Skip to main content

Active Directory Hardening

Here go your tips and tricks for Hardening Active Directory Systems...

Active Directory Hardening Checklist

1. User and Group Management​

  • Limit Administrator Privileges:

    • Use Admin Tiering to segregate admin roles.
    • Assign minimum privileges required for each user (Principle of Least Privilege).
    • Use Protected Groups for highly sensitive accounts like Domain Admins.

  • Admin Account Naming Convention:

    • Avoid default admin usernames like Administrator or Admin.
    • Rename highly privileged accounts to make them harder to guess.

  • Strong Password Policies:

    • Enforce complex password policies (length, complexity, expiration).
    • Require multi-factor authentication (MFA) where possible.

  • Account Lockout Policies:

    • Configure an account lockout policy after a specific number of failed login attempts.

  • Disable or Remove Unused Accounts:

    • Regularly review and disable/remove inactive user accounts.

  • Service Accounts Security:

    • Use managed service accounts and group managed service accounts (gMSA) for system services.

  • Delegate Permissions Carefully:

    • Delegate administrative tasks to users on a need-to-know basis.
    • Avoid unnecessary delegation of administrative privileges.

2. Group Policy and Security Settings​

  • Disable Inheritance on Sensitive Organizational Units (OUs):

    • Prevent unauthorized users from inheriting permissions from higher-level OUs.

  • Audit Group Membership Changes:

    • Enable auditing for Group Membership Changes and Logon/Logoff events.

  • Enforce Kerberos Policies:

    • Use strong Kerberos encryption types (AES 256-bit) and ensure Kerberos ticket lifetime is set correctly.

  • Protect Domain Controllers (DC):

    • Ensure physical security and network segmentation for Domain Controllers.
    • Restrict DC access to only those who need it.

  • Set User Rights Assignment Security:

    • Use Group Policy to control user rights assignments and limit who can log on as a service, batch, or interactively.

  • Disable SMBv1:

    • Disable the insecure SMBv1 protocol across the AD network.

3. Domain Controller and AD Security​

  • Domain Controller Security:

    • Ensure DCs are running the latest security updates and patches.
    • Enable Advanced Audit Policy on Domain Controllers to monitor access events.

  • Audit Domain Admin Activity:

    • Implement logging for all Domain Admin activity, and ensure Windows Event Forwarding (WEF) is set up for centralized logging.

  • Use the KDC (Key Distribution Center) for Security:

    • Ensure the Kerberos Key Distribution Center (KDC) is only accessible to authorized users.

  • Enforce Kerberos Constrained Delegation:

    • Limit delegation to only specific services to prevent abuse of authentication tokens.

  • Use Read-Only Domain Controllers (RODC):

    • Deploy RODCs in remote offices to mitigate the risk of AD compromise.

4. Active Directory Trust and DNS Security​

  • Trust Configuration:

    • Review domain trusts and remove unnecessary or old trusts to reduce the attack surface.

  • Restrict DNS Zone Transfers:

    • Ensure DNS zone transfers are restricted to authorized servers only.
    • Use secure DNS dynamic updates to limit who can update DNS records.

  • Protect Service Principal Names (SPNs):

    • Secure Service Principal Names (SPNs) to avoid misuse in attacks like Kerberoasting.
    • Regularly audit SPNs using PowerShell commands like Get-ADObject -Filter 'ServicePrincipalName -like "*"'.

5. Secure Kerberos Authentication​

  • Configure Strong Kerberos Encryption:

    • Ensure Kerberos encryption types are configured to use strong ciphers such as AES-256 instead of RC4.
    • Disable weak ciphers and hash algorithms.

  • Regularly Rotate Service Account Passwords:

    • Rotate passwords for service accounts regularly to prevent Kerberoasting attacks.

  • Implement Time Synchronization:

    • Ensure NTP (Network Time Protocol) is configured for all DCs and clients to avoid Kerberos ticket issues caused by time discrepancies.

  • Monitor for Kerberos Ticket Abuse:

    • Implement monitoring for Kerberoasting (attacks against SPNs).
    • Use security information and event management (SIEM) solutions to detect unusual behavior.

