Why Active Directory weaknesses stay open for years in teams with one or two admins

Active Directory security in local government often suffers from long-term weaknesses not due to a lack of awareness or funding, but because of "organizational debt" and a lack of structured motivation. Small IT teams, typically consisting of one or two administrators, are often overwhelmed by the volume of tasks and the complexity of legacy Microsoft technologies, making massive audit reports difficult to action.
To address this, a cohort-based model was implemented where municipalities work in parallel over a 12-week period. This approach utilizes peer learning, expert-led templates, and a rhythmic schedule to create momentum. Risk is managed through a phased rollout: establishing auditing and logging first to identify dependencies before implementing changes like SMB and LDAP signing. While most participants followed the standard path, individual exceptions were handled one-on-one. To prevent configuration drift, the program fosters a continuing community of practice and suggests a pyramid structure of successive cohorts to incrementally increase security maturity.

* David Fuhr is the CTO at intcube.
* 27 municipalities participated in a Windows Server and Active Directory security hardening program.
* The program lasted 12 weeks.
* Participants were divided into two groups: morning and afternoon.
* The curriculum included weekly sessions and asynchronous homework.
* Technical focus areas included SMB signing, LDAP signing, and Kerberos hardening.
* Testing was conducted in a lab modeled after municipal infrastructure.
* Measurements of security posture were taken at the start and end of the program.
* A statewide security audit previously provided municipalities with reports of up to 150 pages.
* Group sizes were targeted at 10 to 15 organizations per cohort.

The strongest version of this narrative is that technical problems are often actually social or psychological problems. By transforming a daunting, solitary task into a collective "sport," the cohort model bypasses the inertia of burnout and technical debt, proving that community support is a viable security control.
The narrative relies on a specific framing: it positions the "root cause" as a lack of motivation and energy rather than a systemic failure of resource allocation or vendor design. By characterizing the solution as a "safe space" or a "roped party," it shifts the conversation from technical requirements to emotional resonance. This is a highly effective way to drive adoption, but it risks obscuring the underlying reality that these administrators are structurally undersupported.
The paradigm here is the "gamification of compliance." It echoes the shift toward agile and scrum methodologies—using rhythm and visibility to force progress on stagnant legacy systems. The benefit is a measurable increase in security; the cost is the continued reliance on a "hero culture" where small teams must find "energy" to survive an unsustainable workload.
Who benefits? The municipalities gain security, and the consultancy gains a scalable, high-impact delivery model. The second-order consequence is the creation of a dependency on these external "rhythms" to maintain basic security hygiene.
Bridge Questions:
1. If security depends on "energy" and "momentum," what happens when the cohort ends and the rhythm stops?
2. Would a systemic change in how municipal IT is staffed be more effective than a behavioral intervention?
3. To what extent does the "cohort" model replace the need for standardized, automated hardening tools?
Counterstrike Scan: A coordinated campaign would use "fear of legacy failure" paired with "the exclusivity of a proven group" to lock government entities into a specific vendor's ecosystem. The actual content is a straightforward discussion of a pedagogical approach to IT training and does not match this attack pattern.
Patterns detected: none