from the do-not-pass-go,-do-not-collect-$200 dept

More than 4,000 Hollywood insiders recently signed a letter blasting Paramount’s planned $111 billion merger with Warner Brothers, noting that the massive consolidation will be very historically harmful to labor, consumers, and creatives. That’s a very correct observation, especially as it relates to Warner Brothers, which has never been involved in a merger that didn’t result in mass layoffs, higher prices for everyone, and a significantly shittier overall product.

Now a coalition of press groups, including Freedom of the Press Foundation (FPF) and Reporters Without Borders, are pressing Paramount regarding “potentially corrupt acquisitions and deals” they argue could undermine shareholder value by degrading the (already sagging) quality of journalism at CBS News and CNN, while “relinquishing editorial control of major news outlets to the Trump administration.”

In a letter sent to former Trump DOJ “antitrust enforcer” (using that term ironically) turned Paramount top lawyer Makan Delrahim, the groups highlight all the dodgy bullshit that we’ve well-covered over the last year, whether it’s CBS paying the president a $16 million bribe to gain merger approval, CBS agreeing to install an “ombudsman” to ensure the network is consistently kissing the president’s ass, or Paramount billionaire owner Larry Ellison privately meeting with his friend Trump to promise he’d fire certain CNN anchors if the government allowed him to buy Warner Brothers.

The journalism groups make the point that the Ellison family effort to turn CBS into a Trump and Netanyahu-friendly agitprop machine has been disastrous for the company’s share price. And because both organizations are technically shareholders, they’re demanding deeper access to the Paramount books to see what other dodgy bullshit may not have been revealed yet:

“Since Paramount Skydance announced its most consequential Trump-friendly changes at CBS News in October — acquiring The Free Press and appointing Bari Weiss as editor-in-chief — the company’s market capitalization has decreased by 40%, wiping out more than $8 billion in shareholder value. Ratings for key programs, like “CBS Evening News with Tony Dokoupil,” have also dropped precipitously. Freedom of the Press Foundation and Reporters Without Borders, which are both shareholders in Paramount Skydance Corp., are entitled to inspect the company’s books and records related to these developments under Section 220 of the Delaware General Corporation Law.”

They’ve given Paramount five days to respond to their request for more documents and data related to any promises Paramount may have made the Trump administration. I’m not convinced the gambit will go anywhere, but it’s nice to see these kinds of groups (historically absent from many of these fights) suddenly paying closer attention to media consolidation.

Larry Ellison’s interests here are two-fold. He wanted to gift his nepobaby son David with two major Hollywood studios so David can pretend he’s a very big boy doing very serious things. But he’s also keen on dismantling what’s left of journalism at places like CBS News and CNN (already reeling from years of corporate cowardice) turning them into right-wing friendly agitprop mills that are even more friendly to his favorite autocrats (Trump and Netanyahu).

You’ll recall Bari Weiss sold herself to Paramount as an expert who could modernize CBS News through virality and mass audience appeal (despite having no actual experience in journalism). But Weiss, who got her start at the helm of a strange contrarian troll blog, has the instincts and ideas of a 90 year old man, and clearly isn’t capable of generating watchable propaganda in any ratings-grabbing way that actually appeals to anyone (even MAGA folks, who already have no limit of agitprop options).

The Trump administration will certainly rubber stamp the deal. Paramount will likely keep this effort locked up in the courts indefinitely. And the Democrats’ demand for the FCC to investigate the dodgy Chinese and Saudi financing propping up the deal isn’t likely to go anywhere. That leaves a collaborative looming lawsuit by state AGs as the most likely path toward ensuring this deal never gets off the ground.

But even if the deal gets approved, this giant company’s long-term survival is far from guaranteed. Especially given the shaky state of Hollywood, the steady enshittification of streaming, and the fact that there’s very little evidence that the any of the Paramount folks are competent.

