https://blog.omiilgo.com/tags/windows/ Recent content in Windows on Security Notes Hugo en-us Thu, 10 Sep 2026 16:00:00 +0800 https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Thu, 10 Sep 2026 16:00:00 +0800 https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC. https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Tue, 14 Mar 2023 14:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Lab klist dump, field-by-field decode of times and checksum types, clock-skew 401 — no ticket-forging steps. https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Tue, 27 Sep 2022 10:00:00 +0800 https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Lab spooler service ACL and RPC interface dump, Point-and-Print registry, 7036/808 logs — no spool exploit. https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Mon, 09 May 2022 16:00:00 +0800 https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires. https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Sat, 11 Dec 2021 12:00:00 +0800 https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit. https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Mon, 17 May 2021 15:00:00 +0800 https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain. https://blog.omiilgo.com/posts/active-directory-recon-notes/ Tue, 10 Nov 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/active-directory-recon-notes/ Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook. https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Tue, 17 Mar 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse.