George Simos @GSimos

Former MVP System Center Configuration Manager, MCT, MCITP Ent Admin, MCSE / MCTS: Virtualization Solutions Training IT Pros since 2010. gsimos.wordpress.com Thessaloniki, Greece Joined October 2009

Tweets

4K
Followers

573
Following

797
Likes

4K

Windows At Work @WindowsAtWork

3 months ago

NTLM is being phased out in Windows 11. Learn the risks of legacy authentication, how to audit NTLM dependencies, and how Kerberos options like IAKerb and Local KDC prepare you for what’s next. #TechTakeoff x.com/i/broadcasts/1…

0 6 30 2K 27

View Details

Ελληνικό Μουσείο Πληροφορικής @mouseio

3 months ago

Υπολογιστές μας θα παίξουν στην ταινία The riders, που γυρίζετε αυτές τις ημέρες στην χώρα μας. Ο Μπραντ Πιττ θα μάθει ms-dos για να εκτυπώσει σε έναν εκτυπωτή dot matrix!

0 2 23 257 0

View Details

Michael Niehaus @mniehaus

3 months ago

Discovering PowerShell provider dynamic parameters oofhours.com/2026/03/03/dis…

0 4 5 1K 2

View Details

Sean Metcalf @PyroTek3

3 months ago

In Active Directory, there is a method that’s been around for many years which changes the password last set date but not the actual password. This is what I call a “fake password change” since the account appears to have a recent password when scanning for old passwords based on password last set, but the underlying password hasn’t actually changed. I spoke about this in my 2015 @BSidesCharm talk which was my first conference talk. More details including step-by-step screenshots are here: adsecurity.org/?p=4969 Why does this happen? There are times where service account (or admin accounts) need to have password changes, but someone doesn’t want to do the work to change them. The ability to fake a password change requires modify rights on the pwdLastSet attribute which provides the ability to check/uncheck the setting “User must change password at next logon”. This setting is enabled when you want the user to change their own password when they logon. How does this work? This is simple to do when you have rights on the target account (in this example the password last changed in August 2025). We open up Active Directory Users and Computers (ADUC), double-click on the target account to open up the account properties and then click on the Account tab. From here we check the box for “User must change password at next logon” and click Apply. The PasswordLastSet date is now blank. Which makes it seem like the account has never had a password set. We continue with our process where we uncheck the box for “User must change password at next logon” we checked and then click Apply. After performing this action, the password change date has now been set to the current date and time even though the password itself hasn’t been changed since August 2025. We have successfully faked a password change! Why does this happen? This happens because the “User must change password at next logon” option is used to force a user to change their password at next logon. With it checked, Active Directory is waiting for the user to attempt to logon which is when the user is directed to change their password. During this time the PasswordLastSet value is blank since it is waiting for a new password. Once the user changes their password, the checkbox is effectively removed and the current date and time are set for the user’s passwordlastset property (technically this is the “pwdlastset” attribute, but the AD PowerShell cmdlets use that property). An attacker could use this technique for an account with an old password they discover and have control of the account (with the ability to flip this bit). This would show that the password changed without it actually changing. Detect fake Active Directory password changes at scale I wrote a PowerShell script that will scan either the Active Directory Admins or All Users in the domain to see if there’s a fake password change that has been performed on them. github.com/PyroTek3/Activ…

6 153 976 98K 935

View Details

George Simos @GSimos

3 months ago

@mmsmoa Enjoyed the experience a lot back in 2024!

0 0 1 8 0

View Details

George Simos @GSimos

4 months ago

@jsnover Thank you for everything, not just PowerShell but the inspiring presentations and speaking engagements/keynotes. Enjoy retirement and keep us posted about things you will be tinkering with!

0 0 1 13 0

View Details

George Simos @GSimos

5 months ago

@mniehaus

1 1 2 212 0

View Details

George Simos @GSimos

6 months ago

@PJ_Marcum The hit of the time capsule.....

0 0 0 16 0

View Details

Steven M. Salter @StevenMSalter

7 months ago

Windows 11 23H2 Home and Pro editions, have reached end of life / support today, upgrade to 24H2 to remain supported. If you're a Windows 11 23H2 Education/Enterprise edition customer, these editions will be supported for another 12 months until 11/10/2026. #Microsoft #Windows11

0 2 4 834 0

View Details

George Simos @GSimos

7 months ago

@jarwidmark @ramseyg Even for me, an old guy in tech, these mini courses are not only enjoyable, but also very insightful, thank you for that Johan!

0 0 2 29 0

View Details

Johan Arwidmark @jarwidmark

7 months ago

We all started somewhere, help someone else do the same. Share this free community course with a new tech who’s ready to jump into Microsoft IT (or that just started).

ViaMonstra @viamonstra

7 months ago

💥NEXT WEEK! #ViaMonstraMiniCourse NOV 20, 9–10:30AM CST 👨‍💻 @jarwidmark @AndrewJNet @richardhicks 💻Kick-start your IT journey! Microsoft tech fundamentals—no jargon, just clear demos + real “nobody told me this” tips #ActiveDirectory #Entra Sing up➡️ ow.ly/irml50Xq0Lg

0 2 3 3K 0

1 4 9 1K 0

View Details

Johan Arwidmark @jarwidmark

7 months ago

Well, of course… That’s what October was missing :)

Paula Januszkiewicz @PaulaCqure

7 months ago

AI browsers getting hacked through screenshots? That's the new reality. @brave Security just exposed how attackers hide invisible text in images to manipulate AI assistants, making them steal data, access banks, you name it. And it's not just one browser, it's everywhere. We've

3 16 30 7K 13

0 6 14 4K 3

View Details

George Simos @GSimos

8 months ago

@PJ_Marcum @Mister_MDM @juergkoller @MattWreede @mmsmoa @DeviceDeploy Correction it was for @DeviceDeploy (/chuckles)

0 0 0 29 0

View Details

George Simos @GSimos

8 months ago

@PJ_Marcum @Mister_MDM @juergkoller @MattWreede @mmsmoa @DeviceDeploy Maybe @Mister_MDM would like to jump in this thread and comment?

2 0 0 63 0

View Details

George Simos @GSimos

8 months ago

@PJ_Marcum @juergkoller @Mister_MDM @MattWreede @mmsmoa @DeviceDeploy He does that from time to time, throwing bits of info to keep us on the edge 😊But he is a nice chap and clarifies info very well.

0 0 1 26 0

View Details

George Simos @GSimos

8 months ago

@MattWreede @juergkoller @Mister_MDM @PJ_Marcum AI start talking Aye!

0 0 0 15 0

View Details

George Simos @GSimos

8 months ago

@driving_croonr @miketerrill @bdam555 @jarwidmark @gwblok @mniehaus Again, glad we stick on Server 2022 😊

0 0 0 58 0

View Details

George Simos @GSimos

8 months ago

@driving_croonr @miketerrill @bdam555 @jarwidmark @gwblok @mniehaus The Win11 24/25H2 October updates issues are affecting Windows Server 2025 also, Server 2022 is immune bit.ly/4qEYTXh