Latest / The Identity Blueprint / The Business Case for Killing Active Directory

Transcript

The Business Case for Killing Active Directory · The Identity Blueprint

• 0:00
  SPEAKER_01: You won't find a line item on your balance sheet labeled Active Directory.
• 0:04
  SPEAKER_01: But if you're a distributed enterprise, you're paying for it twice.
• 0:08
  SPEAKER_01: Once in the branch servers, quietly draining power and patching hours, and again in the advanced security features sitting unused in the Microsoft licenses you already bought.
• 0:19
  SPEAKER_01: This episode makes the financial and risk case for retiring on-prem Active Directory.
• 0:25
  SPEAKER_01: Not through a chaotic rip and replace, but through a deliberate, board-approved policy of attrition.
• 0:31
  SPEAKER_01: We walk through the six rules that stop new dependencies from being born, the three-phase model that lets the old infrastructure age out naturally, and the actual numbers, ransomware costs, outage costs, recovered engineering hours that turn this from an IT initiative into a CFO-approved mandate.
• 0:51
  SPEAKER_01: Imagine uh an attacker breaches your network.
• 0:55
  SPEAKER_01: Like someone clicks a phishing link, or maybe a firewall misconfiguration leaves just one minor server exposed.
• 1:01
  SPEAKER_00: Right, the usual starting point.
• 1:03
  SPEAKER_01: Yeah, exactly.
• 1:04
  SPEAKER_01: So how long do you think it takes for that attacker to own your entire company?
• 1:08
  SPEAKER_01: For you listening, maybe you're thinking days or you know, maybe weeks.
• 1:14
  SPEAKER_01: Aaron Powell But according to the instant response data we're looking at today, it takes a median of exactly 3.4 hours.
• 1:20
  SPEAKER_00: Terrifyingly fast.
• 1:21
  SPEAKER_01: It really is.
• 1:22
  SPEAKER_01: So welcome to the deep dive.
• 1:24
  SPEAKER_01: Today we are looking at a fundamental flaw in enterprise IT for you, the listener.
• 1:30
  SPEAKER_01: And well, we have a very specific mission.
• 1:32
  SPEAKER_00: Aaron Powell We do.
• 1:32
  SPEAKER_00: We're getting into the weeds today.
• 1:34
  SPEAKER_01: We are.
• 1:34
  SPEAKER_01: We're analyzing a strategic architectural blueprint for organizations that are already licensed for Microsoft 365, specifically uh those with intra-ID P1 or P2 licenses.
• 1:45
  SPEAKER_00: Right, which is a huge chunk of enterprises right now.
• 1:48
  SPEAKER_01: Exactly.
• 1:48
  SPEAKER_01: And our sources outline this really radical, but I guess mathematically necessary premise, which is retiring on-premises active directory.
• 1:57
  SPEAKER_01: Not through some chaotic, you know, cut over weekend, but through a deliberate policy of attrition.
• 2:03
  SPEAKER_01: And I want to make sure you understand this isn't just IT theory.
• 2:06
  SPEAKER_01: This is a financial and risk reduction imperative that totally changes how a business operates.
• 2:12
  SPEAKER_00: It really does.
• 2:13
  SPEAKER_00: I mean, it's a premise that challenges decades of architectural dogma, honestly.
• 2:17
  SPEAKER_00: But we have to look at the reality of how a distributed business actually operates today.
• 2:21
  SPEAKER_01: Yeah, it's totally different now.
• 2:23
  SPEAKER_00: Exactly.
• 2:24
  SPEAKER_00: Maintaining that legacy identity infrastructure, it just isn't just an IT headache anymore.
• 2:29
  SPEAKER_00: It is a massive financial drain, and it represents a concentration of risk that is uh almost impossible to defend against using modern security standards.
• 2:39
  SPEAKER_01: Aaron Powell So let's start with the financial side of that, because the sources paint a picture of what they call the stranded capital problem.
• 2:45
  SPEAKER_00: Aaron Powell That's a great term for it.
• 2:46
  SPEAKER_01: Right.
• 2:47
  SPEAKER_01: The premise is that organizations are essentially paying twice for identity management.
• 2:51
  SPEAKER_01: But I mean, I look at my own company's balance sheet, and I definitely don't see a line item labeled Active Directory.
• 2:57
  SPEAKER_00: Aaron Powell No, you wouldn't.
• 2:57
  SPEAKER_00: It's hidden.
• 2:58
  SPEAKER_01: Aaron Powell So where is this double payment actually happening?
• 3:00
  SPEAKER_01: Like where's the money going?
• 3:01
  SPEAKER_00: Aaron Powell Well, it's completely hidden in operational overhead.
• 3:04
  SPEAKER_00: Like when people think of on-premises Active Directory, they usually just picture a couple of servers sitting in a rack in the main headquarters, you know.
• 3:10
  SPEAKER_01: Aaron Powell Yeah, just a blanking box in a closet somewhere.
• 3:13
  SPEAKER_00: Aaron Ross Powell Exactly.
• 3:14
  SPEAKER_00: But if you're a distributed enterprise, say you have 50 branch offices, retail stores, or maybe manufacturing plants, the reality is an incredibly sprawling physical footprint.
• 3:27
  SPEAKER_01: Aaron Powell Oh, because they need servers everywhere.
• 3:28
  SPEAKER_00: Aaron Powell Right.
• 3:29
  SPEAKER_00: In a legacy architecture, you likely have local servers acting as domain controllers at every single one of those locations just to handle local logins.
• 3:38
  SPEAKER_00: Wow.
• 3:38
  SPEAKER_00: Okay.
• 3:39
  SPEAKER_00: And each of those physical boxes requires power, cooling, rack space, and you know, a dedicated network drop.
• 3:46
  SPEAKER_01: Aaron Powell And obviously someone has to maintain them, right?
• 3:48
  SPEAKER_00: Trevor Burrus That is the real cost.
• 3:50
  SPEAKER_00: I mean, it's the full lifecycle burden.
• 3:52
  SPEAKER_00: Every month, an engineering team has to apply operating system patches to dozens, if not hundreds, of domain controllers.
• 3:59
  SPEAKER_01: Aaron Powell That sounds miserable.
• 4:01
  SPEAKER_00: Aaron Powell It is.
• 4:01
  SPEAKER_00: And they have to maintain specialized backup infrastructure just to capture the system state of those directories.
• 4:07
  SPEAKER_00: They pay for third-party monitoring tools to watch for CPU spikes, disk space issues, replication failures.
• 4:13
  SPEAKER_00: Trevor Burrus, Jr.
• 4:14
  SPEAKER_01: So it's just a constant drain on resources.
• 4:16
  SPEAKER_00: Totally.
• 4:16
  SPEAKER_00: And then there's disaster recovery.
• 4:18
  SPEAKER_00: Building and maintaining a disaster recovery run book for Active Directory is a monumental task.
• 4:24
  SPEAKER_01: I can only imagine.
• 4:25
  SPEAKER_00: The labor hours spent just keeping this legacy infrastructure breathing are staggering.
• 4:31
  SPEAKER_00: But it's treated as a sunk capital cost.
• 4:33
  SPEAKER_00: So the CFO rarely scrutinizes it.
• 4:36
  SPEAKER_00: It's just viewed as free because the servers already bought.
• 4:39
  SPEAKER_01: Right.
• 4:39
  SPEAKER_01: They just ignore the massive operational drag.
• 4:41
  SPEAKER_01: So that's the money going out the door to maintain the past.
• 4:44
  SPEAKER_00: Yeah.
• 4:44
  SPEAKER_01: But the stranded capital argument, it relies on the idea that we are also paying for the future and just like leaving it in the box.
