Trimarc has been performing Active Directory Security Assessments (ADSAs) for more than 6 years and over this time we have assessed customer Active Directory security posture across industries in Active Directory forests with hundreds of users to over a million users. We have assessed Azure AD & Microsoft Office 365 environments with hundreds of users to almost a million users for the past 4 years with the Trimarc MCSA. The Trimarc Virtual Infrastructure Security Assessment (VISA) is a comprehensive security posture analysis of the VMware vSphere environment. This webcast will include some highlights based on the Trimarc teams knowledge and experience from numerous assessments we have performed over the years covering Active Directory, Azure AD, & VMware. This Trimarc Webcast is a standard Teams meeting structured as a panel featuring: Sean Metcalf Trimarc Founder & Microsoft Certified Master in Active Directory Tyler Robinson Trimarc Offensive Capability Lead During this Trimarc Webcast, Sean & Tyler discuss topics including ransomware, current attack methods, defensive strategies, and take questions from attendees. More information on Trimarc security assessments can be found on the Trimarc website: Trimarc Active Directory Security Assessment (ADSA) https://trimarc.co/TrimarcADSAwr Trimarc Microsoft Cloud Security Assessment (MCSA) https://trimarc.co/TrimarcMCSAwr Virtual Infrastructure Security Assessment (VISA) https://trimarc.co/TrimarcVISAwr Trimarc Enterprise Security Posture assessment (Trimarc ESP) https://trimarc.co/TrimarcESPwr Feel free to reach out to our assessment team to schedule a call to discuss the Trimarc ADSA and other Trimarc service offerings: https://trimarc.co/ContactTrimarcwr

Active Directory (AD) launched in the year 2000 and in the 20+ years since many things have changed, including attacker interest and ability to compromise AD. Trimarc has been performing Active Directory Security Assessments (ADSAs) for more than 6 years and over this time we have assessed customer Active Directory security posture across industries in Active Directory forests with hundreds of users to over a million users. Based on this experience, we have a solid understanding of the easier or more straightforward things that customers of any size can do to improve their Active Directory security and this webcast provides us the opportunity to share this information and recommendations. This Trimarc Webcast provides information about current AD attack methods attackers are leveraging to compromise Active Directory and 10 things you can do now to frustrate attackers. The goal of this presentation is to provide the best methods to improve Active Directory security quickly! Learn about attacks like NTLM & Kerberos relay as well as KrbRelayUp along with real-world advice and guidance on how to mitigate these attacks. Information is provided on the following key Active Directory security topics that are meant to help you increase the security posture of your AD environment today/this week with feasible and actionable recommendations on what to do as well as the attacks that these recommendations thwart. Sean Metcalf, Trimarc Founder & Microsoft Certified Master in Active Directory, lead this Trimarc Webcast and is joined by Trimarc team members Tyler Robinson and Darryl Baker who help cover AD security attack and defense topics. Note that this webcast is not meant to provide comprehensive AD security guidance. Instead, we focus on the "quick wins" that can enhance AD security in the short term. Trimarc plans to host a webcast in the future that will effectively be a "Part 2" to this one which covers the most important steps to hardening AD and greatly increase environment security (which tend to be more involved and take more time). This Trimarc Webcast was live-streamed and recorded on June 23rd, 2022. To learn more about Trimarc Security and to register for future live Webcasts visit https://trimarcsecurity.com Follow Sean Metcalf on Twitter @Pyrotek3 Follow Trimarc on Twitter @TrimarcSecurity Get the slides at: https://www.hub.trimarcsecurity.com/post/webcast-top-10-ways-to-improve-active-directory-security-quickly 0:00 Start 8:52 Intro 11:30 Agenda 12:41 Modern AD Attacks 34:10 Limiting Password Attacks 37:48 Review AD Admins & Highly Privileged Service Accounts 42:01 ADCS Security Checks 45:40 Kerberos Delegation Security 50:00 Auditing Insecure Protocols & Dangerous Defaults 52:45 Limiting Local Admin Accounts 56:08 Domain Controller Security 1:02:48 The Path to Tier 0 1:04:40 The Trimarc Top Ten List 1:06:09 Conclusion 1:07:44 Q&A Q&A