There’s a very high likelihood that the combination of Paramount’s massive debt load from both the CBS and Warner deals– and fleeing audience (either bored by bad product or disgusted by the companies’ Trump allegiances) — combines with Larry Ellison’s over-extension on AI to result in some very precarious financial footing.

These major media deals always go terribly for consumers and labor, but execs often benefit from tax breaks, temporary stock boosts, and compensation in no way dictated by competency (see: CEO David Zaslav). But this series of deals is so massive and problematic, it could generate some very significant pain for the extraction class, and make all past merger disasters seem adorable by comparison.

Filed Under: consolidation, corruption, david ellison, journalism, makan delrahim, media, merger, press

Companies: freedom of the press foundation, paramount, reporters without borders, warner bros. discovery

Gartner’s report found that organisations need to invest in a workforce that can lead the transition to autonomous capabilities.

Over the course of the last year, there have been a range of high-profile layoffs as a result of the continued investment into AI and its capabilities. 

Recently, Cloudflare announced plans to cut 20pc of its workforce after AI usage at the company grew by 600pc in three months and in April, social media and tech platform Meta told staff that it will be laying off 10pc of its workforce, roughly 8,000 employees, reportedly as a means of mitigating the costs of heavy AI spending. Similarly, Snap is laying off 16pc of its workforce to cut costs and focus on AI. 

Gartner surveyed 350 globally dispersed business executives in the third quarter of 2025, to better understand the state of autonomous business at enterprises. Qualifying organisations reported enterprise-wide annual revenue of at least $1bn or the equivalent, and had been piloting or had already deployed either an AI agent, intelligent automation or autonomous technologies.

Of the organisations taking part in the piloting or deployment of autonomous business capabilities, roughly 80pc admitted to reducing their workforce. Gartner’s research found that these reductions do not appear to translate to a return on investment (ROI) for the organisations making the changes. 

The survey found that workforce reduction rates were nearly equal among respondents that reported a higher ROI from autonomous technologies and those that experienced only modest gains or negative outcomes.

Commenting on the findings of the report, Helen Poitevin, a distinguished vice-president and analyst at Gartner, said, “Many CEOs turn to layoffs to demonstrate quick AI returns – however, this disposition is misplaced.

“Workforce reductions may create budget room, but they do not create return. Organisations that improve ROI are not those that eliminate the need for people, but those that amplify them by aggressively investing more in skills, roles and operating models that allow humans to guide and scale autonomous systems.”

Despite increased layoffs as a result of AI adoption, Gartner’s research suggested that, while autonomous business will continue to increase alongside AI agent software spending, “the need for people will go up, not down”. To that point, Gartner predicts that “autonomous business will be a net-positive job creator by 2028 to 2029, driven by new forms of work that AI cannot absorb”.

“Long term, autonomous business will create more work for humans, not less. Lasting structural factors such as demographic decline and high-stakes, trust-dependent consumer moments will ensure human talent remains central to running, governing and scaling autonomous business,” said Poitevin.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

More Information

As wireless communications technologies such as Wi-Fi (IEEE 802.11) and cellular (LTE, 5G NR) continue to demand higher data throughput, the modulation schemes used to encode information have grown increasingly complex. Modern systems employ quadrature amplitude modulation (QAM) with orders up to 4096QAM, where each symbol carries twelve bits but the constellation points are extremely close together. This makes modulation accuracy critical: even small deviations in amplitude or phase can cause bit errors. Error vector magnitude (EVM) has become the primary metric for quantifying this accuracy. This white paper covers the fundamentals of digital modulation, defines EVM and its calculation methods, explores the common sources of EVM degradation, and explains how constellation diagrams can be used to visually diagnose the root causes of modulation impairments in practical wireless systems.

Humanoid robots are a thing now, and here’s an interesting research project that explores using one as a form of haptic media. Specifically, using a humanoid robot to move a chair while one plays a VR driving simulator.