• 4:51
  SPEAKER_00: Yes, exactly.
• 4:52
  SPEAKER_01: So if a company's already paying for intra ID P1 or P2, which most are, just to get email and SharePoint working in Microft 365, what exactly are they buying but not using?
• 5:03
  SPEAKER_00: Well, they are paying for an entire suite of advanced features, modern zero trust security tools that simply cannot function on legacy infrastructure.
• 5:13
  SPEAKER_01: Aaron Powell Like what?
• 5:14
  SPEAKER_01: Give me an example.
• 5:16
  SPEAKER_00: Let's look at conditional access, which is included in P1.
• 5:18
  SPEAKER_00: In the old world, if you had the right password, you got in.
• 5:21
  SPEAKER_00: Simple as that.
• 5:22
  SPEAKER_01: Right.
• 5:22
  SPEAKER_00: Conditional access changes that dynamically.
• 5:25
  SPEAKER_00: It evaluates trillions of signals.
• 5:27
  SPEAKER_00: Like where is the user logging in from?
• 5:30
  SPEAKER_00: Is the device they're using compliant with our security policies?
• 5:33
  SPEAKER_01: Oh, I see.
• 5:34
  SPEAKER_00: Yeah.
• 5:34
  SPEAKER_00: Are they suddenly logging in from a country we don't even do business in?
• 5:38
  SPEAKER_00: It uses those signals to grant, block, or require multi-factor authentication in real time.
• 5:45
  SPEAKER_01: That makes sense.
• 5:46
  SPEAKER_01: Yeah.
• 5:46
  SPEAKER_01: It's like buying a state-of-the-art smart home security system, right?
• 5:49
  SPEAKER_01: With cameras and motion sensors and all that.
• 5:53
  SPEAKER_01: But then stubbornly continuing to pay a night watchman who only checks the front door and like falls asleep on the job.
• 5:59
  SPEAKER_00: Which is legacy AD.
• 6:01
  SPEAKER_01: So why are businesses so reluctant to turn on the features they've already bought?
• 6:06
  SPEAKER_01: I mean, if I'm still using on-prem AD for my core applications, conditional access can't really protect those apps, right?
• 6:13
  SPEAKER_00: Precisely.
• 6:14
  SPEAKER_00: You are paying for a world-class bouncer, but you're leaving the back door of the club completely unguarded.
• 6:19
  SPEAKER_00: You literally can't use the new tools on the old apps.
• 6:22
  SPEAKER_01: That is wild.
• 6:23
  SPEAKER_00: And it goes further with UNTRA IDP too.
• 6:26
  SPEAKER_00: You are paying for risk-based identity protection.
• 6:29
  SPEAKER_01: Aaron Powell How does that one work?
• 6:30
  SPEAKER_00: If a user's credentials leak on the dark web, this system knows.
• 6:34
  SPEAKER_00: And it can automatically force a password reset or block access before an attacker even tries to log in.
• 6:40
  SPEAKER_01: Oh wow.
• 6:41
  SPEAKER_01: That's incredibly proactive.
• 6:42
  SPEAKER_00: It is.
• 6:43
  SPEAKER_00: And you are also paying for privileged identity management.
• 6:46
  SPEAKER_01: Wait, let's pause on privileged identity management or PM.
• 6:49
  SPEAKER_01: Yep.
• 6:49
  SPEAKER_00: PM.
• 6:50
  SPEAKER_01: Walk me through the mechanics of that.
• 6:51
  SPEAKER_01: Why does an organization need PM?
• 6:53
  SPEAKER_00: Well, think about how IT administration usually works.
• 6:56
  SPEAKER_00: A senior engineer is given a domain admin account.
• 6:59
  SPEAKER_00: They hold that immense unrestricted power 24-7, 365 days a year.
• 7:04
  SPEAKER_01: Even when they aren't working.
• 7:06
  SPEAKER_00: Exactly.
• 7:07
  SPEAKER_00: Even when they are asleep or on vacation or sitting at a coffee shop on a Saturday, if their account is compromised at any point, the attacker has permanent keys to the kingdom.
• 7:17
  SPEAKER_01: That seems like a massive oversight.
• 7:19
  SPEAKER_00: It is.
• 7:20
  SPEAKER_00: So PIM changes this to just in time access.
• 7:24
  SPEAKER_01: Aaron Powell Meaning they aren't actually an admin most of the time.
• 7:27
  SPEAKER_00: Correct.
• 7:27
  SPEAKER_00: Their default state is a standard unprivileged user.
• 7:31
  SPEAKER_00: When they actually need to perform administrative work, they log into the PM portal, request temporary elevation, provide a business justification, and perhaps wait for a manager's digital approval.
• 7:42
  SPEAKER_01: Aaron Powell So there's a whole workflow to it.
• 7:44
  SPEAKER_00: Right.
• 7:44
  SPEAKER_00: And once approved, they are granted admin rights for a strict, time-bound window, say two hours.
• 7:50
  SPEAKER_00: When the timer runs out, the access is automatically revoked.
• 7:53
  SPEAKER_01: That's brilliant.
• 7:54
  SPEAKER_01: You drastically shrink the attack surface.
• 7:56
  SPEAKER_00: Aaron Powell You really do.
• 7:57
  SPEAKER_00: And P2 also includes automated access reviews, which force managers to periodically certify that their employees still need access to sensitive data.
• 8:06
  SPEAKER_01: Oh, so no more lingering permissions from a role change five years ago.
• 8:10
  SPEAKER_00: Exactly.
• 8:10
  SPEAKER_00: And it also includes robust passwordless authentication capabilities.
• 8:14
  SPEAKER_01: So just to summarize, organizations are pouring money and sweat into patching 25-year-old branch servers while simultaneously paying Microsoft for risk-based identity protection, time-bound administration, all these P1 and P2 features, and they aren't even turning them on.
• 8:30
  SPEAKER_00: It's psychological and operational inertia.
• 8:33
  SPEAKER_01: I understand the financial waste, but you know, wasting money on unused licenses is bad enough.
• 8:38
  SPEAKER_01: Keeping this legacy infrastructure alive isn't just a financial leak.
• 8:42
  SPEAKER_01: It's actively keeping the organization's most vulnerable attack surface exposed.
• 8:47
  SPEAKER_00: Absolutely.
• 8:48
  SPEAKER_01: We must examine the actual risk this legacy architecture poses, because the source material shifts very quickly from this is inefficient to this is an existential threat to the survival of the business.
• 8:58
  SPEAKER_00: And they aren't exaggerating.
• 9:00
  SPEAKER_00: The risk concentration in on-premises AD is unparalleled in modern IT.
• 9:04
  SPEAKER_00: We really have to look at the exact figures provided by independent incident response data here.
• 9:09
  SPEAKER_01: Let's hear them.
• 9:10
  SPEAKER_01: The numbers in the report were pretty stark.
• 9:12
  SPEAKER_00: They are.
• 9:12
  SPEAKER_00: More than 78% of human-operated ransomware intrusions involve a breached domain controller.
• 9:18
  SPEAKER_01: Wait, really?
• 9:18
  SPEAKER_01: Over three-quarters of ransomware attacks hinge on that specific piece of infrastructure.
• 9:23
  SPEAKER_00: Yes.
• 9:24
  SPEAKER_00: More than 78%.
• 9:26
  SPEAKER_00: And in roughly a third of incidents, the domain controller is actively used to distribute the ransomware payload.
• 9:32
  SPEAKER_01: That is insane.
• 9:34
  SPEAKER_01: It's doing the hackers' jobs for them.
• 9:35
  SPEAKER_00: Aaron Powell It is.
• 9:36
  SPEAKER_00: Overall, independent incident response data places AD compromise in approximately nine out of ten investigated intrusions.
