A real-world case from our own IT environment shows how migRaven.MAX, with AI support, makes security risks visible, suggests concrete measures, and provides verifiable support for their implementation.
The starting point was a seemingly simple question to Max AI: How well is our Active Directory domain protected against NTLM relay and Kerberoasting attacks?
The AI analyzed the available information on service accounts, group policies, permissions, and certificate services. In addition to concrete indications of possible security risks and missing evidence of protective measures, it discovered something unexpected: numerous references to a domain controller that had already been decommissioned years ago still existed in our production environment.
Particularly notable: an active service account still contained ten delegation targets as well as a Service Principal Name (SPN) referencing this former server. Corresponding entries were also found in Active Directory Certificate Services.
From insight to concrete action
The report documents how Max AI classified the anomalies, suggested targeted checks and PowerShell scripts, and supported the administrators in the step-by-step clean-up. A subsequent review confirmed that the outdated delegation targets had been removed. Further references remained documented as open items for review.
What to expect in this download:
- Two anonymized AI security reports from our real production environment
- Concrete security findings with technical classification and recommended actions
- PowerShell scripts for targeted investigation and clean-up
- Documented results, including the follow-up review and still-open measures
This practical case illustrates how a simple security question can lead to a well-founded investigation with concrete need for action – and how AI helps to
