Why Changing Passwords Doesn’t End an Active Directory Breach

Resetting a password may not immediately invalidate the old authentication path everywhere in Active Directory and hybrid Entra ID environments. Cached password hashes, active Kerberos tickets, service accounts, forged tickets, and modified ACLs can allow access to persist or be re-established.