it is field-engineer material and not marketing.
Quick Win of the Week
Go read your domain controllers’ System event logs for KDCSVC events 203, 204, 208, and 209. Those are the enforcement-mode error variants, which means they are not warnings about something that might break later, they are records of authentication that already failed since the July update landed. Their warning-mode twins are 201, 202, and 205 through 207.
Get-WinEvent -FilterHashtable @{
LogName = ‘System’
ProviderName = ‘Microsoft-Windows-Kerberos-Key-Distribution-Center’
ID = 201,202,203,204,205,206,207,208,209
StartTime = (Get-Date).AddDays(-30)
} | Group-Object Id | Sort-Object Count -Descending
Run it on every DC, not the one you always log into. While you are in there, confirm the box actually took the March 10 and April 14, 2026 rollups, since those are the KerberLoss and ResetNightmare fixes and nothing above will tell you if it did not.
Fun Retro SysAdmin Fact
Because Kerberos 4 used DES, the United States classified it as auxiliary military equipment on the Munitions List and banned its export, so MIT shipped an international version with every encryption function and every call to one surgically removed, named “Bones,” until Eric Young at Bond University in Australia re-implemented DES back into it to produce “eBones,” which went on to become the ancestor of the Swedish KTH-KRB and Heimdal implementations.
Final Item Worth Your Time
Semperis - “Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover” - Shai Laron’s writeup of the Black Hat research behind this issue’s Take, with the full mechanism for both KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). It is a vendor blog and there is a product pitch in the detection section, so read it for the research and skip the rest; the CVEs and the patch dates stand on their own.
Until Next Week
Patch Tuesday is a date on a calendar, not evidence that anything actually happened. Make sure those patches get installed!
Stay Frosty,
Andy
SysAdmin Weekly