SMB interception defenses
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit fb9fd02 · +1 −1 lines · also on GitHub
⋯ 287 unchanged lines
288288
1. **Use group Managed Service Accounts (gMSA)** - gMSA enabled services with their 127 random
289289
character construction, makes brute force and dictionary attacks to crack passwords incredibly
290290
time consuming. Read about what gMSAs are in the article
291
− [Group Managed Service Accounts Overview](../../ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview.md).
291
+ [Group Managed Service Accounts Overview](../../ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/group-managed-service-accounts-overview.md).
292292
1. **Kerberos Armoring, known as Flexible Authentication Secure Tunneling (FAST)** - FAST prevents
293293
[Kerberoasting](https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/) because the user’s pre-authentication data is protected and no longer subject to
294294
offline brute force or dictionary attacks. It also prevents downgrade attacks from spoofed KDCs,
⋯ 26 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.