This message was deleted.

Interesting read! Sounds like having a double hop deployment with external NetScaler's in DMZ would do a lot to take the teeth out of this vulnerability. Crazy how they were able to decrypt service account passwords from the NetScaler config to do LDAP recon too. Another protection would be to deny interactive logon for services accounts.