UK school’s network left wide open for invasion, student found

A UK sixth-form student discovered a misconfigured Active Directory where administrator passwords were stored in description fields and no admin authentication was required, enabling view and remote-control of servers, access to Google Workspace mailboxes, firewall settings and classroom management tools; the student did not exploit the access but the exposure represents a serious local security misconfiguration.