Here’s how it works: a Unitree G1 robot sits behind a player’s chair and grasps it with its hands. Spherical markers on the chair help the robot’s depth camera know the chair’s position, and real-time G-force signals fed from the simulator (Assetto Corsa, running on PC) tell the robot how much and in what direction to shift the chair to match in-simulator events.

While a humanoid robot (especially one equipped with articulated, human-like hands) makes for an awfully expensive force feedback chair, this approach is interesting because it specifically explores using an already-existing humanoid robot as a general-purpose device. It sits in a chair, looks with its camera, grasps with its hands, and moves the player’s chair in response to game events; no hardware modifications required.

So how well does it work? Pretty well, apparently! Participants found the synchronized motion feedback accurate and highly enjoyable, although it does seem like there were some rough edges. Some testers reported that the sustained motion and constant vibration were tiring, and in some cases seemed to worsen VR sickness.

Still, using a robot in this way seems to be a conceptual success and showcases the potential of humanoid robots as flexible, general-purpose devices. We’ve seen a robot used to provide interactive force feedback in VR before, but a driving simulator makes for a pretty fun demonstration.

The video is embedded below, and for more information, check out the team’s research paper.

Summer is when pools move from being part of the setup to becoming part of everyday life. What starts as a manageable routine quickly turns into regular use, whether it is weekends with family, hosting friends, or simply spending more time outdoors. It is also when maintenance stops being occasional and begins to demand consistency, which is where most systems start to fall short.

Surface debris returns faster than expected, shallow areas remain inconsistent, and steps that were meant to be automated begin to come back into the routine. What looks simple at the start of the season starts to take more time than it should, especially when the pool is being used more often.

Beatbot positions the Sora 70 as a way to remove that friction altogether. Built as a 4-in-1 cordless system, it brings together water-surface cleaning, waterline scrubbing, wall climbing, and floor cleaning into a single workflow that reduces the need for repeated intervention. More than that, it fits into how pools are actually used during the season, making it a practical upgrade for homeowners and a high-value gift for those investing in easier, more usable outdoor living. With the Anniversary Campaign running from May 9 to 25, it arrives at a point where that shift becomes both relevant and easy to act on

A 4-in-1 system designed to replace fragmented pool cleaning

Most robotic pool cleaners still leave gaps in how cleaning is handled. Floors are covered, walls are managed, but surface debris, shallow platforms, and waterline buildup are often left to separate tools or manual effort. That fragmentation becomes more visible with regular use, when no single cycle fully resets the pool and maintenance starts to return in smaller, repeated steps.

The Sora 70 is designed to replace that fragmented approach. Its 4-in-1 system brings together water-surface cleaning, waterline scrubbing, wall climbing, and floor cleaning into a single cycle, reducing the need for multiple devices or follow-up passes. Instead of dividing the process, it handles the pool as one continuous environment, which is where most systems tend to fall short.

In practical terms, this shifts the experience from managing individual cleaning tasks to relying on a system that delivers complete coverage in one run. That reduction in manual effort is what makes it a smarter upgrade, and also what allows it to stand out as a more considered purchase for homeowners looking to simplify how their pool is maintained.

Designed to handle the areas most systems miss

In many pools, the challenge is not cleaning the obvious surfaces but reaching the areas that are easy to skip. Shallow platforms, tanning ledges, and multi-level sections often sit outside the effective range of standard robotic cleaners, which leaves parts of the pool inconsistent even after a full cycle.

The Sora 70 addresses this through its dual SonicSense ultrasonic sensors, which allow it to navigate shallow-water zones as low as 8 inches. This enables it to move across varied pool layouts without breaking the cleaning path, maintaining continuity from surface to floor.

That consistency removes the need for manual correction after each cycle, which is where most of the effort tends to go. For users looking for reliable cleaning that holds up through regular use, this is where the system begins to justify itself not just as an upgrade, but as something that delivers ongoing value over time.

JetPulse turns surface cleaning into an active process

Surface debris is one of the most persistent issues in pool maintenance, especially during summer use when leaves, dust, and particles return quickly. Most robotic systems rely on passive movement, collecting debris only when it drifts into range, which often requires multiple cycles to achieve visible results.

