Topic starter
11/08/2026 3:13 pm
TL;DR: Active Directory Unicode edge cases can let non-privileged users create confusing lookalike objects, bypass SPN and UPN uniqueness checks, and escalate to domain-wide impact, according to Semperis research. The result is a governance failure, not just a parsing bug: identity systems must validate what humans can see and what controllers will actually accept.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover”.
Key questions
Q: What breaks when hidden Unicode is allowed in Active Directory object names?
A: It breaks the assumption that displayed names and directory-resolved identities are the same thing.
Q: Why do conflicting SPNs create such a serious Kerberos risk?
A: A conflicting SPN changes which account Kerberos treats as the owner of a service.
Q: How can security teams tell if Unicode abuse is hiding in Active Directory?
A: Look for duplicate-looking objects, unexpected hidden characters in attribute values, and SPN or UPN changes that do not match normal delegation or onboarding patterns.
Practitioner guidance
- Harden attribute write permissions Restrict who can modify SPN, UPN, and other lookup-sensitive attributes on user and computer objects, especially where generic write rights exist on delegated OU structures.
- Audit for invisible character abuse Scan Active Directory objects for hidden Unicode characters, duplicate-looking names, and conflicting SPN or UPN values that could alter directory resolution.
- Monitor directory modifications at the DC Enable SACLs and review Security event ID 5136 for SPN and UPN changes that collide with existing identities or introduce non-default naming patterns.
Bottom line: Invisible Unicode handling in Active Directory creates a genuine identity integrity problem because controllers, operators, and LDAP filters can disagree on what a name means.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
Directory identity is only as strong as the comparison rules behind it: If a controller and an administrator do not evaluate names the same way, then uniqueness checks become a cosmetic control rather than a security control. Active Directory’s Unicode edge cases show that identity integrity can fail even when permissions look intact. The implication is that directory governance must include parser behaviour, not only access policy.
A question worth separating out:
Q: Should organisations rely on visual review to catch directory identity abuse?
A: No. Visual review is useful for triage, but it is not enough when the directory can store values that render ambiguously or are ignored by different components. Organisations need attribute-level validation, least-privilege write access, and audit telemetry because the attack succeeds through directory semantics, not just through user deception.
👉 Read our full editorial: Unicode identity confusion in Active Directory enables Domain Admin