Hi everyone,

We have an existing on-prem AD environment where Microsoft Entra Seamless SSO has been configured for quite some time.

During a recent AD security assessment, the AZUREADSSOACC computer account was highlighted as a security risk because its Kerberos decryption key/password has not been rotated recently.

Microsoft's documentation recommends periodically rolling over the Kerberos decryption key for the AZUREADSSOACC account, at least every 30 days. The documentation also provides PowerShell commands to perform the rollover from the Microsoft Entra Connect server.

Before making this change in our environment, we are planning to test it in our lab first.

I would like to understand the practical production impact:

• Has anyone performed an AZUREADSSOACC password/Kerberos key rollover in an existing production environment?
• Did the rollover cause any Seamless SSO interruption or authentication issues?
• Did users need to log off/restart their devices or purge existing Kerberos tickets?
• Were there any issues with Microsoft Entra Connect or the existing Seamless SSO configuration after the rollover?
• Is there anything specific we should verify before and after the rollover?
• If you have performed this in a large/older AD environment, did you encounter any unexpected behavior?

We are not looking to disable/reconfigure Seamless SSO; the goal is only to perform the recommended Kerberos decryption key/password rollover on the existing AZUREADSSOACC account as a security remediation.

Any real-world production experience would be really helpful, especially from anyone who has done this in an older AD environment.

Thanks!

Hello experts,

I have configured Microsoft Entra Seamless SSO with Password Hash Synchronization (PHS). My current setup is that my on-premises domain is xyz.com, and my Microsoft Entra tenant is on.microsoft2345.com. I added cloud domain as an alternative UPN suffix in Active Directory. Initially, Seamless SSO was working, but it is currently not working.

Is there anything I might have missed or need to check? Any guidance would be really helpful.

Hi everyone,

I recently ran Purple Knight against one of our Active Directory environments, and it flagged the pre-Windows 2000 Compatible Access group for review.

When I checked the membership, I noticed:

• NT AUTHORITY\ANONYMOUS LOGON/ Everyone
• Authenticated Users (which I understand can be the default in modern domains)
• Exchange Domain Servers
• A few computer accounts

I know that Authenticated Users may be present by default depending on how the domain was created, but I'm curious about the other members.

My questions are:

1. Why would Exchange Domain Servers be added to this group?
2. Under what scenarios are computer accounts added to this group? Are there Microsoft products or third-party applications that do this automatically?
3. How do you determine whether these memberships are still required before removing them?
4. Have you encountered this in your environments, and what was the root cause?

I'd appreciate hearing from anyone who's investigated this before or knows the historical reasoning behind these memberships.

Thanks!

Hello Experts,

Looking for feedback from people running event-driven operations / Windows monitoring in production.

I’m building and testing an internal setup using an MCP server (EventWhisper) connected to Claude Desktop to allow natural language investigation of Windows Event Logs across remote servers.

Current flow:

Claude Desktop
→ MCP Server (EventWhisper)
→ Remote PowerShell / WinRM
→ Windows Event Logs (System / Security / Application)
→ Human-readable response

Goal:
Enable non-technical IT users (Service Desk, AD Admins, Infra Ops, Audit teams) to ask questions like:

• “When was DC01 restarted?”
• “Who added users to Domain Admins?”
• “Show failed logins in the last 24 hours”
• “What changed in Active Directory today?”

without requiring knowledge of Event IDs, PowerShell, or Event Viewer.

A few design questions for people running this at scale:

1. Is direct WinRM + Get-WinEvent considered an industry-standard approach for production-scale environments?
2. For large environments, is translating user intent → event queries considered a good architecture pattern?
3. Any security concerns with running a central service account for remote event access?
4. What would you change before calling this production-ready?

Interested in hearing real-world practices and lessons learned.

Hello Experts,

I have a question regarding application remediation in an old/on-prem environment.

When modernizing or remediating existing infrastructure, one of my biggest concerns is making changes without breaking existing applications or dependencies.

I wanted to understand what the recommended approach is for:

• Identifying application authentication methods (AD, LDAP, Kerberos, NTLM, SAML, service accounts, etc.)
• Discovering application dependencies (servers, databases, DNS, network, certificates, APIs, file shares, integrations, etc.)
• Mapping application communication flows
• Understanding which systems will be impacted before making changes
• Performing remediation with minimal downtime or business impact

Are there any automated tools that can help identify application authentication patterns and dependency relationships in legacy environments?

