Part of Microsoft's responsibility is not making some of the insecure options enabled by default, but part of it is investing in the AD product itself.
AD2025 is clearly just a heartbeat update, AD hasn't had serious work done on it in years as Microsoft tries to drag everyone kicking and screaming into the cloud
I mean.. why would you want regular AD updates? There really aren't that many new features and every update is an incredible risk that has to be tested very carefully and contains the chance for unknown bugs or exploits.
The last really useful AD update I can think of were MSAs - which really made a big difference. But apart from that?
And changing defaults on existing infrastructure particularly with AD seems incredibly dangerous. AD is installed on so many different configurations in so many critical environments that probably still include ancient systems that haven't been updated in years. Just doesn't seem like a practical approach.
Much better to provide explicit guidance and best practices for how to secure your system, which means you can test and configure things separately and in your own time.
And Microsoft has a ton of information available there and it would've been totally possible to configure the system in such a way that the attack couldn't have worked.
No, I'd say the real problem is that large companies are starving their IT departments to death and are trying to be cheap as possible when it comes to security, because even now I doubt any of the responsible C-suite people will have to fear dire consequences.