The Sora 70 takes a more active approach through its JetPulse system. A twin-jet mechanism generates directed water flow that pulls floating debris toward the intake, allowing it to be captured earlier in the cycle rather than after repeated passes. This shortens the time between cleaning and usability, which matters more during periods of frequent use. Instead of waiting for the pool to settle, it stays ready with fewer interruptions, supporting a setup that is easier to maintain without repeated intervention.

HydroBalance maintains consistent suction across the entire cycle

In many robotic cleaners, suction performance drops as the cleaning cycle progresses, which leads to uneven results and often requires additional runs to fully clear the pool. That inconsistency becomes more noticeable during regular use, when debris accumulates quickly and cleaning needs to be reliable rather than repeated.

The Sora 70’s HydroBalance system is designed to maintain a steady flow throughout the cycle. A center-mounted pump creates a direct, low-resistance path, while a high-efficiency motor sustains 6,800 GPH suction without drop-off. The 6.7-inch intake reduces clogging, and the bottom-hugging design helps retain suction close to the surface being cleaned. This allows debris to be removed in a single pass, reducing the need for additional cleaning cycles and making the system easier to depend on as part of a regular pool routine.

Filtration that supports both routine cleaning and higher-precision results

Alongside debris removal, the Sora 70 is built to handle the difference between visible cleaning and actual water clarity. A 6L, 150-micron debris basket captures leaves, insects, and larger particles during everyday use, allowing longer cycles without frequent emptying and keeping routine maintenance consistent.

When finer particles become more noticeable, particularly during periods of frequent use, an optional 3-micron ultra-fine filter captures dust, pollen, and algae spores that are not always visible during standard cleaning cycles.

By maintaining the same cleaning process while improving the level of filtration, the system avoids adding extra steps while delivering a more refined result. That consistency becomes part of its long-term value, particularly for homeowners who want a setup that continues to perform without added effort, and for those considering a more considered purchase that improves how the pool is maintained over time.

Retrieval that does not interrupt the process

Retrieval remains one of the most inconvenient parts of robotic cleaning. The process often requires manual handling at the end of each cycle, which breaks the sense of automation. The Sora 70 addresses this through Smart Water-Surface Parking and One-Touch App Retrieval. At the end of a cycle, it rises to the surface and moves toward the pool edge, where it can be accessed without additional effort.

The SmartDrain system releases excess water before lifting, reducing weight and making handling easier. This keeps the experience consistent from start to finish, without reintroducing effort at the final step, which is often where automation tends to fall apart.

Built for longer use, not just shorter cycles

Pool cleaning needs to keep up with usage, especially during summer when the pool is used more frequently. The Sora 70 is powered by a 10,000 mAh battery that supports up to seven hours of surface cleaning or five hours of full-pool cleaning, allowing it to cover up to 3,230 square feet in a single cycle.

Its cordless design removes the need for cable management, improving ease of use in active outdoor environments. This makes it easier to treat as part of a regular setup rather than a task that needs planning, which is where most systems start to feel limiting.

A shift that fits how pools are used through the season

Pool usage changes once the season is in full swing, with expectations moving beyond basic cleaning toward maintaining a space that stays ready without repeated attention. Bringing surface cleaning, walls, and the pool floor into a single system allows the Sora 70 to remove the need for managing separate steps, keeping the overall setup consistent even during periods of regular use without adding to the workload.

That difference becomes more relevant when the decision moves from solving an immediate problem to choosing a system that continues to deliver over time. For homeowners upgrading an outdoor space, the Sora 70 works as a high-value addition that improves how the pool is used without adding complexity. It also translates naturally into a premium, practical gift for pool owners or new homeowners, where the value comes from reducing a recurring task rather than introducing another one.