Also, what process do you typically follow before remediation to reduce the risk of breaking production applications?

Would appreciate recommendations, real-world experiences, or lessons learned.

Thanks in advance!

Hello Experts,

I have a question regarding Active Directory assessment.

I’m looking for a tool that can perform continuous AD assessment, automatically detect misconfigurations or vulnerabilities, and flag/notify when new risks are identified instead of running only one-time health checks.

I wanted to understand whether this can be achieved through any built-in settings or features in Splunk or SCOM, or if there are dedicated tools that are better suited for this use case.

Thanks in advance for your suggestions.

Hello Experts,

I’m looking for guidance and best practices to prepare and assess a large-scale on-premises Active Directory environment. My focus is on understanding the recommended approach from an AD architecture and assessment perspective before implementation or modernization.

Areas I’m currently evaluating include:

• OU hierarchy and organizational design – scalability, delegation, and administrative boundaries
• GPO strategy – design standards, inheritance, filtering, naming conventions, and optimization
• Sites and Subnets design – replication efficiency, WAN optimization, and location mapping
• Domain and Forest architecture – design considerations and future growth planning
• AD replication health and topology
• DNS and DHCP integration best practices
• Delegation model and RBAC approach
• Group design and membership strategy
• Authentication and security hardening recommendations
• Monitoring, auditing, and operational governance
• Disaster recovery and business continuity planning
• Assessment approach – what key checkpoints should be validated before moving to production?

I’d love to hear real-world experiences, lessons learned, common mistakes to avoid, or any AD assessment checklist/framework that you follow for enterprise environments.

Thank you in advance for sharing your expertise.

Hello Experts,
I have a few questions regarding the MCP server. I did a Google search, but I couldn’t find a satisfactory answer.

I wanted to know: when we define tools in an MCP server, is there any limit on the number of tools we can define?

Also, let’s say we have a dedicated machine for an MCP server — can we run another MCP server in parallel on the same machine? If yes, how many MCP servers can we run on the same machine, and are there any best practices for this?

Thank you.

Hello Experts!

Over the last few days, I’ve been experimenting with EventWhisper, an MCP server that allows an LLM (currently Claude Desktop) to query Windows Event Logs using natural language.

Current Lab Setup

• Azure VM (currently acting as DC01) hosting EventWhisper
• Remote MCP access from my workstation
• Windows Event Logs as the data source

Current architecture:

Workstation
     ↓
Claude Desktop
     ↓
Remote MCP
     ↓
Azure VM (EventWhisper)
     ↓
Windows Event Logs

Example questions I tested:

• Who logged into this server today?
• Has anyone been trying to guess passwords?
• Were any new user accounts created recently?

Now I’m thinking about the next step: scaling this beyond 10–20 machines.

My initial idea was:

• Package EventWhisper as MSIX
• Deploy it to endpoints using SCCM / Intune
• Run it using Task Scheduler
• Allow remote access to each machine individually

But I’m starting to think this may not be the best design.

Current concerns:

1. Right now, the server is listening on 0.0.0.0 and I opened an inbound port for remote access.
2. If I scale to 20 machines, opening and managing ports on every server does not seem ideal.
3. I’m currently accessing it over a public endpoint, which feels like a security risk.

• How would we secure this architecture (VPN, reverse proxy, private network, authentication, etc.)?
• Any best practices for scaling and productionizing this kind of setup?

I’d appreciate architecture feedback and suggestions.

I’m exploring a use case and would appreciate feedback from the community.

Is it possible to build a custom agent that can remotely read all Windows Event Logs without continuously storing or forwarding them to a central database?

My idea is:

• A lightweight custom MCP (Model Context Protocol) server/agent runs on the target machine.
• A local LLM interacts with the remote MCP server/agent (running on windows and queries Event Logs on demand.
• Instead of searching raw logs manually, users can ask questions in plain English, such as:
  • How many times was this VM shut down in the last 24 hours?
  • How many times was it started?
  • How many user accounts were created in the last 24 hours?
  • How many user accounts were deleted?
  • Are there any suspicious security events or potential threats?
  • Show failed login attempts from the last 7 days.

The MCP server would fetch the relevant event data at query time, and the LLM would analyze the results and return a natural-language response.

Has anyone implemented a similar architecture? If so:

• Which technologies did you use?
• How did you handle permissions and security?
• Did you query Event Logs directly through APIs (WinRM, WMI, PowerShell, Windows Event Log API, etc.)?
• What challenges did you face regarding performance and scalability?