• 9:45
  SPEAKER_00: Yeah.
• 9:46
  SPEAKER_00: And we mentioned the speed earlier.
• 9:47
  SPEAKER_00: Attackers reach Active Directory a median of 3.4 hours after initial access.
• 9:53
  SPEAKER_01: I want to understand the mechanics of that 3.4 hour window because that is terrifyingly fast.
• 9:58
  SPEAKER_01: Aaron Powell.
• 10:00
  SPEAKER_01: I mean, so if an attacker fishing a junior marketing employee at 9.0 AM means the attacker is sitting on the domain controller by lunchtime, something is structurally wrong with the architecture.
• 10:11
  SPEAKER_00: Aaron Powell You're completely right.
• 10:12
  SPEAKER_01: Why does Active Directory concentrate risk so heavily?
• 10:14
  SPEAKER_01: Like why is it so vulnerable?
• 10:16
  SPEAKER_00: Well, there are three fundamental structural reasons.
• 10:19
  SPEAKER_00: The first is that it represents a single point of total compromise.
• 10:22
  SPEAKER_01: Aaron Powell Okay, unpack that for me.
• 10:23
  SPEAKER_00: Active Directory was designed as a monolithic trust boundary.
• 10:27
  SPEAKER_00: It holds every credential, it manages every group policy, and it dictates trust relationships across the entire network.
• 10:35
  SPEAKER_01: So it's the master key.
• 10:36
  SPEAKER_00: Exactly.
• 10:37
  SPEAKER_00: If an attacker manages to elevate their privileges to a domain admin, there is no isolation.
• 10:43
  SPEAKER_00: Owning the directory means owning every single device, every server, every database, and every identity joined to it.
• 10:51
  SPEAKER_01: So the Blast Radios isn't limited to one department or one application, it is the entire enterprise.
• 10:56
  SPEAKER_00: The entire enterprise.
• 11:09
  SPEAKER_01: How does that actually work in an attack scenario?
• 11:12
  SPEAKER_01: Because you mentioned earlier that in roughly a third of incidents, the domain controller is used to distribute the ransomware.
• 11:17
  SPEAKER_00: Right.
• 11:17
  SPEAKER_01: Are you saying the attacker doesn't even have to write their own deployment tools like they just use the ones we built?
• 11:22
  SPEAKER_01: And our own highly efficient AD replication is actually weaponized against us.
• 11:26
  SPEAKER_00: That is exactly what happens.
• 11:28
  SPEAKER_00: AD is designed for resilience and consistency.
• 11:31
  SPEAKER_00: If an IT admin creates a new user on a domain controller in New York, the AD replication engine ensures that information is synchronized to the domain controller in London within minutes.
• 11:42
  SPEAKER_01: Which is great for normal business operations.
• 11:44
  SPEAKER_00: It is a highly efficient, highly trusted mechanism.
• 11:47
  SPEAKER_00: But the system has absolutely no way to distinguish between a legitimate IT admin and an attacker who has stolen an admin's credentials.
• 11:55
  SPEAKER_01: Oh, I see.
• 11:56
  SPEAKER_00: None whatsoever.
• 11:57
  SPEAKER_00: If an attacker compromises the environment, they don't need to manually hack every single workstation in the company.
• 12:05
  SPEAKER_00: Exactly.
• 12:06
  SPEAKER_00: They simply create a new group policy object containing their ransomware payload and link it to the root of the domain.
• 12:12
  SPEAKER_00: Active Directory's own highly efficient replication engine dutifully copies that malicious policy to every branch office globally.
• 12:20
  SPEAKER_00: Yeah.
• 12:21
  SPEAKER_00: And when the employees log in, their own trusted domain controllers push the execution command to their workstations.
• 12:27
  SPEAKER_00: The architecture weaponizes your own efficiency against you.
• 12:31
  SPEAKER_01: That is incredibly dark.
• 12:32
  SPEAKER_01: And what about persistence?
• 12:35
  SPEAKER_01: I've seen terms in our research like golden tickets and DC sync attacks.
• 12:39
  SPEAKER_01: How do those factor into this replication of malice?
• 12:42
  SPEAKER_00: Those highlight how deeply attackers can embed themselves.
• 12:46
  SPEAKER_00: A golden ticket attack involves the attacker stealing the cryptographic key of the specific account that issues Kerberos tickets for the entire domain.
• 12:54
  SPEAKER_01: Aaron Powell The KRBTGT account, right?
• 12:57
  SPEAKER_00: Yes, the KRBTGT account.
• 12:59
  SPEAKER_00: Once they have that key, they can forge a valid access ticket for any user to any resource at any time.
• 13:05
  SPEAKER_01: Even if you change all the passwords?
• 13:06
  SPEAKER_00: Even if you change all the passwords, they bypass the password check entirely.
• 13:10
  SPEAKER_01: That's terrifying.
• 13:10
  SPEAKER_01: And what about the other one, the DC sync attack?
• 13:12
  SPEAKER_00: A DC sync attack is even more insidious.
• 13:15
  SPEAKER_00: The attacker uses a compromised admin account to literally instruct the primary domain controller to synchronize its data with the attacker's machine.
• 13:23
  SPEAKER_01: Wait, hold on.
• 13:24
  SPEAKER_01: The attacker's laptop just pretends to be a domain controller.
• 13:27
  SPEAKER_00: Essentially, yes.
• 13:28
  SPEAKER_00: The attacker issues a standard directory replication command.
• 13:32
  SPEAKER_00: The real domain controller assumes it's talking to a legitimate peer and hands over the password hashes for every single user in the company.
• 13:40
  SPEAKER_01: Just hands them over.
• 13:42
  SPEAKER_01: Because it's designed to do that.
• 13:43
  SPEAKER_00: Because it's just doing its job.
• 13:46
  SPEAKER_01: So if these protocols are fundamentally outdated and their behavior is so well understood by attackers, I mean they are exploiting the fundamental design of Kerberos and directory replication.
• 13:58
  SPEAKER_01: Why can't Microsoft just issue a patch, like just send down a security update?
• 14:02
  SPEAKER_00: Aaron Powell And that brings us to the third structural reason.
• 14:04
  SPEAKER_00: The core protocols of Active Directory fundamentally predate the modern threat model.
• 14:09
  SPEAKER_00: We are talking about NTLM, Kerberos delegation, and LD8.
• 14:13
  SPEAKER_01: They're just too old.
• 14:14
  SPEAKER_00: You cannot patch the foundational design of a 25-year-old protocol meant for a trusted local area network.
• 14:20
  SPEAKER_00: When Kerberos was designed, the underlying assumption was that if a user was inside the corporate firewall, they were generally trusted.
• 14:27
  SPEAKER_01: Right.
• 14:27
  SPEAKER_01: The perimeter was the security, like a mode around a castle.
• 14:30
  SPEAKER_00: Exactly.
• 14:31
  SPEAKER_00: But today, the perimeter doesn't exist.
• 14:33
  SPEAKER_00: Users are on home Wi-Fi, working from coffee shops, accessing cloud apps on personal phones.
• 14:38
  SPEAKER_01: Yeah, everyone's everywhere.
• 14:39
  SPEAKER_00: These legacy protocols have no concept of modern security contexts.
• 14:43
  SPEAKER_00: Kaberos cannot enforce phishing-resistant multi-factor authentication.
• 14:47
  SPEAKER_00: It cannot check if the laptop requesting a ticket is fully patched or secretly infected with a keylogger.
• 14:53
  SPEAKER_01: So it's flying blind.
• 14:54
  SPEAKER_00: Totally blind.