With Anniversary pricing from May 9 to 25, where it is available at $1,149, down from $1,499, the timing aligns with peak pool use. The shift toward less manual work and a more reliable setup becomes easier to act on, making it a relevant upgrade for the season as well as a considered purchase that continues to deliver beyond it.

Sora 30: a smart upgrade for consistent everyday cleaning

Building on the approach established by Beatbot’s Sora 70, the Sora 30 focuses on the parts of pool cleaning that define everyday use, delivering consistent results without moving into full 4-in-1 automation. It is designed for users who want dependable cordless pool cleaning that reduces manual effort while keeping the system simple to operate.

Its 3-in-1 cleaning across floor, walls, and waterline ensures routine maintenance is handled in a single cycle, with dual roller brushes supporting stable wall climbing and consistent contact across surfaces. The filtration system captures both larger debris and finer particles within the same pass, helping avoid repeat runs, while a runtime of up to five hours allows most residential pools to be cleaned without interruption.

Coverage extends to shallow zones such as steps and ledges, and smart surface parking brings the unit to an accessible point for retrieval, with the fully cordless design removing cable management altogether and making repeated use easier to manage over time.

As part of Beatbot’s Anniversary offer from May 9 to 25, the Sora 30 is available at $699, down from $999, positioning it as a clear step up from entry-level cordless pool cleaning. It works both as a smart upgrade for everyday use and as a practical, high-value gift for pool owners or new homeowners, delivering less work, more pool time, and a setup that holds up through regular use.

AquaSense X: a premium system for low-intervention pool care

Extending beyond the Sora series, Beatbot’s AquaSense X is designed for users who want pool cleaning to operate with minimal involvement, moving from consistent maintenance into a more automated, system-led approach.

It brings complete, all-zone coverage into a system built around advanced pool robotics, combining floor, walls, waterline, and surface cleaning with filtration and water clarification. Automated debris handling reduces the need for manual emptying, while intelligent navigation ensures consistent coverage across the entire pool without requiring supervision, shifting the experience from managing cleaning cycles to relying on a system that runs with minimal input. This makes it particularly relevant for larger pools or setups that see frequent use, where consistency and reduced intervention matter more than isolated cleaning performance.

As part of Beatbot’s Anniversary offer from May 9 to 25, the AquaSense X is available at $3,999, down from $4,250, positioning it as a flagship upgrade within advanced pool robotics. It also works as a premium, high-value gift for homeowners investing in outdoor spaces, delivering less work, more pool time, and a system that continues to perform without constant attention.

AquaSense 2 Ultra: AI-powered cleaning for complex pool environments

Positioned within the premium segment, the AquaSense 2 Ultra introduces HybridSense AI-powered mapping, enabling precise navigation, obstacle detection, and adaptive path planning across complex pool layouts. Its 5-in-1 cleaning system covers surface, floor, walls, waterline, and water purification, while HybridSense AI mapping helps reduce cleaning time by up to 50% through more efficient coverage. ClearWater natural clarification improves water clarity alongside debris removal, and side brushes enhance surface cleaning performance, ensuring that both visible and fine particles are addressed within the same cycle.

Adaptive path planning allows it to navigate multi-level platforms and irregular pool shapes more effectively, while remote control functionality provides flexibility when needed. Once cleaning is complete, the system returns to the pool edge automatically for easy retrieval without manual handling.

Available at $2,649, with $501 off as part of Beatbot’s Anniversary offer from May 9 to 25, the AquaSense 2 Ultra stands out as a compelling premium upgrade for users looking to step into AI-driven pool cleaning. It balances reduced cleaning time, complete coverage, and advanced automation, making it easier to maintain a high-quality pool setup with less ongoing effort.

A more complete way to approach pool care this season

This lineup works because each system is aligned to a clear level of effort reduction. The Sora 70 brings full coverage into a single system. The Sora 30 simplifies everyday cleaning into a more consistent routine. The AquaSense range extends that further into automation and intelligent control.

