Will Schroeder
- Co-created BloodHound with Andy Robbins and Rohan Vazarkar
- Co-authored the Certified Pre-Owned research on Active Directory Certificate Services abuse
- Author of PowerView and other widely used AD enumeration tooling
Bio
Will Schroeder co-created BloodHound and has published a long run of Active Directory research, including the Certified Pre-Owned work on Active Directory Certificate Services abuse and the PowerView enumeration tooling that preceded it.
Profile built from public project, research, and company records.
Where their work shows up
The AD CS research is the clearest example of the pattern: a component almost every enterprise ran, almost nobody audited, and which could be abused to mint authentication certificates for any user. It turned an unconsidered piece of internal PKI into a first-tier identity risk overnight. See AD CS certificate template abuse, Kerberoasting, and the ITDR guide.
Related on Start with Identity
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra