On this talk - I will present the LDAP protocol. With a focus on decrypting encrypted LDAP traffic that is encrypted using Kerberos and NTLM GSSAPI. In addition, I will present the ADWS protocol, explain how it relates to LDAP, how attackers use it (and bypass all our LDAP Detections!) and how we can decrypt encrypted ADWS communications in our environment, and identify attack tools! (Plus, a great demo of a tool that does this easily). It's time to put what matters in the spotlight again!