With the Anniversary Campaign running from May 9 to 25, the decision shifts from comparing features to choosing how much of the process to remove. Whether it is replacing manual cleaning, consolidating multiple tools, or moving toward a more automated setup, the current pricing makes that shift easier to act on now.

For pool owners preparing for the season, or for those looking at a more meaningful, high-value gift, this is a moment where upgrading becomes a practical decision. Whether it is about reducing ongoing effort or making the pool easier to use day to day, the Sora 70 aligns with a simple outcome that defines summer use at its best, less work and more time in the water.

There are probably a few old Fire TV Sticks still plugged into TVs across the country, collecting dust and loading just slowly enough to make you wonder whether it’s time to replace them. According to a proposed class-action suit filed in California, that sluggishness isn’t an accident. The suit alleges that Amazon deliberately ended software support for first- and second-generation Fire TV Sticks without adequately disclosing its plans to do so, effectively pushing functional hardware into early obsolescence and steering frustrated owners toward buying newer models.

The plaintiff named in the suit, Bill Merewhuader, filed in the Superior Court of Los Angeles County, said he purchased two second-generation Fire TV Stick devices from Best Buy in 2018, four years after the company debuted its first Fire TV Stick. Merewhuader said that a few years later, he experienced slower streaming speeds, difficulty navigating menus and long load times. 

He eventually was unable to use the device. He purchased new Fire TV Sticks in 2024, according to the filing.

Merewhuader says in the complaint that Amazon intentionally made older devices perform poorly to spur hardware upgrades and “bricked” Fire TV devices “before the expiration of their useful life.” 

A representative for Amazon did not immediately respond to a request for comment. Lawyers for the plaintiff said they had no further comment beyond the legal complaint.

Streaming devices are getting older

Popular streaming devices from big tech companies have been around for nearly two decades. Apple debuted AppleTV in 2007, and Roku followed the next year. Google’s Chromecast, which evolved streaming devices from set-top boxes to plug-in dongles, launched in 2013. Amazon followed up the next year with its Fire TV box and plug-in stick, released later in 2014.

As earlier generations of devices from these tech companies age, it’s common for them to lose functionality, as they can’t run newer apps or access certain features. For instance, Apple’s first Apple TV box is all but inoperable today and was eventually replaced with Apple TV 4K streaming boxes.  

Read more: Google Will Pay $135M to Android Phone Owners. Learn Who’s Eligible and How to Get Paid

The filing partly hinges on allegations that Amazon did not inform buyers that Fire TV Stick devices would lose functionality or become inoperable over time, and that the performance of early devices did not match the promises Amazon made in its marketing.

The proposed class action would be open to anyone who resides in the US and who still owns a first- or second-generation Fire TV Stick as of Jan. 1, 2023, or April 1, 2023, respectively. 

Password resets are often the first response to a suspected compromise. It makes sense; resetting credentials is a quick way to cut off an attacker’s most obvious path back in.

However, that doesn’t always completely solve the issue. In both Active Directory (AD) and hybrid Entra ID environments, password changes do not immediately invalidate the old credential across every authentication path.

Even a short window is an opportunity that potentially allows attackers to maintain access or re-establish a foothold.

For security architects and IT administrators, this gap has real implications during incident response.

The password reset gap

Windows systems cache password hashes locally to support offline logon. If a device hasn’t reconnected to the domain, it may still hold the previous credential in a usable form. In hybrid environments, there can also be a short delay before the new password syncs to Entra ID.

This means there are three possible states created after a password reset:

1. The user has logged in with the new credential while connected to AD. The cached credential store updates, invalidating the old hash.

2. The user has not logged in to a particular machine since the reset. The old cached credential may still be usable for certain authentication attempts.

3. In hybrid deployments, the password has been reset in AD but the new hash has not yet synchronized to Entra ID. The old password may still authenticate during the password hash synchronization interval.

How attackers exploit the gap

Cached credentials

Attackers take advantage of cached password hashes with methods like pass-the-hash, where the hash itself is used instead of the plaintext password. If that hash was captured before the reset, changing the password doesn’t immediately invalidate it everywhere.

