Why Changing Passwords Doesn’t End an Active Directory Breach

This vendor-written advisory explains that password resets in on-premises Active Directory and hybrid Entra ID environments can leave short windows where old credentials or Kerberos tickets remain valid, enabling attackers to persist via cached hashes, active sessions, forged tickets (Golden/Silver), service account compromise, or ACL manipulation; it recommends actions such as forcing logoffs/reboots, purging Kerberos tickets, resetting the KRBTGT account, rotating service account credentials, and auditing ACLs and privileged roles to fully evict attackers.