Unconstrained Kerberos delegation is one of the most dangerous misconfigurations in Active Directory — and one of the most common. Any server with this flag set is silently caching TGTs for every privileged user who connects to it. Here's how to find every account configured for unconstrained delegation in your environment and fix it with PowerShell.

Active Directory functional levels control which features are available in your domain and forest, and running on outdated levels leaves security capabilities on the table. Here's what each level unlocks and why it matters for your environment.

Active Directory health issues don't announce themselves - replication failures, DNS misconfigurations, and group policy inconsistencies build up quietly until something breaks. Here's a practical baseline health assessment you can run in any AD environment, including the exact tools and commands to use.