Service accounts with 2012 passwords still run your domain. ⚠️

Covering: gMSA setup, Kerberoasting defense, and the GPO you forgot.