Windows domains — Trust is earned, not givenhttps://www.bobhuang.com/series/windows-domains/How Windows proves who you are: the NT domain trust maze before Active Directory, then AD, Kerberos and NTLM, hybrid identity, and the passwordless endgame.en08 Oct 2024 12:00:00 GMTWindows domains, part 6: NTLM retirement, Server 2025, and the passwordless endgamehttps://www.bobhuang.com/blog/786/windows-domains-part6-ntlm-retirement-future/https://www.bobhuang.com/blog/786/windows-domains-part6-ntlm-retirement-future/08 Oct 2024 12:00:00 GMTIn 2023 Microsoft did what this series has been building toward since part 3: it put NTLM on a deprecation path — first blocking NTLMv1 and turning off…Windows domains, part 5: hybrid identity — Entra Connect, the PRT, and the seam between two worldshttps://www.bobhuang.com/blog/785/windows-domains-part5-hybrid-entra/https://www.bobhuang.com/blog/785/windows-domains-part5-hybrid-entra/17 May 2022 12:00:00 GMTBy 2022 the forest was no longer the whole story. Most enterprises run a hybrid: AD for the devices, file servers, and legacy apps; Entra ID (Azure AD, renamed…Windows domains, part 4: the feature arc — Server 2008 R2 to 2019https://www.bobhuang.com/blog/784/windows-domains-part4-feature-arc/https://www.bobhuang.com/blog/784/windows-domains-part4-feature-arc/04 Jun 2019 12:00:00 GMTBetween 2009 and 2019 the forest quietly acquired almost every operational safety net it now depends on. Each release added one or two big things; knowing…Windows domains, part 3: Kerberos and NTLM — how Windows actually proves who you arehttps://www.bobhuang.com/blog/783/windows-domains-part3-kerberos-ntlm/https://www.bobhuang.com/blog/783/windows-domains-part3-kerberos-ntlm/21 Nov 2017 12:00:00 GMTForests and transitive trusts only pay off if the authentication protocol is worth trusting transitively. This part is the protocol deep-dive: NTLM, the NT-era…Windows domains, part 2: AD 2000 changed everything — forests, trees, and transitive trusthttps://www.bobhuang.com/blog/782/windows-domains-part2-ad-forest/https://www.bobhuang.com/blog/782/windows-domains-part2-ad-forest/08 Sep 2016 12:00:00 GMTWhen Windows 2000 shipped Active Directory, it did not upgrade the NT domain — it replaced its geometry. Three ideas did most of the work, and all three are…Windows domains before Active Directory: NT domains, master domains, and the trust mazehttps://www.bobhuang.com/blog/781/windows-domains-part1-nt-era/https://www.bobhuang.com/blog/781/windows-domains-part1-nt-era/14 Apr 2015 12:00:00 GMTFifteen years after Active Directory shipped, the shape of its design still only makes sense once you understand what it replaced. This series starts where…