Help Net Security spoke with David Fuhr, CTO at intcube, about a security cohort in which 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. The program was originally planned for 10 to 15 participants and had to be split into two groups. Fuhr says the demand shows that awareness is not the problem: the municipalities knew they needed to act, but a typical 150-page security audit gave them no clear way to start.
Fuhr argues that Active Directory weaknesses persist for years in organizations with one or two admins because the constraint is not money or tools but motivation. Small IT teams are stretched across many tasks and lack the energy to tackle a specific hardening problem. The cohort addressed this with a fixed rhythm: two-hour weekly sessions, homework on a shared platform, and measurements at the start and end. Seeing progress week by week created momentum, like a roped party on a mountain.
To avoid breaking systems, the group first set up basic logging and auditing so each municipality could see which SMB versions and LDAP signing settings were in use. They returned to those logs weeks later before making changes. All changes were tested in a lab modeled on a simple municipal infrastructure, and rollback planning was done individually. In every cohort, two or three organizations need one-on-one help to stay on track; the group discussed risks openly, but each organization made its own decision on accepting residual risk.