Any suggestions or architectural recommendations would be greatly appreciated.

Hi everyone,

I am exploring a solution for Windows Event Log analysis in an enterprise environment and looking for recommendations.

Requirement:
I want to analyze Windows Event Logs using plain English queries. The idea is that an admin can ask questions like:

• “Is device XYZ successfully Entra ID joined?”
• “Did user ABC complete Intune enrollment?”
• “What issue caused the enrollment failure?”
• “Which event log path contains the related logs?”
• “Show the exact error event and explain it in simple English.”

Example:
For Entra ID Join / Device Registration, logs are available under:

Applications and Services Logs
→ Microsoft
→ Windows
→ User Device Registration
→ Admin

I am looking for a system/tool that can:

1. Read and correlate Windows Event Logs automatically
2. Convert technical events/errors into plain English explanations
3. Identify relevant log sources and event IDs
4. Support troubleshooting scenarios across Entra ID, Intune, Windows enrollment, authentication, compliance, etc.
5. Possibly support natural language querying (AI-assisted)

Questions:

• Are there any existing inbuilt Microsoft tools that already provide this capability?
• Has anyone built a custom MCP server or AI-based solution for this kind of log analysis?
• Would using an MCP server with LLM + Event Log ingestion be a good approach?

I am considering building a custom MCP server that can:

• Read Windows Event Logs
• Map known Event IDs to troubleshooting scenarios
• Use AI/LLM to summarize findings
• Return plain English explanations with exact log paths

Would love to hear suggestions, architectures, best practices, or existing tools that already solve this problem.

Thanks!

Hi everyone,

I am exploring a solution for Windows Event Log analysis in an enterprise environment and looking for recommendations.

Requirement:
I want to analyze Windows Event Logs using plain English queries. The idea is that an admin can ask questions like:

• “Is device XYZ successfully Entra ID joined?”
• “Did user ABC complete Intune enrollment?”
• “What issue caused the enrollment failure?”
• “Which event log path contains the related logs?”
• “Show the exact error event and explain it in simple English.”

Example:
For Entra ID Join / Device Registration, logs are available under:

Applications and Services Logs
→ Microsoft
→ Windows
→ User Device Registration
→ Admin

I am looking for a system/tool that can:

1. Read and correlate Windows Event Logs automatically
2. Convert technical events/errors into plain English explanations
3. Identify relevant log sources and event IDs
4. Support troubleshooting scenarios across Entra ID, Intune, Windows enrollment, authentication, compliance, etc.
5. Possibly support natural language querying (AI-assisted)

Questions:

• Are there any existing inbuilt Microsoft tools that already provide this capability?
• Has anyone built a custom MCP server or AI-based solution for this kind of log analysis?
• Would using an MCP server with LLM + Event Log ingestion be a good approach?

I am considering building a custom MCP server that can:

• Read Windows Event Logs
• Map known Event IDs to troubleshooting scenarios
• Use AI/LLM to summarize findings
• Return plain English explanations with exact log paths

Would love to hear suggestions, architectures, best practices, or existing tools that already solve this problem.

Thanks!

Hi everyone,

I am exploring a solution for Windows Event Log analysis in an enterprise environment and looking for recommendations.

Requirement:
I want to analyze Windows Event Logs using plain English queries. The idea is that an admin can ask questions like:

• “Is device XYZ successfully Entra ID joined?”
• “Did user ABC complete Intune enrollment?”
• “What issue caused the enrollment failure?”
• “Which event log path contains the related logs?”
• “Show the exact error event and explain it in simple English.”

Example:
For Entra ID Join / Device Registration, logs are available under:

Applications and Services Logs
→ Microsoft
→ Windows
→ User Device Registration
→ Admin

I am looking for a system/tool that can:

1. Read and correlate Windows Event Logs automatically
2. Convert technical events/errors into plain English explanations
3. Identify relevant log sources and event IDs
4. Support troubleshooting scenarios across Entra ID, Intune, Windows enrollment, authentication, compliance, etc.
5. Possibly support natural language querying (AI-assisted)

Questions:

• Are there any existing inbuilt Microsoft tools that already provide this capability?
• Has anyone built a custom MCP server or AI-based solution for this kind of log analysis?
• Would using an MCP server with LLM + Event Log ingestion be a good approach?

