u/Chemical-Wall9026

Working through an AD security finding in an isolated lab and want a sanity check on my understanding before I take this to a client.

The finding: "Domain trust to a third-party domain without quarantine" (ANSSI vuln1_trusts_domain_notfiltered). Description says it looks for outbound forest trusts where the Quarantine flag is false, meaning the trusted domain isn't subject to SID filtering.

What I did in the lab:

Built two forests, forestA.local and forestB.local, and created an outbound forest trust from A (B trusts A, so A's users can be authorized in B).

Scanned it — passed clean. Trust attributes read:

Direction               : Outbound
ForestTransitive        : True
SIDFilteringForestAware : False
SIDFilteringQuarantined : False

I'd expected SIDFilteringQuarantined : False to fire the finding, but it didn't. My read is that quarantine isn't the active control on a forest trust, so False there is the normal secure default. Is that right?

Then I ran:

netdom trust forestA.local /domain:forestB.local /EnableSIDHistory:Yes

Re-scanned — finding fired. Trust attributes now showed 72 [TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL, TRUST_ATTRIBUTE_FOREST_TRANSITIVE]. Quarantine never changed; only SID history did.

Where I'm confused:

1. Is "enabling SID history" and "disabling SID filtering" the same change described two ways, or are they genuinely separate controls? My current understanding is that on a forest trust there's no independent filtering switch — allowing SID history is how filtering gets relaxed. Correct?
2. Am I right that the switch differs by trust type? Forest trust → /EnableSIDHistory, external trust → /Quarantine. Same underlying protection, different lever depending on type.
3. The scanner's result line says "Quarantine is disabled or SID history is enabled" — so two independent trigger conditions, either one alone fires it. Does that match how you'd read it?

Why it matters: I need to phrase this correctly in a client report. My current wording is:

>

Does that hold up, or am I conflating things?

Also — practical question — has anyone hit a case where disabling SID history broke legitimate cross-forest access? Trying to work out what to ask a client before remediating, since I assume an in-flight migration is the one genuine reason it'd be on.

I'm learning Azure Machine Learning and had a question about data ingestion.

Instead of first uploading my dataset to an Azure Blob Storage account (or registering it as a datastore), can I simply upload the dataset directly from my local computer into Azure ML and use it for model training?

My main reason is to reduce Azure Storage costs while experimenting with small datasets.

If this approach is possible:

• What are the limitations compared to using Blob Storage?
• Is the file still stored somewhere in Azure behind the scenes?
• Are there any restrictions on dataset size, reproducibility, or collaboration?
• Would this approach work only for experimentation, or is it also suitable for production workloads?
• What is Microsoft's recommended practice for training datasets in Azure ML?

I'd appreciate any clarification from people who have used both approaches.

Azure ML Model Catalog contains a large number of models (LLMs, vision models, embedding models, speech models, etc.), and I'm finding it difficult to understand how experienced practitioners decide which one to use.

What factors should be considered when selecting a model?

For example:

• Accuracy vs latency
• Cost of inference
• Context window
• Model size
• Fine-tuning support
• Hardware requirements (CPU/GPU)
• Licensing/commercial usage
• Multilingual capabilities
• Reasoning ability
• Benchmark scores

Is there a recommended evaluation process or checklist that teams follow before choosing a model for production?

I'd love to hear how others approach model selection in Azure ML.

I'm learning Azure Machine Learning and I'm trying to understand the intended use case for the different ways of building ML solutions.

From what I understand:

• AutoML automates model training.
• Model Catalog provides pre-trained foundation models.
• Notebooks give full control over coding and experimentation.

However, I'm still unsure about the practical decision-making process.

Some questions I have:

• What should be the priority when starting a new ML project?
• How do you decide whether to use AutoML, a model from the Model Catalog, or build everything in a notebook?
• What kinds of business problems are best suited for each approach?
• Are there scenarios where one option should be avoided?
• How do experienced Azure ML users typically make this decision in production projects?

I'd appreciate any real-world examples or decision frameworks.