• 14:55
  SPEAKER_00: It doesn't evaluate the real-time geographic risk of the login attempt.
• 14:59
  SPEAKER_00: It simply looks at the username and the password hash, and if they match, it grants access.
• 15:05
  SPEAKER_00: You cannot issue a software update to make a 1990s protocol understand a 2026 zero trust architecture.
• 15:12
  SPEAKER_01: Aaron Powell Which explains the financial devastation when this goes wrong.
• 15:15
  SPEAKER_01: Our sources note that extended AD outages carry losses of up to$730,000 per hour.
• 15:21
  SPEAKER_00: Up to$730,000 per hour.
• 15:23
  SPEAKER_01: Yes.
• 15:24
  SPEAKER_01: Just hemorrhaging money.
• 15:25
  SPEAKER_01: And if you have to rebuild it, the sources say full force recovery is a 50 to 100 step manual procedure most organizations have never rehearsed.
• 15:32
  SPEAKER_00: Never rehearsed once.
• 15:33
  SPEAKER_01: It sounds like if you get hit, you are essentially starting the company's IT from scratch.
• 15:37
  SPEAKER_00: You really are.
• 15:39
  SPEAKER_00: Rebuilding an entire Active Directory forest from bare metal, ensuring no persistent attacker backdoors were backed up in the system state, and then restoring trust across thousands of endpoints, it is a nightmare scenario that can take weeks.
• 16:01
  SPEAKER_01: But I mean, anyone who has spent 10 minutes in enterprise IT knows you can't just unplug the domain controllers.
• 16:07
  SPEAKER_01: It's the central nervous system of the company.
• 16:09
  SPEAKER_01: Doing a rip and replace of the heart of an IT network is terrifying.
• 16:13
  SPEAKER_00: Oh, it usually results in someone getting fired.
• 16:16
  SPEAKER_01: Right.
• 16:16
  SPEAKER_01: So the solution isn't a migration then.
• 16:18
  SPEAKER_01: It's establishing a very specific set of rules to stop the bleeding.
• 16:22
  SPEAKER_00: Aaron Powell Exactly.
• 16:22
  SPEAKER_00: This is the critical paradigm shift here.
• 16:24
  SPEAKER_00: Organizations fail when they try to violently uproot decades of legacy tech in one go.
• 16:30
  SPEAKER_00: The solution is the cloud first policy.
• 16:32
  SPEAKER_00: Trevor Burrus, Jr.
• 16:33
  SPEAKER_01: The cloud first policy.
• 16:34
  SPEAKER_01: Okay, let's get into this.
• 16:35
  SPEAKER_01: Introduce this concept for us.
• 16:36
  SPEAKER_00: Aaron Powell It is a strict procurement and commissioning rule.
• 16:39
  SPEAKER_00: It changes what is allowed to be born in the IT environment.
• 16:42
  SPEAKER_01: Aaron Powell Oh, I see.
• 16:43
  SPEAKER_01: So it's like putting the legacy network on a starvation diet.
• 16:46
  SPEAKER_01: We aren't surgically removing AD today.
• 16:48
  SPEAKER_01: We are just refusing to feed it anything new.
• 16:50
  SPEAKER_00: That's a great way to look at it.
• 16:52
  SPEAKER_01: Let's walk through the six policy statements of this cloud-first approach in extensive detail because this is the actual blueprint.
• 16:58
  SPEAKER_00: Let's do it.
• 16:58
  SPEAKER_01: The first rule dictates that new applications must authenticate through intra ID via OIDC, SAML, or OOF 2.0 and may not require LDAP or Kerberos.
• 17:10
  SPEAKER_01: Walk me through the mechanics of that.
• 17:11
  SPEAKER_01: How does an app authenticate without a password?
• 17:14
  SPEAKER_00: So this rule stops the bleeding at the application layer.
• 17:18
  SPEAKER_00: Historically, when a business unit bought software, say a new HR management tool, that software would be installed on a server and it would constantly query the local domain controllers using LD app to check if a user existed, or it would use Kerberos to log them in.
• 17:33
  SPEAKER_01: Which just further entrenches the domain controller.
• 17:36
  SPEAKER_01: You now have another critical business process depending on that legacy box.
• 17:40
  SPEAKER_00: Precisely.
• 17:41
  SPEAKER_00: Under this new rule, procurement simply blocks the purchase of any software that relies on those old protocols.
• 17:48
  SPEAKER_00: The application must speak the modern language of the web.
• 17:50
  SPEAKER_01: Aaron Powell So SAML and OIDC.
• 17:52
  SPEAKER_00: Yeah.
• 17:53
  SPEAKER_00: Protocols like SAML, which stands for Security Assertion Markup Language or OpenID Connect or OIDC, they fundamentally change the trust relationship.
• 18:03
  SPEAKER_01: How so?
• 18:03
  SPEAKER_00: Instead of the application handling your password, the application redirects you to enter ID in the cloud.
• 18:09
  SPEAKER_00: You authenticate there using multi-factor auth, biometrics, whatever conditional access requires.
• 18:14
  SPEAKER_01: Okay.
• 18:15
  SPEAKER_00: And then Enter ID then hands your browser a secure, cryptographically signed token.
• 18:20
  SPEAKER_00: Your browser passes that token back to the application.
• 18:23
  SPEAKER_00: The application verifies the signature and lets you in.
• 18:26
  SPEAKER_01: So the app never even sees the password.
• 18:28
  SPEAKER_00: It never sees your password and it never talks to a legacy domain controller.
• 18:32
  SPEAKER_01: That's so clean.
• 18:33
  SPEAKER_01: But what happens when IT needs to spin up a new server for an internal project?
• 18:37
  SPEAKER_00: Yeah.
• 18:38
  SPEAKER_01: The second rule states: no newly commissioned server may join the on-premises domain.
• 18:42
  SPEAKER_00: Right.
• 18:43
  SPEAKER_01: That seems incredibly disruptive.
• 18:45
  SPEAKER_01: If it's not on the domain, how do admins even manage it?
• 18:48
  SPEAKER_00: Every time you join a Windows server to the legacy AD domain, you are anchoring it to the past.
• 18:53
  SPEAKER_00: It becomes dependent on domain controllers for identity, it relies on legacy group policy for configuration, and it immediately becomes a target for lateral movement by attackers.
• 19:04
  SPEAKER_01: So you just forbid it entirely.
• 19:06
  SPEAKER_00: By forbidding new servers from joining the domain, you force the engineering teams to adopt modern management.
• 19:12
  SPEAKER_01: Aaron Powell Which looks like what, practically speaking?
• 19:14
  SPEAKER_00: If the new server is a virtual machine hosted in the cloud, it gets managed via native cloud tools, Azure Resource Manager, Managed Identities, Cloud-based configuration management.
• 19:25
  SPEAKER_01: Okay.
• 19:26
  SPEAKER_01: What if it's physical?
• 19:27
  SPEAKER_00: If it absolutely must be a physical server running on-premises, say a local database for a manufacturing floor, it gets managed via Azure Arc.
• 19:34
  SPEAKER_01: Azure Arc?
• 19:35
  SPEAKER_00: Yeah, Azure Arc projects that on-premises server into the cloud control plane, allowing you to manage its security policies and access from Intra ID without ever joining it to the vulnerable local domain.
• 19:45
  SPEAKER_01: That handles the back end perfectly.
• 19:47
  SPEAKER_01: But what about the endpoints?
• 19:49
  SPEAKER_01: The laptops the employees actually use.
• 19:51
  SPEAKER_01: The third rule states: all new devices are intra-joined via Windows Autopilot, never hybrid joined.
• 19:58
  SPEAKER_00: This is a huge one.
• 20:00
  SPEAKER_01: What is the difference between hybrid join and what this rule mandates?
