Password reset at scale after breach
Overview
Big bang resets fix lateral movement or cause lockout avalanche if sequencing sloppy—IR lead owns plan.
Preconditions
Contain ADCS / Azure AD Connect if attacker could forge creds; otherwise resets reinfect.
Strategy
- Tiered: break-glass + admins first, service accounts with documented owners second, broad users in waves by site.
- SSPR load test—portal may throttle; helpdesk surge staffing.
Secrets beyond passwords
Rotate LDAP binds, SQL logins, API keys, VPN PSKs, RADIUS shared secrets, webhooks.
Service impact
App pools using old passwords will fail—dependency map before go-live.
MFA re-enrollment
FIDO easier than SMS at volume—ship keys to critical users first.
Verification
Bloodhound / auth logs show old ticket anomalies stopped; hunt PtH patterns.
Comms
Users need simple portal link + why—reduces shadow IT password reuse to personal email.
Documentation
Spreadsheet of rotated vs exception accounts with expiry review.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...