Engineering AD from the ground up so security is not an afterthought with Evgenij Smirnov

Andrew sits down with Evgenij Smirnov, a Berlin-based IT veteran with 30 years of experience in Active Directory and security consulting, to dig into what actually gets organizations popped. Evgenij walks through the most common escalation paths he sees in real-world AD environments, including over-permissioned accounts, exposed certificate authorities, and unencrypted domain controller backups, and he explains how attackers chain these together to produce golden tickets and gain god-mode access. The conversation covers why these misconfigurations keep happening (bad defaults, lazy vendors, and a long history of "just click next"), how PowerShell fits into both hardening and attack scenarios, and what proper tier isolation actually looks like when you implement it with both authentication policies and user rights assignments. Evgenij also introduces his book, Building Modern Active Directory, and makes the case for treating security not as a chapter you can skip, but as something baked into the design from day one.