I am considering building a custom MCP server that can:

• Read Windows Event Logs
• Map known Event IDs to troubleshooting scenarios
• Use AI/LLM to summarize findings
• Return plain English explanations with exact log paths

Would love to hear suggestions, architectures, best practices, or existing tools that already solve this problem.

Thanks!

Hello Experts,

I’m planning to build an MCP (Model Context Protocol) server focused on PCAP/network traffic analysis and would love input from the community.

The goal is to create an MCP server that allows an LLM to intelligently analyze .pcap files, inspect protocols, detect anomalies, and assist with troubleshooting/security investigations.

I’m currently designing the architecture and trying to identify:

1. Core MCP Tools

What are the ideal tools/functions an MCP server for PCAP analysis should expose?

Some ideas:

• analyze_pcap() → protocol summary, conversations, statistics
• detect_anomalies() → suspicious traffic patterns
• live_capture() → real-time interface capture

2. Resources

What resources should ideally be exposed to the LLM?

3. Special Prompts

What instructions are important for safe and accurate analysis?

4. Best Practices

Looking for recommendations around:

• MCP architecture patterns
• Tool granularity (small tools vs large tools)
• Performance optimization for large PCAPs
• Streaming analysis workflows
• Security considerations
• Multi-agent approaches for protocol analysis
• Best way to expose tshark functionality safely
• Handling token/context limitations with large captures

If anyone has built something similar — especially around Wireshark, tshark, MCP-based security tooling — I’d really appreciate your insights, architecture ideas, or open-source references.

Thanks!

Hello Experts,

I have recently started learning the MCP (Model Context Protocol) concept. I created a simple MCP server and connected it with Claude Desktop as the MCP client.

I want to understand how the complete flow works internally, especially how the LLM understands when it should use an MCP server.

For example:

• If a user writes a prompt in natural language in Claude Desktop chat, what are the exact backend steps that happen?
• How does the LLM understand the context of the prompt? Does the LLM understand it by itself, or does it use the tool docstrings/descriptions provided by the MCP server? What actually happens internally?
• How does it decide that a specific MCP server/tool should be used (for example, an internet/search MCP server)?
• How does the MCP client expose the available tools, prompts, and resources to the LLM?
• How is the context maintained during the conversation?

I want to understand the complete end-to-end architecture and internal workflow in detail.

Another thing I noticed is that in most MCP examples, only tools are commonly used. I do not clearly understand:

• How resources are managed
• How prompts are managed
• How the MCP client/LLM becomes aware of these resources and prompts
• When resources/prompts are preferred over tools

If anyone can explain the detailed architecture or share learning resources/examples, it would really help me.

Thanks in advance!

Hello Experts,

I have recently started learning the MCP (Model Context Protocol) concept. I created a simple MCP server and connected it with Claude Desktop as the MCP client.

I want to understand how the complete flow works internally, especially how the LLM understands when it should use an MCP server.

For example:

• If a user writes a prompt in natural language in Claude Desktop chat, what are the exact backend steps that happen?
• How does the LLM understand the context of the prompt? Does the LLM understand it by itself, or does it use the tool docstrings/descriptions provided by the MCP server? What actually happens internally?
• How does it decide that a specific MCP server/tool should be used (for example, an internet/search MCP server)?
• How does the MCP client expose the available tools, prompts, and resources to the LLM?
• How is the context maintained during the conversation?

I want to understand the complete end-to-end architecture and internal workflow in detail.

Another thing I noticed is that in most MCP examples, only tools are commonly used. I do not clearly understand:

• How resources are managed
• How prompts are managed
• How the MCP client/LLM becomes aware of these resources and prompts
• When resources/prompts are preferred over tools

If anyone can explain the detailed architecture or share learning resources/examples, it would really help me.

Thanks in advance!

Hi everyone
I am working on an experiment where I want to analyze raw network traffic (PCAP files from Wireshark) and then ask natural language questions on top of that data using an LLM via MCP (Model Context Protocol) server.

Goal (high level):

• Capture traffic using Wireshark / PCAP
• Analyze raw packet‑level data (not just summaries)
• Expose this data to an MCP server
• Ask NLQ questions, e.g.:
  • “Is there any suspicious traffic spike?”
  • “Which IP is generating abnormal packets?”
  • “What protocols dominated during the outage?”
• I want to keep the system low‑cost, serverless, and focused on deep raw‑data analysis, not just summaries.

Any guidance, examples, or design suggestions would be greatly appreciated.
Thanks in advance!