• 20:03
  SPEAKER_00: This is a massive shift away from legacy endpoint management.
• 20:07
  SPEAKER_00: For years, the standard IKEA procedure for a new hire was to take a laptop, connect it to the corporate network, wipe it, and apply a massive monolithic corporate image using a tool like SCCM.
• 20:20
  SPEAKER_01: System center configuration manager, right?
• 20:22
  SPEAKER_00: Exactly.
• 20:22
  SPEAKER_00: They would join the laptop to the local domain, installing a web of local trust.
• 20:26
  SPEAKER_01: Aaron Powell And when companies started moving to the cloud, they just bridged the two, right?
• 20:30
  SPEAKER_01: That's the hybrid join.
• 20:31
  SPEAKER_00: Yes.
• 20:31
  SPEAKER_00: And it's honestly the worst of both worlds.
• 20:33
  SPEAKER_00: A hybrid join machine is tethered to the old on-premises AD for its core identity, but it's also registered in the cloud.
• 20:40
  SPEAKER_01: So it has two masters.
• 20:42
  SPEAKER_00: Right.
• 20:42
  SPEAKER_00: It means if your on-prem domain controller goes down or gets compromised, the endpoint is still vulnerable.
• 20:48
  SPEAKER_00: The cloud first policy outlaws this completely.
• 20:51
  SPEAKER_01: So what's the autopilot process like?
• 20:53
  SPEAKER_00: Under Windows Autopilot, a bland new laptop is shipped directly from the hardware manufacturer, Dell, Lenovo, whoever, straight to the employee's house.
• 21:03
  SPEAKER_01: IT never even touches the physical hardware.
• 21:05
  SPEAKER_00: Never.
• 21:06
  SPEAKER_00: The employee powers it on and connects to their home Wi-Fi.
• 21:09
  SPEAKER_00: The laptop asks for their corporate email address.
• 21:12
  SPEAKER_00: They log in, authenticate against UNTRA ID, and Windows Autopilot takes over.
• 21:17
  SPEAKER_01: That sounds so much easier.
• 21:18
  SPEAKER_00: It reaches out to the cloud, pulls down the specific security policies, applications, and configurations for that user via Microsoft Intune, and provisions the device over the air.
• 21:28
  SPEAKER_00: The laptop never speaks to a legacy domain controller.
• 21:31
  SPEAKER_00: It is a hundred percent cloud native from birth.
• 21:34
  SPEAKER_01: That makes the fourth rule somewhat obvious in hindsight.
• 21:37
  SPEAKER_01: All new sites follow a serverless branch standard.
• 21:40
  SPEAKER_00: It's the logical conclusion.
• 21:41
  SPEAKER_00: If a company opens a new regional sales office, the traditional build out included a locked server closet containing a local domain controller, a print server, and a file server.
• 21:51
  SPEAKER_01: Right, all that hardware.
• 21:52
  SPEAKER_00: But if all the new laptops are communicating directly with Entra ID and all the new applications are cloud hosted or using modern authentication.
• 22:00
  SPEAKER_00: There is absolutely no architectural requirement to put a vulnerable server in that remote office.
• 22:06
  SPEAKER_01: You just don't need it.
• 22:07
  SPEAKER_00: You just install robust networking gear, redundant internet connections, and you're done.
• 22:12
  SPEAKER_00: You eliminate the physical infrastructure entirely.
• 22:14
  SPEAKER_01: Aaron Powell Which leads right into the fifth rule.
• 22:17
  SPEAKER_01: All new identities are created cloud native in UNTRA ID as the source of authority.
• 22:23
  SPEAKER_01: This seems like it's addressing the HR onboarding process, right?
• 22:26
  SPEAKER_00: It reverses the legacy synchronization flow.
• 22:29
  SPEAKER_00: Usually an HR system like Workday provisions a new user by running a script that creates an account in the on-premises Active Directory.
• 22:35
  SPEAKER_00: Then a tool like Entra Connect syncs that account up to the cloud.
• 22:39
  SPEAKER_01: So the on-premises directory is the master record.
• 22:42
  SPEAKER_00: Exactly.
• 22:42
  SPEAKER_00: This rule flips the script.
• 22:44
  SPEAKER_00: New identities are provisioned directly into Entra ID via automated API connections from the HR system.
• 22:50
  SPEAKER_00: On-premises AD stops being the authoritative source for new humans entering the organization.
• 22:56
  SPEAKER_01: That all sounds incredibly efficient, but we have to talk about the real world here.
• 22:59
  SPEAKER_01: Every enterprise has immense technical debt.
• 23:02
  SPEAKER_00: Oh, for sure.
• 23:03
  SPEAKER_01: The sixth rule acts as the pressure valve for this entire framework.
• 23:07
  SPEAKER_01: It states: any AD dependency exception requires a named business owner, compensating controls, and a review date.
• 23:15
  SPEAKER_00: This is where the magic happens.
• 23:17
  SPEAKER_01: I want to know how this actually plays out in a boardroom.
• 23:19
  SPEAKER_01: I mean, regarding rule number six, what happens when a powerful business unit absolute-year-old app that runs a critical assembly line and only supports LDIP?
• 23:33
  SPEAKER_00: That scenario is exactly why the exception process exists.
• 23:37
  SPEAKER_00: But it is deliberately designed to function as a governance deterrent.
• 23:41
  SPEAKER_00: IT doesn't just say no and halt the assembly line.
• 23:44
  SPEAKER_00: Okay.
• 23:44
  SPEAKER_00: Instead, IT says, yes, but you, the VP of manufacturing, must formally sign your name to the corporate risk register.
• 23:52
  SPEAKER_01: Oh wow.
• 23:52
  SPEAKER_01: So they have to personally own the vulnerability.
• 23:55
  SPEAKER_00: Exactly.
• 23:56
  SPEAKER_00: They must formally acknowledge they are forcing the introduction of an outdated vulnerable protocol into the environment.
• 24:02
  SPEAKER_00: Furthermore, they have to fund the compensating controls out of their own budget.
• 24:07
  SPEAKER_01: Right.
• 24:07
  SPEAKER_01: It hits their wallet.
• 24:08
  SPEAKER_00: If that app requires a domain controller, they have to pay for the network microsegmentation and the advanced firewalls to isolate it.
• 24:16
  SPEAKER_00: And finally, there is a hard review date set for 12 months out where that VP has to present their plan to replace the legacy software.
• 24:24
  SPEAKER_01: I imagine that changes the conversation entirely.
• 24:26
  SPEAKER_01: It's not just an IT problem anymore.
• 24:27
  SPEAKER_00: It works miracles.
• 24:29
  SPEAKER_00: When you force a named executive to personally own the cyber risk and defend it periodically, the business organically restricts legacy growth.
• 24:38
  SPEAKER_01: Yeah, no one wants their name on that.
• 24:39
  SPEAKER_00: Suddenly, that critical legacy app isn't quite as critical when the VP has to put their name next to the ransomware risk acceptance form.
• 24:47
  SPEAKER_00: They usually find the budget for the modern SAS alternative very quickly.
• 24:51
  SPEAKER_01: I bet they do.
• 24:52
  SPEAKER_01: So having a policy on paper is one thing, it's great governance.
• 24:55
  SPEAKER_01: But how does the existing environment actually transition without a massive disruptive cut over weekend?
• 25:01
  SPEAKER_01: Right.
• 25:02
  SPEAKER_01: We are talking about companies with thousands of devices and decades of convoluted group policy objects.
• 25:08
  SPEAKER_01: You said earlier this isn't a migration, so how does this actually work?
• 25:12
  SPEAKER_01: Let's unpack the three-phase attrition model.