Limiting that exposure is crucial to defending AD environments. Solutions like Specops uReset enable secure self-service password resets by enforcing end-user ID verification to reduce the risk of reset abuse.

When combined with the Specops Client, uReset can update the local cached credential store immediately on the device where the reset is performed, closing the window where the old hash remains usable on that endpoint.

This doesn’t remove identity drift entirely, but it does reduce exposure at the network edge, where corporate laptops and remote systems are frequently targeted.

Active sessions

AD authentication is primarily handled through Kerberos tickets, which are valid for a set period of time. If a user or attacker already has a valid ticket, they can continue accessing resources without re-entering a password.

That means an attacker with an active session remains authenticated even after the password has been changed. In some cases, that window is long enough to establish additional persistence or move laterally.

Unless sessions are explicitly invalidated, through logoff, reboot, or ticket purging, access can continue well beyond the reset itself.

Service accounts

Unlike user accounts, service accounts tend to have long-lived passwords, with elevated privileges tied to critical systems. Attackers can expose those credentials through techniques like Kerberoasting or discover them when moving laterally through a network.

Because these accounts are tied to running services, they’re less likely to be reset quickly, especially if there’s a risk of disruption. That makes them a reliable fallback for attackers after an initial access point is closed.

Ticket attacks

As mentioned above, in environments using the Kerberos authentication protocol, access is controlled through tickets rather than repeated password checks. If an attacker can forge those tickets, they don’t need valid credentials at all.

A Golden Ticket attack, made possible by compromising the Kerberos Ticket Granting Ticket account, allows attackers to create valid ticket-granting tickets for any user in the domain. Silver Tickets are more targeted, granting access to specific services without contacting a domain controller.

In both cases, these attacks effectively bypass password changes. Resetting user passwords won’t invalidate forged tickets, and access can continue until the underlying issue is addressed.

Permissions

AD is heavily driven by Access Control Lists (ACLs). If an attacker grants a compromised account (or a new one they control) rights like resetting passwords for other users, they’ve effectively created a backdoor. Even if the original password is changed, those permissions remain.

Furthermore, accounts protected by AdminSDHolder (like Domain Admins) inherit permissions from a specific template. Attackers who modify the ACL on the AdminSDHolder object can ensure their permissions are re-applied every hour by SDProp.

How to ensure attackers are removed

The time between a password reset and it synching across AD and Entra ID is small, typically just a few minutes, which severely limits the opportunity attackers have to exploit the gap. Forcing more frequent synchronizations is also possible, for instance turning on AD Change Notification or manually initiating a Sync to the Entra ID tenant.

However, the gap still exists, and by the time an account compromise is discovered, attackers may have been able to establish additional footholds. If password resets aren’t enough on their own, defenders need to look at fully closing off access.

That starts with invalidating anything already in play. Active sessions should be terminated, and Kerberos tickets cleared by forcing logoffs or reboots on affected systems. For more serious compromises, resetting the KRBTGT account (twice) is often necessary to invalidate forged tickets.

Next comes credential hygiene beyond standard user accounts. Service account passwords should be rotated, especially those with elevated privileges, and any cached credentials on endpoints should be cleared as systems reconnect.

Just as important is reviewing what’s changed in the directory itself. That means auditing:

• Group memberships
• Delegated rights and ACLs
• Privileged accounts and roles

Look for anything that could allow access to be re-established without relying on a password.

For serious breaches, there isn’t a single step that guarantees eviction. It’s a combination of cutting off sessions, rotating the right credentials, and verifying that no hidden access paths remain.

Secure your AD today

Hardening your AD requires every account to be protected by strong passwords, combined with a secure reset process that limits opportunities for abuse.

Specops helps you do both, giving you confidence that password resets strengthen your security rather than introduce new gaps.

Book a demo to see how our solutions can support your identity security strategy.

Sponsored and written by Specops Software.