Inside Active Directory's Origin Story: Aaron Turner on Microsoft's "Kill Novell" Mission
Identity Decoded | The Identity Security PodcastShow Notes
In episode one of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough sit down with Aaron Turner, who spent eight years at Microsoft during the founding of Active Directory — starting as a support engineer and later working on Active Directory, SQL Server, Windows Mobile, and Xbox Live. Aaron takes listeners back to the mid-'90s mindset that shaped Active Directory's design: a mission to "kill Novell" and sell more Windows and Office licenses, not to build a security boundary. The conversation traces how that original trade-off — deployment speed over security — led to decades of "identity debt," why LSASS (designed in 1998) has become a favorite target in modern ransomware-as-a-service kill chains, and what the NSA's declassified account of removing Russian actors from the US Treasury reveals about identity segmentation done right (and wrong).
🎧 Episode Highlights [00:02:00] Aaron's origin story: getting into computers after watching WarGames, early penetration testing, and landing a bilingual, Novell-experienced role at Microsoft. [00:04:00] The Venezuela story: building a countrywide identity platform on NT4, and how that trip led to Bill Gates personally awarding Aaron a "gold star" in 1999. [00:07:00] Why Active Directory's original mission statement was to "steal Novell's lunch money," not build a product with security in mind from the start — and the resulting tension between deployment speed and security. [00:11:00] The mismatch at the heart of Active Directory: enterprise-grade authentication, handed to teams without enterprise-grade security operations. [00:15:00] The economics of identity debt: roughly $250 billion spent on firewalls since 1999, versus an estimated 2% of that on identity. [00:18:48] The LSASS problem — why a process designed in 1998 to run for a week at most now caches years of credentials, and how that fuels modern ransomware-as-a-service kill chains. [00:22:20] Aaron's practical playbook: turn on success logging, visualize authentication traffic with tools like Gravwell, and eliminate legacy protocol dependencies (like clear-text LDAP) one server at a time. [00:24:25] The NSA's declassified account of removing Russian actors from the US Treasury — how attackers moved across five separate identity planes (on-prem AD, AD FS, Entra, Okta, Duo) to stay hidden, and why simplifying your identity stack matters more than adding another layer.
🔑 Key Takeaways: Takeaway 1: Active Directory was never designed as a security boundary — it was built to sell more Windows and Office licenses, and decades of security assumptions have been built on top of an infrastructure tool, not a security system. Takeaway 2: The industry's massive underinvestment in identity relative to firewalls (an estimated $250B vs. ~2% of that on identity) has created a structural "identity debt" that most enterprises can't simply modernize their way out of — many will have to invest in shoring up legacy infrastructure rather than fully replacing it. Takeaway 3: Adding more identity providers doesn't reduce risk if it adds more places for attackers to hide — as seen in the NSA's Treasury case study, simplifying and consolidating your identity stack is often more effective than layering on additional cloud identity tools.
👤 Guest Spotlight Aaron Turner, IANS Faculty Aaron Turner has spent over 30 years in the security industry, starting as an early penetration tester in the 1990s before joining Microsoft, where he spent eight years working across Active Directory, SQL Server, Windows Mobile, and Xbox Live. Early in his Microsoft career, he helped rebuild a national identity platform for Venezuela on NT4 — a project that led Bill Gates to personally recognize him with a "gold star" award in 1999, one of the company's most selective honors at the time. That recognition gave Aaron the freedom to work across some of Microsoft's most foundational identity and security projects during the internet's early enterprise
More from Identity Decoded | The Identity Security Podcast
Recorded live at Identiverse in Las Vegas, this episode of Identity Decoded brings co-hosts Roy Akerman and Rob Ainscough together with Dr. Rogerio Rondini, Head of Innovation at PwC Netherlands, who has spent 16 years working in identity. Rogerio argues that identity has grown from workforce access into federation, customer identity, non-human identity, and AI agents, yet most organizations still run it with the same siloed operating model: separate teams, separate tools, and separate budgets for workforce, customer identity, and privileged access. Tune in to hear what it takes to bring those pieces together, from why identity verification is no longer just a customer concern in the age of deepfake job candidates to how his team is exploring AI agents to help organizations see what good Zero Trust looks like, plus why bringing identity and cybersecurity closer may be one of the most powerful and important moves a security team can make.
In this episode of Identity Decoded, recorded at Identiverse, hosts Roy Akerman and Rob Ainscough flip the usual format with Simon Moffat, founder of analyst firm The Cyber Hut and a 20-plus year veteran of identity vendors including ForgeRock and Oracle. Simon argues that identity's traditional pillars — IGA, PAM, access management — were built for a linear, on-premises world, and they're now colliding under pressure from AI, non-human identity, and agentic systems. The conversation covers why category definitions provide clarity but should never be considered unshakeable, Simon's vision for a composable "identity operating system" built around horizontal capabilities instead of vertical products, and a practical framework for actually measuring whether identity controls are working.
In this episode of Identity Decoded, recorded live at Identiverse, hosts Roy Akerman and Rob Ainscough sit down with George Roberts, Principal Architect for Identity and Access at McDonald's, to talk about Identity Security at a scale few practitioners ever encounter. George manages 2.2 million workforce identities across 95 markets worldwide. The conversation covers how McDonald's built a single source of truth without 1,500 separate HR integrations, why frontline workers get a printed, paper-based MFA sheet as their "least common denominator" security factor, and George's long-term vision for verifiable credentials and distributed identity. They also dig into why identity teams get looped into new technology initiatives too late, and why George doesn't think AI or continuous identity are overhyped, just under-answered.
In episode two of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough continue their conversation with Aaron Turner — this time tracing a surprising parallel between drug cartels and ransomware groups. Aaron was assigned to the US Department of Justice after 9/11 and spent 18 months working with DEA Special Operations Division under Steve Murphy and Javier Peña — the real-life figures behind Netflix's Narcos. He breaks down why both types of criminal organizations are, at their core, transnational, economically rational actors that rely on stolen or assumed identities to operate. The conversation moves from Pablo Escobar's "plata o plomo" model of corrupting trust, to franchise-style scaling that lets sophisticated attackers hide inside the noise of less-skilled affiliates, to Aaron's later work at Idaho National Lab building some of the first cyber-physical attack simulators — and what that taught him about identity segmentation across IT and OT environments.
In this episode of Identity Decoded, recorded live from Identiverse, hosts Roy and Rob sit down with Sean O'Dell to unpack one of the most talked-about — and least understood — challenges in Identity Security today: agentic identity. Sean shares how his background across healthcare, entertainment (including a stint reverse-engineering an authorization system at The Walt Disney Company), and engineering shaped his product-first approach to identity and access management. The conversation dives into why identity must be a "first directive" baked into agents at creation, the difference between agent identifiers and agent identities, the lack of standards across providers, and Sean's practical advice for security teams overwhelmed by agentic adoption: pick one team, one use case, and deliver one verified agentic identity before trying to scale. They also cover AI security hype, the legal and liability questions raised by LLM decision-making, and why "IGA is the answer to all your questions" might be identity's biggest myth.