• 25:15
  SPEAKER_00: First, we must emphasize why traditional Big Bang AD migration projects fail.
• 25:20
  SPEAKER_00: If you try to treat this like moving mailboxes from Exchange to Microsoft 365, you will fail.
• 25:26
  SPEAKER_01: Because it's too interconnected.
• 25:28
  SPEAKER_00: You cannot simultaneously catalog and move hundreds of interconnected, undocumented legacy applications and devices over a single weekend.
• 25:36
  SPEAKER_00: Things break, the help desk gets overwhelmed, the business revolts, and leadership cancels the project.
• 25:41
  SPEAKER_00: Attrition avoids all of this by letting the environment age out naturally.
• 25:45
  SPEAKER_01: So phase one is the freeze phase, running from months zero to six.
• 25:48
  SPEAKER_01: What are the mechanical steps required here?
• 25:50
  SPEAKER_00: Aaron Powell Phase one is about stopping the bleeding and gaining visibility.
• 25:54
  SPEAKER_00: The very first action is ratifying the policy we just discussed.
• 25:57
  SPEAKER_00: From day one, the procurement gates are locked.
• 25:59
  SPEAKER_00: Next, the technical prerequisite is verifying password hash sync.
• 26:03
  SPEAKER_01: Aaron Powell Why is password hash sync so critical?
• 26:06
  SPEAKER_01: Doesn't the cloud just ask the on-prem server if the password is correct anyway?
• 26:10
  SPEAKER_00: Aaron Powell That's how older federation methods like ADFS or Active Directory Federation Services work.
• 26:15
  SPEAKER_00: In a federated model, the cloud redirects the login request back down to your on-premises servers.
• 26:21
  SPEAKER_00: Right.
• 26:21
  SPEAKER_00: The fatal flaw there is that if your on-premises environment goes down, say a branch domain controller loses power or you suffer a ransomware attack, you suddenly cannot log into your cloud applications either.
• 26:32
  SPEAKER_01: Oh, that's terrific.
• 26:33
  SPEAKER_00: You lose access to email, teams, and cloud backups right when you need them most.
• 26:37
  SPEAKER_00: Password hash sync securely synchronizes a cryptographic representation of the user's passwords directly into Entra ID.
• 26:45
  SPEAKER_01: So the cloud can validate the login independently.
• 26:48
  SPEAKER_00: Exactly.
• 26:48
  SPEAKER_00: The cloud access survives the on-prem outage.
• 26:51
  SPEAKER_00: It decouples your modern productivity tools from your legacy infrastructures uptime.
• 26:56
  SPEAKER_01: That's a crucial first step.
• 26:57
  SPEAKER_01: What's next in phase one?
• 26:58
  SPEAKER_00: The final part of phase one is building a complete dependency inventory.
• 27:03
  SPEAKER_00: You deploy network monitoring tools to parse the traffic hitting your domain controllers.
• 27:08
  SPEAKER_00: You're looking specifically for port 389, which is LDAT, and port 88, which is Kerberos.
• 27:14
  SPEAKER_01: You're just watching the traffic.
• 27:15
  SPEAKER_00: You need to know exactly which applications, service accounts, and devices are actively querying the legacy directory.
• 27:22
  SPEAKER_00: You are building the hit list.
• 27:24
  SPEAKER_01: So the exit gate for phase one is simple.
• 27:26
  SPEAKER_01: No new AD dependencies can be created without exception approval, and the dependency register is 100% complete.
• 27:33
  SPEAKER_00: Yes, you know exactly what is in the environment.
• 27:36
  SPEAKER_01: Which brings us to phase two.
• 27:38
  SPEAKER_01: Starve.
• 27:38
  SPEAKER_01: This is the longest phase, running from month six to thirty-six.
• 27:42
  SPEAKER_01: You argue that IT doesn't actually have to do the heavy lifting here, which sounds counterintuitive.
• 27:48
  SPEAKER_00: This is the brilliance of the attrition model.
• 27:50
  SPEAKER_00: You don't need to ask the CFO for a massive multimillion dollar transformation budget because you are piggybacking on three natural business clocks that already exist.
• 27:59
  SPEAKER_01: Business clocks.
• 28:00
  SPEAKER_00: Yeah, the business is already paying to replace technology on natural cycles.
• 28:04
  SPEAKER_00: You are just changing the destination.
• 28:06
  SPEAKER_01: I marvel at the business clocks concept.
• 28:08
  SPEAKER_01: This is incredibly clever.
• 28:10
  SPEAKER_01: We aren't asking for new money, we're just redirecting it.
• 28:12
  SPEAKER_01: Let's state these time frames precisely, starting with the first clock.
• 28:16
  SPEAKER_00: The first is the device refresh clock, which operates on a three to four year cycle.
• 28:21
  SPEAKER_00: Every time a laptop hits the end of its hardware warranty, it gets replaced.
• 28:25
  SPEAKER_00: Instead of imaging the replacement laptop with SCCM and joining it to the legacy domain, you simply hand the user an ultra-joined autopilot provision device.
• 28:34
  SPEAKER_01: So just by waiting, they migrate themselves.
• 28:36
  SPEAKER_00: Over a three to four year cycle, your entire fleet of workstations naturally migrates to the cloud without a dedicated workstation migration project.
• 28:44
  SPEAKER_01: That's clock number one.
• 28:46
  SPEAKER_01: The second clock is the application contract renewal clock at one to five years.
• 28:50
  SPEAKER_00: Right.
• 28:51
  SPEAKER_00: Software contracts expire.
• 28:52
  SPEAKER_00: When a business unit goes to the vendor to renew a legacy application, the new cloud first policy applies.
• 28:58
  SPEAKER_00: The vendor must provide a modern SOS-based version that speaks SEML or OIDC.
• 29:03
  SPEAKER_01: And if they don't have one.
• 29:05
  SPEAKER_00: If they can't, the business uses that renewal window to migrate to a competitor who can.
• 29:10
  SPEAKER_00: App by app, as contracts turn over, the LDIP dependencies die off naturally.
• 29:15
  SPEAKER_01: And the third clock is the server refresh clock at four to six years.
• 29:18
  SPEAKER_00: Servers age out, hardware fails, and operating systems reach end of support.
• 29:23
  SPEAKER_00: As each on-premises server hits that four to six year mark, it is decommissioned.
• 29:29
  SPEAKER_01: You don't replace it like for like.
• 29:30
  SPEAKER_00: Exactly.
• 29:31
  SPEAKER_00: The workload is moved to a modern platform, maybe a cloud native database, a SOS platform, or a modern Azure virtual machine.
• 29:39
  SPEAKER_00: The physical box is destroyed, and the domain dependency dies with it.
• 29:43
  SPEAKER_01: Okay, I have to push back here because there is an obvious technical flaw during this 36-month starvation phase.
• 29:50
  SPEAKER_01: Let's hear it.
• 29:50
  SPEAKER_01: You have a mix of new devices and old servers.
• 29:53
  SPEAKER_01: If I'm an employee and my laptop just hit its three-year refresh, I now have a brand new cloud native enter-joined laptop.
• 30:00
  SPEAKER_00: Yep.
• 30:00
  SPEAKER_01: But my department still uses a massive legacy on-premises file share that isn't scheduled for refresh for another two years.
• 30:06
  SPEAKER_01: How do I get my files?
• 30:08
  SPEAKER_01: Does my new cloud laptop just fail to authenticate to the old server because it's not on the domain?
• 30:13
  SPEAKER_00: That used to be the exact roadblock that prevented this entire strategy from working.
• 30:17
  SPEAKER_00: But Microsoft solved it mechanically with a feature called Cloud Kerberos Trust.
