Solution Architect @ Coretek | 4 boys | Bestest Wife | Cybersecurity, Microsoft, Cloud, AI, VMware, EUC, Citrix ¦ Griller, Medieval Combat, Hiking, RPGs
"Off-Prem"
Joined October 2009
- Tweets27.2K
- Following2.5K
- Followers1.9K
- Likes11.5K
Phillip Jones retweeted
I’ve spent 1,000 hours, just in the last year, pentesting Windows and Active Directory environments. These are some of the most recurring and most dangerous issues I see. If there's anything I wish IT admins would fix, these would be it.
Phillip Jones retweeted
OK, so this is actually a pretty big deal 🥳
Microsoft removed the Entra P1 license requirement to export logs from Entra to Azure Storage or Event Hub
Even better, Azure Data Explorer offers up to 100GB free data ingestion from these - a huge win for small/low resource orgs
Phillip Jones retweeted
PSA The next major release of Graph PowerShell will drop support for Windows PowerShell.
PS7 only going forward...
Investing in a more reliable Microsoft Graph PowerShell experience
devblogs.microsoft.com/micro…
Phillip Jones retweeted
For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how…
Jerry Devore’s awesome series on Active Directory hardening.
Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege
Links for each one👇
techcommunity.microsoft.com/…
Phillip Jones retweeted
If there is one thing you can do to up your game, it's build labs and configure and harden ALL OF IT.
Implement things like SSO, MTA's, SSPMs, CSPMs, SIEM, EDR, AV, Group Policy, PKI, Exchange, DLP, Hacktive Directory, ADCS, ADFS, SharePoint, Teams, 3rd party SaaS, IdP chaining, Intune, SCCM, Web Servers, Databases, File Servers, etc. ALL OF IT.
I realize I'm lucky because I helped build a smaller org (about 2500 Members at the time) in a tiger team. I got to feel all those pains and cry all those tears. I didn't do anything but work for almost a year straight. But before that, I built infrastructure and labs all the time both at work and in my free time.
You have to build it to better understand it. You have to.
If there is another things you can do after you build it: Learn adversarial tradecraft. Not exploiting CVEs. Exploiting configuration based vulnerabilities. Replicate attacks you see in threat reports. Create incidents in your lab and respond to them yourself. If there is a log somewhere, study it.
Nobody taught me how to do all this. I learned it myself.
Phillip Jones retweeted
Microsoft Entra Connect Sync upgrade required before September 30, 2026!
All synchronization services in Microsoft Entra Connect Sync will STOP working on September 30, 2026 if you're not on at least version 2.5.79.0.
In May 2025, Microsoft released this version with a back-end service change that hardens its services. Upgrade before this deadline to avoid any service disruption.
Microsoft strongly recommends upgrading to the latest available version 2.6.84.0, rather than only meeting the minimum version requirement.
Version 2.6.84.0 includes security fixes and is the current recommended release.
If you're unable to upgrade before the deadline, all synchronization services will FAIL until you upgrade.
The Microsoft Entra Connect Sync .msi installation file is exclusively available on Microsoft Entra Admin Center.
Make sure you meet the minimum requirements, including .NET Framework 4.7.2 and TLS 1.2.
Learn more:
- alitajran.com/upgrade-micros…
- learn.microsoft.com/en-us/en…
#Microsoft365 #EntraID #EntraConnect #Cybersecurity
Phillip Jones retweeted
Great breakdown on ablated models.
Phillip Jones retweeted
Risk assessment is hard. Even for professionals who’ve been doing it for years.
When I first started my cybersecurity career, I had this shocking revelation: so EVERYTHING is broken? Everything is hackable?
And that’s an expected emotional reaction when you first get stared assessing risk. Then you learn how to manage it.
Today we’re seeing a LOT of people assess risk for their first time, and the reaction that naturally follows.
Phillip Jones retweeted
There are numerous ways to extract cloud credentials (like tokens) once an attacker gains access to a workstation. Protect your cloud admin credentials as Tier 0.
trustedsec.com/blog/securing…
Phillip Jones retweeted
Signup and info here: workplaceninjas.us/
Is Active Directory indefensible or can it be adequately defended? I think you already know the answer to that... 😉
Come to Scottsdale in January for an exclusive debate @wpninjasus. @merill and I will be talking about Active Directory and Entra security.
This event is going to be one of the largest gatherings of Microsoft MVPs outside of the Microsoft MVP summit. A great place to learn and network.
Rising tides lift all boats and I am so 100% down for anything and everything that helps us accomplish that.
Should have gotten the extended warranty. All it would have taken is a Pic @secretlabchairs #oops
Phillip Jones retweeted
If you’ve ever wanted to learn more about Active Directory, now is your chance.
A list of Active Directory Domain Services modules on Microsoft Learn sorted from introductory to advanced.
Thank you Orin!
techcommunity.microsoft.com/…
Phillip Jones retweeted
The most requested feature for the last 6 years is now available
📢 Now available: Remote Help Unattended Support with Remote Sign-In for @Windows is now available in @MSIntune!
Reduce scheduling delays, support remote sites, and troubleshoot devices securely even when no user is signed in.
➡️ Learn more: aka.ms/Intune/Remote-Help-Un…
#MSIntune #IntuneInspired
Phillip Jones retweeted
I wrote a new Task Manager that runs natively on Windows, macOS, and Linux. You can get it now at tmog.org ... but why?
