Tldr:
- Don't use SPNs if you don't need them
- Use gMSAs and friends when possible
- Stop using rc4
- Use long, brute-force resistant passwords on "user" class service accounts
- Stop using SPNs if you don't need them
Id add, stop reusing service accounts for multiple things. It makes it hard to track attacks, hard to change passwords without causing outages, and encourages the use of weak passwords stored in Excel.