• 30:22
  SPEAKER_00: It acts as a magic bridge during the transition phase.
• 30:25
  SPEAKER_01: Cloud Kerberos Trust, how does that actually function under the hood?
• 30:29
  SPEAKER_00: When you log into your brand new, cloud-only Windows device, you authenticate directly against Intra ID in the cloud.
• 30:36
  SPEAKER_00: However, Entra ID is configured to maintain a cryptographic trust relationship with your remaining on-premises active directory.
• 30:43
  SPEAKER_00: Okay, they're talking to each other.
• 30:45
  SPEAKER_00: During your cloud login, Intra ID securely issues your device a special Kerberos ticket granting ticket, or TGT.
• 30:53
  SPEAKER_01: And the old on-premises servers recognize a ticket generated by the cloud.
• 30:57
  SPEAKER_00: Yes, that's the magic of it.
• 30:59
  SPEAKER_00: The legacy on-premises domain controllers are configured to respect the mathematical signature of the cloud identity provider.
• 31:06
  SPEAKER_00: Wow.
• 31:06
  SPEAKER_00: So when the user opens File Explorer and clicks on their old mapped network drive, the Windows operating system silently presents that cloud-generated Kerberos ticket to the old file server.
• 31:16
  SPEAKER_00: The file server validates it and the user gets their files seamlessly.
• 31:20
  SPEAKER_01: They have no idea they are using a modern zero trust device to access a legacy server.
• 31:26
  SPEAKER_01: It just works.
• 31:27
  SPEAKER_00: None.
• 31:28
  SPEAKER_00: The user experience is perfectly transparent.
• 31:30
  SPEAKER_00: Cloud Kerberos Trust is the linchpin that allows you to confidently move all your endpoints to the cloud immediately without having to wait for the legacy servers to be upgraded first.
• 31:40
  SPEAKER_01: That solves a massive headache.
• 31:42
  SPEAKER_01: But realistically, how do we track this starvation process so it doesn't lose momentum in year two?
• 31:47
  SPEAKER_01: Enterprise projects are notorious for just stalling out.
• 31:50
  SPEAKER_00: The exit gate for phase two is that the exception register must trend monotonically towards zero.
• 31:56
  SPEAKER_00: You ensure this happens by making the exception register the single key performance indicator, the sole KPI for the entire program.
• 32:04
  SPEAKER_01: So it's highly visible.
• 32:05
  SPEAKER_00: It is reviewed quarterly by senior leadership.
• 32:08
  SPEAKER_00: You track the raw count of remaining legacy devices, apps, and servers.
• 32:12
  SPEAKER_00: If that number stalls or goes up, the executives holding those exceptions have to explain why to the board.
• 32:17
  SPEAKER_01: It shifts the burden of proof entirely.
• 32:20
  SPEAKER_00: IT no longer has to justify a migration budget.
• 32:22
  SPEAKER_00: The business units have to justify why they are clinging to vulnerable technical debt.
• 32:27
  SPEAKER_01: That brings us to phase three, decommission or contain, which triggers at month 36 and beyond.
• 32:34
  SPEAKER_01: We are at the end of the line.
• 32:36
  SPEAKER_01: What do the end states actually look like?
• 32:38
  SPEAKER_00: There are only two legitimate end states here.
• 32:41
  SPEAKER_00: The primary goal, obviously, is full decommission.
• 32:43
  SPEAKER_00: This is incredibly satisfying for an engineering team.
• 32:46
  SPEAKER_01: Aaron Powell I bet.
• 32:47
  SPEAKER_01: Turning things off is the best part of IT.
• 32:49
  SPEAKER_00: It really is.
• 32:49
  SPEAKER_00: It means disabling directory synchronization from on-premises to the cloud.
• 32:54
  SPEAKER_00: You must then sanitize the immutable IDs in Entra ID.
• 32:58
  SPEAKER_01: Aaron Powell, What is an immutable ID and why do we have to sanitize it?
• 33:01
  SPEAKER_00: When an account is synchronized from on-premises AD to the cloud, the cloud creates an immutable ID.
• 33:08
  SPEAKER_00: It's a cryptographic anchor that essentially tells Entra ID, do not allow anyone to change the core attributes of this user in the cloud.
• 33:16
  SPEAKER_00: Those changes must come from the on-premises master record.
• 33:18
  SPEAKER_01: Oh, so it locks it down.
• 33:20
  SPEAKER_00: If you just turn off the on-premises servers without clearing those anchors, those cloud identities become orphaned and unmanageable.
• 33:26
  SPEAKER_00: You run scripts to wipe those immutable IDs, permanently converting the synced accounts into fully native cloud identities.
• 33:32
  SPEAKER_01: Okay.
• 33:33
  SPEAKER_00: And then you literally power off the physical domain controllers, you pull the power cables, and throw the hardware in the recycling bin.
• 33:41
  SPEAKER_01: But we know some companies will never achieve 100% decommission.
• 33:44
  SPEAKER_01: There is always that one ancient application.
• 33:47
  SPEAKER_01: Maybe it controls a specific piece of manufacturing hardware, or it's a proprietary internal tool that genuinely cannot shed LDAP or Kiberos, and the vendor went out of business a decade ago.
• 33:58
  SPEAKER_01: What is the second end state for them?
• 34:01
  SPEAKER_00: The second legitimate end state is containment.
• 34:04
  SPEAKER_00: You do not keep 50 branch domain controllers alive just to support one legacy app.
• 34:09
  SPEAKER_01: Right.
• 34:10
  SPEAKER_01: That defeats the whole purpose.
• 34:11
  SPEAKER_00: You relocate that specific application to a small, hardened AD island.
• 34:16
  SPEAKER_00: Usually this means running it inside UNTRA domain services in a heavily firewalled, micro-segmented Azure virtual network.
• 34:23
  SPEAKER_01: So it's completely isolated from the rest of the company?
• 34:25
  SPEAKER_00: Entirely.
• 34:26
  SPEAKER_00: It has no physical branch presence, no employee workstations are joined to it, and it has no administrative trust back to your primary UNTRA ID environment.
• 34:34
  SPEAKER_00: It is quarantined.
• 34:35
  SPEAKER_00: The exit gate for phase three is zero domain controllers remaining on premises.
• 34:40
  SPEAKER_00: Active Directory is no longer a tier zero disaster recovery system for the enterprise.
• 34:46
  SPEAKER_01: To even get authorization to start phase one, though, IT needs absolute leadership buy-in.
• 34:52
  SPEAKER_01: You cannot put the environment on a starvation diet without the CFO and the board understanding exactly what is in it for them.
• 34:59
  SPEAKER_01: You have to build a bulletproof financial case.
• 35:01
  SPEAKER_00: Absolutely.
• 35:02
  SPEAKER_00: The money has to make sense.
• 35:03
  SPEAKER_01: Let's unpack the specific financial levers that justify this entire architecture shift, focusing on the four value streams outlined in the sources, starting with value stream one, infrastructure elimination.
• 35:15
  SPEAKER_00: The most immediate hard dollar savings come from physical hardware elimination.
• 35:19
  SPEAKER_00: Let's look at the numbers.
• 35:20
  SPEAKER_00: Across a typical enterprise estate with 50 plus branch locations, this policy leads to the permanent removal of 50 to 150 servers.
• 35:28
  SPEAKER_01: That's a huge footprint reduction.
• 35:29
  SPEAKER_00: You are no longer purchasing that hardware every five years.
• 35:32
  SPEAKER_00: You are no longer paying enterprise licensing fees for the Windows server operating systems running on those boxes.
• 35:38
  SPEAKER_00: You completely eliminate the power, cooling, physical security, and rack space costs in those 50 branch locations.
