Further abusing the badPwdCount attribute

Fox-IT describes a weakness in Active Directory password-history handling (N-2) where failed authentication attempts using a recent previous password do not increment badPwdCount on the PDC, enabling attackers to probe badPwdCount and confirm valid current credentials without triggering lockouts; the paper includes PowerShell and Metasploit proof-of-concepts, usage guidance, and remediation recommendations (strong/passphrase passwords and IDS/IPS detection).