Hi everyone,

I've been assigned a task to clean up Active Directory accounts where adminCount = 1, but only for users who are no longer members of any protected administrative groups.

I understand that adminCount is not automatically cleared when a user is removed from a protected group, so simply resetting it for all users with adminCount = 1 would not be safe.

I'm looking for the best approach to:

• Identify all users with adminCount = 1.
• Verify whether they are still members (including nested membership) of any protected groups (such as Domain Admins, Enterprise Admins, Schema Admins, Administrators, etc.).
• Ensure no legitimate privileged accounts are missed.
• Safely clear adminCount (and re-enable inheritance if required) only for accounts that are no longer protected.

Has anyone implemented this in a production environment?

I'm particularly interested in:

• Is there a Microsoft-recommended approach?
• Is PowerShell the best option for this?
• How do you accurately handle nested group membership?
• Are there any edge cases or protected groups that are commonly overlooked?

Any guidance, sample scripts, or best practices would be greatly appreciated.

I'm trying to better understand the relationship between Azure Machine Learning Storage Accounts, Datastores, and Data Assets, and I'm a bit confused about when each should be used.

From my understanding:

• A Storage Account is where the actual data resides.
• A Datastore acts as a registered connection to the storage.
• Data Assets reference data stored in a datastore or another supported location.

However, I'm still unclear about a few things:

1. What is the practical difference between URI File, URI Folder, and MLTable?
2. For different data formats, which asset type is recommended?
   • CSV
   • Excel (.xlsx)
   • JSON
   • Parquet
   • Images
   • Text files
3. Is MLTable intended only for tabular datasets, or can it also be used with image datasets and other file types?
4. When would you register a Data Asset instead of simply accessing files directly from a Datastore?
5. Are there any performance, versioning, or reproducibility benefits to using Data Assets over directly referencing storage?
6. What is the recommended data organization strategy for production Azure ML projects?

I'd appreciate it if anyone could share real-world examples or best practices for organizing data in Azure ML.

Thanks!

Hi everyone,

I'm trying to better understand how AD-integrated DNS zones behave after the DNS Server role is removed. I reproduced the following scenario in an isolated lab and wanted to sanity-check my understanding with people who know AD internals well.

Lab setup:

• Created an AD-integrated reverse lookup zone (in-addr.arpa) configured for "Nonsecure and Secure" dynamic updates.

• Ran Purple Knight, which flagged the zone under the "Unsecured DNS configuration" finding.

• Uninstalled the DNS Server role (along with the RSAT DNS management tools) and rebooted the server.

• Verified that the DNS Server role was no longer installed (`Get-WindowsFeature DNS` showed the role as Available).

• Queried Active Directory and confirmed that the `dnsZone` object still existed under `CN=MicrosoftDNS,DC=DomainDnsZones`.

• Ran Purple Knight again, and it continued reporting the same finding even though the DNS Server role was no longer installed.

• Deleted the AD-integrated zone object.

• Re-ran Purple Knight, and the finding was no longer reported.

Based on this, my current understanding is that AD-integrated DNS zones are stored as objects within the `DomainDnsZones` / `ForestDnsZones` application partitions in Active Directory. Removing the DNS Server role removes the DNS service itself, but it does not remove these AD objects. As a result, tools like Purple Knight appear to evaluate the AD data directly rather than relying on whether the DNS service is installed.

My questions are:

1. Is my understanding of this behavior correct?

2. When DNS has been permanently migrated elsewhere, is deleting the orphaned AD-integrated zone objects the expected remediation?

3. Is the persistence of these objects after DNS role removal simply by design, or are there scenarios where they would be cleaned up automatically?

I'm trying to understand the underlying AD behavior rather than just trusting the scanner's output, so I'd appreciate any corrections or additional insights.

Thanks!

Hey everyone, I'm working on an internal productivity tool that automatically tags calendar meetings with the correct project and task category. The app pulls meeting data from the calendar API and I want the ML model to predict: which client, which project, and which task purely from the meeting metadata.