• 35:46
  SPEAKER_01: And as you mentioned earlier with autopilot, it also kills the imaging infrastructure.
• 35:50
  SPEAKER_00: Yes.
• 35:51
  SPEAKER_00: The hidden cost of legacy endpoints.
• 35:53
  SPEAKER_00: Because all new devices use Windows Autopilot, you completely eliminate the infrastructure required to maintain OS images.
• 36:00
  SPEAKER_01: So no more massive deployment servers.
• 36:02
  SPEAKER_00: You no longer need to maintain massive SECM distribution points and PXE boot servers at every branch office just to re-image a broken laptop.
• 36:11
  SPEAKER_00: Autopilot pulls the configuration directly over the internet.
• 36:14
  SPEAKER_00: The storage savings and the reduction in administrative overhead are massive.
• 36:18
  SPEAKER_01: That plays directly into value stream too, network cost restructuring.
• 36:22
  SPEAKER_01: So by killing the branch domain controller, we effectively kill the need for the traditional corporate VPN.
• 36:28
  SPEAKER_01: We are severing the expensive umbilical cord back to the data center.
• 36:31
  SPEAKER_00: Exactly.
• 36:32
  SPEAKER_00: For decades, distributed companies have relied on incredibly expensive hub and spoke network models.
• 36:37
  SPEAKER_00: You pay a premium for MPLS lines, multi-protocol label switching, or heavy dedicated site-to-site VPN tunnels simply because the laptops in the branch office have to constantly talk back to a central domain controller to authenticate, change passwords, and update group policies.
• 36:54
  SPEAKER_01: But if the laptop is untra-joined, it just needs the internet.
• 36:58
  SPEAKER_00: Precisely.
• 36:58
  SPEAKER_00: By eliminating the branch domain controller, you sever the requirement for the corporate backbone.
• 37:03
  SPEAKER_00: You can completely restructure the network budget by converting those expensive MPLS and VPN contracts into commodity direct to internet broadband paired with SD-WAN for routing optimization.
• 37:14
  SPEAKER_01: But what about the few legacy apps that haven't been phased out yet?
• 37:17
  SPEAKER_01: If an employee at a branch office needs to access an internal inventory system hosted back at headquarters and we've killed the VPN, how do they connect?
• 37:25
  SPEAKER_00: You utilize UNTRA private access.
• 37:28
  SPEAKER_00: Instead of giving a remote user a full network VPN that exposes your entire corporate routing table to their potentially compromised laptop, intra private access works like a secure reverse proxy.
• 37:39
  SPEAKER_01: Okay, how does that differ?
• 37:40
  SPEAKER_00: It creates a micro-segmented connection specifically to the exact IP address and port of that single application.
• 37:47
  SPEAKER_00: The user gets access to the inventory system, but they cannot ping or scan any other server on the network.
• 37:53
  SPEAKER_01: So it's way safer.
• 37:54
  SPEAKER_00: You are slashing the wide area network budget while simultaneously improving the security posture.
• 38:00
  SPEAKER_01: Which brings us to the most critical argument for the board, value stream three, risk adjusted exposure reduction.
• 38:06
  SPEAKER_01: This is where we bring the specific numbers back and we have to state them precisely to build the case.
• 38:11
  SPEAKER_00: The numbers don't lie here.
• 38:13
  SPEAKER_01: We have the$9.36 million average ransomware cost figure combined with the$730,000 per hour outage figure for Active Directory.
• 38:23
  SPEAKER_01: How do you use these specific figures to build an annualized loss expectancy argument for a CFO or a cyber insurance underwriter?
• 38:30
  SPEAKER_00: You rely on standard risk mathematics.
• 38:32
  SPEAKER_00: Annualized loss expectancy, or ALE, is calculated by multiplying the single loss expectancy by the annualized rate of occurrence.
• 38:39
  SPEAKER_01: Okay, simple math.
• 38:40
  SPEAKER_00: If we know the average ransomware attack costs$9.36 million in recovery and lost revenue, and a core AD outage costs up to$730,000 per hour in downtime, the financial exposure of a single domain controller compromise is astronomical.
• 38:57
  SPEAKER_00: Right.
• 38:57
  SPEAKER_00: When you present this to a CFO, you aren't talking about improving security hygiene.
• 39:01
  SPEAKER_00: You are talking about mitigating a massive corporate liability.
• 39:05
  SPEAKER_01: Aaron Powell Because the domain controller is the vector.
• 39:07
  SPEAKER_00: Yes.
• 39:08
  SPEAKER_00: By adopting the cloud first policy and executing the attrition model to eliminate the on-premises domain controllers, you mathematically reduce the probability of that specific catastrophic intrusion vector to zero.
• 39:20
  SPEAKER_00: The on-premises AD cannot be compromised if it no longer exists.
• 39:24
  SPEAKER_01: And how do the cyber insurance underwriters react to that math?
• 39:27
  SPEAKER_00: They care deeply.
• 39:28
  SPEAKER_00: Cyber insurance premiums have skyrocketed over the last few years, specifically because of AD-driven ransomware payouts.
• 39:35
  SPEAKER_00: Demonstrating a governed, measurable, board-approved attrition program to eliminate legacy AD provides a quantifiable risk reduction.
• 39:42
  SPEAKER_01: So it actually lowers the bill.
• 39:43
  SPEAKER_00: Underwriters use that exact data to lower premiums, or in some high-risk industries, it is the only way they will simply agree to write the policy in the first place.
• 39:52
  SPEAKER_01: Finally, value stream 4.
• 39:54
  SPEAKER_01: Organizational capacity.
• 39:56
  SPEAKER_01: This is really about human capital, isn't it?
• 39:58
  SPEAKER_00: IT support hours are incredibly expensive.
• 40:01
  SPEAKER_00: By removing 50 to 150 branch servers, you are recovering thousands of engineering hours previously wasted on patching legacy operating systems, troubleshooting hardware disk failures, managing backup tape rotations, and debugging convoluted legacy group policies.
• 40:18
  SPEAKER_01: That's a lot of recovered time.
• 40:19
  SPEAKER_00: That recovered time is then forcefully redirected toward actual business modernization work.
• 40:24
  SPEAKER_00: Your engineers stop being server janitors, keeping 25-year-old architecture on life support, and they start becoming true identity architects.
• 40:32
  SPEAKER_01: Doing the high value work.
• 40:33
  SPEAKER_00: Exactly, focusing on fine-tuning conditional access policies and deploying zero trust network access.
• 40:39
  SPEAKER_00: You are fundamentally funding the modernization effort with the labor hours recovered from the legacy attrition.
• 40:44
  SPEAKER_01: Today we covered the stranded capital problem, the risk concentration and on-premises AD, the six rules of the cloud first policy, the three-phase attrition model, and the four value streams of the financial case.
• 40:57
  SPEAKER_01: The math is blunt.
• 40:59
  SPEAKER_01: Over 78% of ransomware intrusions involve a breached domain controller.
• 41:04
  SPEAKER_01: And the median time to compromise is under four hours.
• 41:08
  SPEAKER_01: But the fix isn't a migration project.
• 41:11
  SPEAKER_01: It's a starvation diet.
• 41:13
  SPEAKER_01: Freeze new dependencies.
• 41:15
  SPEAKER_01: Let three existing business clocks retire the old hardware for you.
• 41:19
  SPEAKER_01: Then decommission or contain whatever's left.
• 41:23
  SPEAKER_01: Next episode, we take this same policy out to the branch office and walk through exactly what replaces the local server printing, networking, workstation provisioning, even the conference room.
• 41:35
  SPEAKER_01: Thanks for listening.
• 41:36
  SPEAKER_01: We'll see you then.