Manage Your AD PowerShells Correctly

[MUSIC PLAYING] So how do most organizations manage their Active Directory, and how does that impact security? Yes, so right now what we see is most organizations are managing Active Directory using native methods-- the command line. Microsoft has been pushing more and more administration for Windows Server and Azure into PowerShell commands. There are over 900 PowerShell commands alone to manage Active Directory, from user provisioning, group management, attribute populations. It's this scripting that gives an administrator a lot of control, but it also introduces complexity into an environment. And left unchecked, it can breed micro developing, unknown dependencies, and security misconfigurations. And to add on top of this, what we see is most organizations really only have one person on staff who's proficient in PowerShell. This is one person who's writing and managing all these scripts, while the rest of the administration team has no idea which scripts are running, what dependencies are out there, and whether those scripts are bypassing security controls, wittingly or unwittingly. And so this is why in 2019 I make a bold prediction that we'll see the first multi-tenancy breach of Azure AD or Office 365. And the likely culprit will be scripting misconfigurations. [MUSIC PLAYING]