Active Directory turned 25 last year. And while the tech world has evolved dramatically, AD remains the backbone of identity in countless organizations. But with age comes exposure. Attackers still see it as a crown jewel, and breaches often begin (and escalate) right there. This session dives into what happens when AD is compromised—and more importantly, what comes next. We’ll walk through real-world incident response scenarios, common post-breach challenges, and the hard lessons learned along the way. You'll gain practical guidance on recovery, re-hardening, and modernizing your AD security posture—because in 2025, legacy doesn’t mean obsolete. It means critical. Whether you're holding the line or planning your next move, this session will equip you to defend your domain with confidence.

You will learn:

• Phases of incident response
• What to do
• What certainly not to do