Well, it started as an argument over whether you could vibe code Microsoft Word today. I didn't think so. But I figured... maybe something simpler like Task Manager. But you can't just tell Claude, "Hey, write a task manager!" Well, you can, but it'll be hot garbage.
Then my kid blew out his appendix and needed surgery, so I had a couple of days in waiting rooms to tinker with the idea. I broke out my new M5 MacBook Air, and I put together a 107-page spec, like I was some caffeine-addled PM from the 90s. Everything you could ever want to know about a task manager, how it works, what it should do, and what it should look like.
By the time he was out of the hospital, I had a rough app working. But then he started bleeding internally, needed emergency surgery and a blood transfusion. Happy to say he's all better now - but suffice to say I had the rest of the week to tinker as he healed.
But why write a Task Manager? Because when I wrote the original in '95, it was on a P90 or something equally weak. Updating, scrolling, and painting without using more than a percent or two of the CPU was the modest goal.
Now that we have 5 GHz CPUs and GPUs to help, why not push the limits? Animate everything at 60Hz, instead of once a second. History mouse tracking, a summary page, and all the features I would have added then if the hardware had allowed it.
My autism leads me to embrace neon and high contrast in a way that's not to everyone's taste, so there's a saturation slider to control the color. But this one goes to 11.
You can also select from a bunch of DEC VT220-inspired themes like Green Phosphor, Amber, or White. And I added Blue to match my VSCode theme!
The code is fully native: Direct2D/DirectComposition on Windows, UIKit on Mac, and Qt on Linux. The UI communicates with a shared CPP core, which branches out to platform-specific helpers. There's NO electron, HTML, JSON, etc.
Thanks to David and Rutger for their help along the way, I couldn't have done it this quickly on three platforms without them!
If you've got some cycles to spare, give it a try and let me know if you run into any issues!
tmog.org
Phillip Jones retweeted
Pin down which sites, items, and sharing links every agent can reach with Data Access Governance. DLP and sensitivity labels in Purview restrict agent access to labeled content and tag everything generated. Start here. youtu.be/G6Aot9UCePU Apply Zero Trust controls to every AI agent in your environment across identity, tool usage, and data access. Extend Conditional Access in Microsoft Entra to evaluate every agent authorization request in real time against the same risk signals as human users. Assign each agent its own managed identity with Entra Agent ID and scope permissions with Access Packages. Govern your MCP catalog as a software supply chain. #ZeroTrustAI #dataprotection #cloudsecurity #zerotrustsecurity #cybersecurity #zerotrust
Phillip Jones retweeted
🚨 Microsoft Entra ID CVSS 10.0 Vulnerability Reported as Actively Exploited
A maximum-severity vulnerability affecting Microsoft Entra ID has been disclosed, with Microsoft reportedly indicating that the vulnerability is being actively exploited.
Tracked as CVE-2026-69836, the vulnerability involves deserialization of untrusted data and can allow an unauthorized attacker to execute code over a network.
* CVE: CVE-2026-69836
* Product: Microsoft Entra ID
* Severity: CRITICAL
* CVSS: 10.0 — assigned by Microsoft
* Weakness: CWE-502 — Deserialization of Untrusted Data
* Attack Vector: Network
* Authentication Required: None
* User Interaction Required: None
* Potential Impact: Remote code execution
* NVD lists Microsoft Entra as affected and classifies the product as an "Exclusively Hosted Service"
* CERT-FR issued advisory CERTFR-2026-AVI-1074 on August 21
* CERT-FR explicitly states that Microsoft reports CVE-2026-69836 as actively exploited
⚠️ Important Clarification:
NVD is still enriching the vulnerability record.
The current CISA SSVC information displayed through NVD lists exploitation as "none," so it would be premature to claim that CISA independently confirms active exploitation or that the vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog without additional confirmation.
⚠️ Analyst Note:
The combination of CVSS 10.0, network accessibility, no authentication requirement and no required user interaction makes this an exceptionally important identity-security vulnerability.
Because Entra ID sits at the center of authentication and identity infrastructure for many organizations, defenders should review Microsoft's guidance immediately and assess any recommended remediation or mitigation.
Official Sources:
NIST NVD:
nvd.nist.gov/vuln/detail/cve…
Microsoft MSRC:
msrc.microsoft.com/update-gu…
CERT-FR:
cert.ssi.gouv.fr/avis/CERTFR…
#DDW #Microsoft #EntraID #CVE #CyberSecurity #Vulnerability #ThreatIntelligence
Phillip Jones retweeted
A simple guided setup for emergency access accounts 😎
Recommend dev/test for now - includes setup of emergency access accounts, automated exclusion from CA policies, optional RMAU and alerting
azd init -t nathanmcnulty/azd-emergency-access && azd up
github.com/nathanmcnulty/azd…
Ensure you have at least 2 emergency (break glass) accounts for Entra ID. These should have long passwords and FIDO2 keys. Monitor and alert when logon to either of these accounts occurs.
learn.microsoft.com/en-us/en…
Phillip Jones retweeted
You may not want to believe it but it doesn’t make it any less true. You absolutely can defend Active Directory. Start by doing this:
Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege
Link to all articles 👇
techcommunity.microsoft.com/…