Jorge's Quest For Knowledge

[jsqforknowledge]

Re-awarded the Microsoft MVP Award again for the 21st time! Again for "Identity and Access"

View On WordPress

[jsqforknowledge]

The famous PowerShell script to reset the password of all KRBTGT accounts of DCs (!) found in an AD domain, either automatically or on demand has been updated with improvements, feature requests and minor bug fixes. Got feedback or request? Let me know!

View On WordPress

[jsqforknowledge]

Unidirectional forest or external trusts are unfortunately still vulnerable in W2K25 DCs/Domains. Read here what to do!

View On WordPress

[jsqforknowledge]

(2026-04-06) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 12)

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

View On WordPress

[jsqforknowledge]

(2026-02-16) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 11)

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

View On WordPress

[jsqforknowledge]

(2026-01-16) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 9)

More information can be found through the following links regarding the previous updates: (2018-12-30) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (2019-02-12) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 1) (2019-02-25) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs…

View On WordPress

[jsqforknowledge]

(2026-01-09) Oh Crap, An Application Partition Was Deleted From The AD Forest! - How To Restore It Back?

Some days ago I was reading REDDIT and stumbled across this post, where someone mistakenly deleted a DNS application partition. I responded to that post by providing steps on how to recover. In addition I also wanted to refresh my memory and see if i had written down was correct or not. All I wrote in that REDDIT post was correct with the addition of having forgotten 1 important step! WARNING:…

View On WordPress

[jsqforknowledge]

(2026-01-01) PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs (Update 8)

First things first… HAPPY NEW YEAR! Some time ago, almost 7 years ago, I wrote a PowerShell script to reset the KrbTgt Account Password of both RWDCs and RODCs. This is UPDATE 8 – FINALLY!!!!!!!! There was lots of coding and functional and stress testing of the new and updated components, and both took some serious time. In addition, I also wanted to move the documentation from individual blog…

View On WordPress

[jsqforknowledge]

(2025-11-20) Auditing KDS Root Keys Access

When using either Group Managed Service Accounts (gMSAs) or Delegated Managed Service Accounts (dMSAs) (currently only possible Windows Server 2025 DCs), in addition to some account metadata, the KDS Root Key(s) available in the AD forest play a very important part in the password (re)calculation by the writable DCs (RWDCs) when servicing a managed password request from any server that uses the…

View On WordPress

[jsqforknowledge]

(2025-11-15) Renaming Domain Controllers - Without Breaking It

I have not done this for quit some time, but because of a silly mistake I made in my test lab, I needed to rename the domain controller. Because of how it went, I wanted to share the experience of how it went wrong and also how I solved it. Many years ago, if you wanted to rename a domain controller you had to use NETDOM. Then after some it was also possible to rename through the GUI, which made…

View On WordPress

[jsqforknowledge]

(2025-11-14) 32K Pages Size vs 8K Pages Size On W2K25 DCs - That Could Be A Problem!

Just wanted to check this out myself, see what happens and add some more info. All credit is for Christoffer Andersson for discovering this issue and reporting it to MSFT. Now when you look at the documentation from Microsoft in What’s new in Windows Server 2025 For Active Directory Domain Services, you will see the following line of text (and also in Figure 1): An upgraded DC continues to use…

View On WordPress

[jsqforknowledge]

(2025-11-12) Soft-Delete For Groups In Entra ID

Previously in Entra ID, only Applications, Users, M365 Groups supported soft delete. Recently Microsoft has extended the list to now also include Cloud Security Groups as you can see below in figure 1. SOURCE: https://learn.microsoft.com/en-us/entra/architecture/recover-from-deletions Figure 1: List Of Objects In Entra ID Supporting Soft Delete When looking at “Users”, it both means native…

View On WordPress

[jsqforknowledge]

(2025-11-08) TODAY Marks 20 YEARS Of Blogging

Today, exactly 20 years ago I started blogging and created my “Jorge’s Quest For Knowledge” blog, which has been and still is being read by many people around the world. My biggest drive and passion to do this is to research and acquire knowledge, and then share it with others around the globe so that those people can use the information to their best usage in their day-to-day jobs. The very…

View On WordPress

[jsqforknowledge]

(2025-11-08) Getting Relevant Configuration Of Your Managed Service Accounts From Your AD Domain

Are you using managed service accounts (stand-alone, group or delegated), and you want or need to view and understand the configuration of those? Look no further! I have written 3 PowerShell scripts, one for each managed service account type, to display the configuration of each managed service account. When you look at the data and know how to interpreter it, you will also understand if the…

View On WordPress

[jsqforknowledge]

(2025-10-21) Managing The DSRM Administrator Account Password (Revisited)

Almost 15,5 years ago I wrote a blog post about how to manage the DSRM Administrator Account Password. That old blog post can be found here. A few days earlier back then I wrote a blog post how and when you could log on with the DSRM Administrator account. That old blog post can be found here. Looking at todays new capabilities and threats, I felt it was needed to rewrite those blog posts,…

View On WordPress

[jsqforknowledge]

(2025-09-02) From BadSuccessor To PatchedSuccessor

Microsoft released Windows Server 2025 some time ago and one of the cool features is “delegated Managed Service Accounts (dMSA)”. With a dMSA, in general, you can migrate an existing (legacy) service account used for a service, scheduled task or application pool and have that dMSA do whatever that (legacy) service account is doing. In other words, the dMSA takes over the functionality of the…

View On WordPress

[jsqforknowledge]

(2025-07-11) How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration

This is a cross posting from the Semperis blog where this blog post was initially posted on 2025-07-10 and also written by me. The link to the Semperis blog post is: How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration ================================================================== Author: Jorge de Almeida Pinto, Semperis Senior Incident Response Lead Key…

View On WordPress