The cost of skipping maintenance
Oct 27th, 2023 by Jesper Kråkhede
My previous post was about resetting the krbtgt password, a simple maintenance task that few organisations do. It is just one example of many.
Active Directory and other core systems need regular maintenance just like a car does. Resetting krbtgt. Cleaning out old accounts and computers. Reviewing privileged groups. Removing old trusts and old domain controllers. Updating the functional level. Testing the restore of a domain controller. None of it is difficult. All of it takes time, and in a small IT team that time is always needed for something else.
So it is skipped, year after year. Nothing happens, so it seems fine. Until the day of an incident, when the skipped maintenance becomes very expensive. Unknown accounts the attacker can hide behind. A krbtgt password that hasn´t been changed in ten years and that nobody dares to reset during the crisis. A restore procedure that has never been tested.
In incidents I have worked on, the lack of basic maintenance has added days, sometimes weeks, to the recovery. At the price of a full business standstill, that is enormous compared to the few hours a month the maintenance would have taken.
So for management: ask for a maintenance plan for your core systems, and protect the time to do it.
Maintenance is cheap. Emergency repairs are not.