The data looks roughly like this:

| Meeting Subject | Day | Duration | Organiser Role | Task Label |

|---|---|---|---|---|

| Team daily sync | Monday | 0.25h | QA Lead | QA Standup |

| Weekly checkpoint | Wednesday | 1h | Infra Lead | Infra Weekly Call |

| Tech review session | Thursday | 1.5h | QA Lead | QA Internal Meeting |

| Daily standup | Monday | 0.25h | Client PM | Client Standup |

| Automation framework setup | Friday | 2h | QA Engineer | Mobile Automation |

~1,500 records total.

The problem:

I have ~90 unique task labels in the raw data. Most of them have only 1–5 examples. The straightforward approach is to drop rare classes (< 15 samples) but that means losing real data. I want to instead *group similar tasks* and retain everything.

But grouping is tricky:

- "Client daily standup" and "Internal daily standup" sound identical in the subject line but are completely different tasks (different billing, different project)

- "AI assistant testing" and "AI POC work" sound similar and probably should be grouped

- Some tasks are person-specific (e.g. "Remediation task - engineer A" vs "Remediation task - engineer B") — same type of work, different person assigned

What I've tried:

- Logistic Regression + TF-IDF: ~44% on tasks

- SVM: ~44%

- DistilBERT fine-tuned on subject only: ~46%

- DistilBERT on subject + body_preview + organiser: ~48%

The training loss converges fine but validation loss plateaus early, suggesting the signal just isn't strong enough in the text alone.

My questions:

1. Is there a smarter way to group ~90 classes into meaningful buckets beyond manual rules? I tried clustering sentence embeddings but struggling to validate whether the clusters actually make business sense.

2. Should I be doing hierarchical classification? (predict client first → use that as a feature → predict task). Feels like the right architecture but haven't implemented it yet.

3. Is 1,500 records just fundamentally too small for this many classes even after grouping?

4. Any features I might be missing? I currently have: subject, body preview, organiser name, duration, day of week, attendee count.

Any advice appreciated — especially from people who've tackled short-text multi-class classification with heavily imbalanced labels.

Hi everyone,

I’m working on an NLP problem and would really appreciate some guidance on what to do next.

Objective:
I’m building a model that takes a meeting subject (e.g., “weekly sync”, “client call”, “testing discussion”) and predicts:

• Project
• Client
• Task

Important point:
Not every meeting subject clearly contains all three.
Sometimes it may indicate only one or two, or be vague like “discussion” or “sync”.

Dataset:
The data comes from real meeting logs. Most fields are either missing or not useful, so I’m mainly relying on:

• meeting_subject (primary input)

Challenges:

• Short and ambiguous text
• Many similar subjects across different projects/tasks
• Task labels are very granular (~95 unique tasks)
• Class imbalance (some tasks appear very rarely)

Models I tried:

1. Logistic Regression (TF-IDF on subject)

• Project accuracy: 66%
• Client accuracy: 78%
• Task accuracy: 37%

1. SVM

• Project accuracy: 0.67
• Client accuracy: 0.80
• Task accuracy: 0.44

1. DistilBERT (separate models for each target):

• Project accuracy: 79.50%
• Client accuracy: 93.50%
• Task accuracy: 0.46

Experiments:

• Using only meeting subject → best performance
• Adding other fields → reduced accuracy due to noise

Current system:

I’ve built a pipeline where:
meeting_subject → predicts Project + Client + Task using separate models

Problem:

• Project and Client predictions are strong
• Task prediction is weak

Likely reasons:

• Too many task classes (~95)
• Tasks are too specific and overlapping
• Limited signal in short subject text

What I need help with:

1. How should I improve task prediction?
   • Should I group tasks into broader categories?
   • Or use hierarchical prediction (project → task)?
2. Should I keep 3 separate models or try a single multi-output model?
3. Is DistilBERT enough, or should I try something like RoBERTa?
4. Any best practices for handling short-text + high-class-count classification?

Goal:

I want to build a practical and usable system, not just optimize metrics.

Would really appreciate suggestions.

Thanks!