The Security Concepts Behind AD and Entra ID

Tue, 21 Jul 2026 15:11:09 +0530

The Point

Ten security concepts sit underneath almost everything that goes wrong in Windows and cloud environments. Each one is a form of trust — Windows or Entra ID issuing a token, a ticket, or a permission and then trusting it without double-checking. Attackers don’t invent new categories of attack; they find a way to get one of these ten things issued to them, forge it, or steal it. This post walks through each one in plain language, with a real example, the flaw that makes it exploitable, how to spot abuse, and how to close the gap.

One-Line Server Inventory & AD Audit Report

Sat, 04 Oct 2025 10:00:00 +0530

Purpose

Every Windows environment I inherit has the same problem — nobody knows what’s actually on the servers. Who’s got a password older than a year? Which computers haven’t checked in for six months? Is BitLocker actually on? This one-liner bootstraps VB.ServerInventory and produces a full server + AD audit report in a single run. No agent, no console, no license.

What This Covers

What the bootstrap script actually does (line by line)
The report it produces and what’s in it
Which security baselines the audit checks map to
How to run it and verify the output

Before You Start

Windows Server 2016+ or Windows 10/11 with PowerShell 5.1 or later
Local admin on the target machine
Domain admin (or delegated read) if you want the AD, GPO, and DHCP sections populated
Internet access to reach PSGallery and the gist
ExecutionPolicy needs to allow the run — the script sets Unrestricted for CurrentUser scope

The Bootstrap

Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

# Enforce TLS 1.2 — PSGallery rejects older protocols
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Register PSGallery if it's missing (fresh servers often have no repos)
if (-not (Get-PSRepository -Name "PSGallery" -ErrorAction SilentlyContinue)) {
 Register-PSRepository -Default -ErrorAction Stop
}

# Trust PSGallery so Install-Module doesn't prompt
Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted

# Widen the console buffer so nothing scrolls off screen
$host.UI.RawUI.BufferSize = New-Object System.Management.Automation.Host.Size(500, 9000)

Get-PSRepository

# Pull and execute the inventory script from the gist
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex (Invoke-WebRequest "https://gist.githubusercontent.com/Vibhu2/9a4ecf03d30c35d27073c71a2d5f0d4d/raw/b0541f3663701a2b16d0e1a8fd4a4030f9bf70ee/gistfile1.txt" -UseBasicParsing).Content

The first block is prep — TLS, repo trust, buffer size. The last line is the actual work: it pulls the Get-ServerInventory script from a gist and runs it in the current session.