Trimarc Founder and Active Directory Security Subject Matter Expert, Sean Metcalf, will cover common issues with AD administration, how attackers could compromise AD admins, and the best methods to perform AD administration and protect privileged AD credentials. This webcast covers the following topics: * Common administration methods * Ways attackers can compromise administrator credentials * Securing AD administration To learn more about Trimarc Security and to register for future live Webcasts visit https://trimarcsecurity.com Follow Sean Metcalf on Twitter @PyroTek3 Follow Trimarc on Twitter @TrimarcSecurity Get the Slides at: https://www.hub.trimarcsecurity.com/post/securing-active-directory-protecting-ad-administration 0:00 Start 6:48 Intro 12:12 Agenda 12:45 Common Administration Methods 15:01 How Attackers Compromise Admins 36:24 How to Protect Admins and Administration 54:59 Q&A

Trimarc Founder and Active Directory Security Subject Matter Expert, Sean Metcalf, covers how to improve the security of your Active Directory environment by performing your own AD security review and how to identify potential issues in your environment. This webcast covers the following topics: The most common security issues Trimarc sees during AD security assessments. PowerShell commands you can run to check for potential AD security issues. Recommendations on how to fix these issues. To learn more about Trimarc Security and to register for future live Webcasts visit https://trimarcsecurity.com Follow Sean Metcalf on Twitter @Pyrotek3 Follow Trimarc on Twitter @TrimarcSecurity Get the slides and Script at: https://www.hub.trimarcsecurity.com//post/webcast-securing-active-directory-performing-your-own-ad-security-review 0:00 Start 3:44 Intro 6:20 Presentation 7:33 Agenda 8:44 Identifying AD Security Issues 17:54 AD Duplicate SPN 20:26 AD Admin Account Checks 22:48 Protected Users 38:00 Kerberos Delegation Recommendations 50:35 Tools for Reviewing AD 51:18 Invoke-TrimarcADChecks 53:25 Q&A

Trimarc Founder and Microsoft Certified Master, Sean Metcalf, will cover how to improve the security of your Office 365 & Azure AD tenant environment by exploring how attackers compromise these environments and providing recommendations on how best to secure them. This webcast covers the following topics: • How attackers compromise Office 365 • Key actions to prevent/mitigate attacks against your cloud tenant • The most important security controls to implement now and in the near future 0:00 Start 5:04 Intro 6:32 Agenda 7:28 Attacking Office 365 23:19 From Azure AD To Azure An Unanticipated Attack Path 45:03 Securing Office 365 57:21 Q&A To learn more about Trimarc Security and to register for future live Webcasts visit https://trimarcsecurity.com Follow Sean Metcalf on Twitter @Pyrotek3 Follow Trimarc on Twitter @TrimarcSecurity Get the slides at: https://www.hub.trimarcsecurity.com/post/webcast-securing-office-365-and-azure-ad-defend-your-tenant See the blog post at: https://www.hub.trimarcsecurity.com/post/from-azure-ad-to-active-directory-via-azure-an-unanticipated-attack-path

Active Directory Security and Resolving Common issues. In this webcast Trimarc Founder and Active Directory Security Subject Matter Expert, Sean Metcalf, covers how to improve the security of your Active Directory environment by identifying and resolving common issues. 0:00 Start 4:05 Intro 8:16 Agenda 9:15 Do I need Domain Admin 14:50 KRBTGT Account 18:53 Service Accounts in Domain Admins 29:32 AD Permissions 34:22 Local Administrator Passowrd Solution 35:50 Password Spraying 41:08 Kerberoasting 53:26 Domain Controller Security 1:00:06 Conclusion 1:00:56 Q&A To learn more about Trimarc Security and to register for future live Webcasts visit https://trimarcsecurity.com Follow Sean Metcalf on Twitter @Pyrotek3 Follow Trimarc on Twitter @TrimarcSecurity

Trimarc Founder Sean Metcalf's 2019 talk from Microsoft Ignite. This video was sourced from Microsoft Ignite 2019 - https://myignite.techcommunity.microsoft.com/sessions/84321