Arnav Sharma • 5/31/2026

Changing Your Password Won’t Save You

This article discusses why simply resetting a compromised password in Active Directory is insufficient for security. It highlights how Windows caches password hashes locally, allowing old credentials to work until devices reconnect. Kerberos tickets remain valid after a reset, enabling attackers to maintain access. Hybrid environments with Entra ID sync create additional windows of vulnerability. Attackers use pass-the-hash techniques and active tickets to bypass resets. The article emphasizes the need for forced domain reconnects, cache refreshes, and ticket purging during incident response.

0 comments

#Active Directory #Password Security #Incident Response