6. AD Administrative Actions​

  • Limit Use of Domain Admins:

    • Avoid using Domain Admin credentials for regular administrative tasks. Use Tiered Admin Model.
    • Employ Just-in-Time (JIT) administration to limit the time an admin has elevated access.

  • Use Privileged Access Management (PAM) for Admin Accounts:

    • Control and monitor privileged access using tools like Microsoft PAM to reduce the risk of privilege escalation.

7. Security Hardening for Specific AD Roles​

  • Protect Administrative Groups:

    • Restrict membership and access to administrative groups like Enterprise Admins and Domain Admins.

  • Secure Domain Controllers with Virtualization:

    • Ensure Domain Controllers are virtualized in a secure environment with adequate isolation.

  • Use Active Directory Federation Services (ADFS) Securely:

    • Secure ADFS endpoints using strong TLS/SSL certificates.
    • Limit ADFS exposure to only required applications.

8. Backup and Recovery Plan​

  • Backup AD Data Regularly:

    • Implement a reliable AD backup strategy to ensure you can recover from a compromise.
    • Store backups in a secure location, ideally offline, to prevent tampering.

  • Test AD Recovery Procedures:

    • Periodically test your Active Directory disaster recovery plans to ensure your AD environment can be restored in case of a breach.

9. Monitoring and Logging​

  • Enable Active Directory Auditing:
    • Use Advanced Audit Policy settings to track changes to AD objects, group memberships, and authentication events.
  • Monitor Domain Controllers for Anomalies:
    • Implement SIEM tools for real-time monitoring of DCs and AD events, such as failed login attempts, privilege escalations, and unauthorized group memberships.

10. Regularly Review Security​

  • Periodic Security Reviews:

    • Regularly review your Active Directory security posture, including user/group permissions and trust configurations.

  • Conduct Penetration Testing:

    • Regularly test the AD environment for vulnerabilities, misconfigurations, and potential attack vectors.

Active Directory Hardening Tools​

ToolPurposeCommand/Usage
Microsoft AD Security GuideProvides a comprehensive guide to securing Active Directory.Review: Microsoft AD Security Guide
ADAudit PlusMonitors and audits Active Directory activity, including changes.Use for monitoring group membership changes, logon events, and user activity.
BloodHoundHelps identify attack paths in Active Directory through permission and group analysis.BloodHound queries to analyze attack paths and attack surface in AD.
PowerSploitPowerShell scripts for offensive and defensive AD security.Invoke-Command -ScriptBlock {Get-NetUser -Domain <domain>} for AD enumeration.
NessusVulnerability scanner with AD hardening checks.Run AD security audits and vulnerability assessments for potential misconfigurations.
Netwrix AuditorTracks Active Directory changes and user activity for compliance auditing.Monitor and generate reports on AD changes (e.g., user modifications, privilege changes).
BloodHoundMaps attack paths in Active Directory to identify privilege escalation opportunities.Identifies vulnerabilities such as unprotected admins or misconfigured trusts.
NetcatUtility for investigating and exploiting network services.Used to test connectivity and interaction with AD ports/services.
PowerViewPowerShell toolkit for network situational awareness and AD enumeration.Get-NetUser to gather users or Get-NetGroup to gather groups.
Get-ADUser (PowerShell)Retrieves user account information from Active Directory.Get-ADUser -Filter * to list all AD users or Get-ADUser <username> for specific users.
PingCastleSecurity assessment tool for Active Directory with detailed reports.Run PingCastle.exe --healthcheck for a quick health check of your AD environment.
KerberosForceTool to brute-force weak Kerberos tickets to assess encryption strength.Use for testing for weak or vulnerable Kerberos configurations in your domain.
CIS-CAT ProSecurity assessment tool to automate AD security best practices checks.CIS benchmark scans help identify insecure configurations within AD.
ADACL ScannerA tool for auditing Active Directory Access Control Lists (ACLs).Helps in identifying overly permissive AD ACLs and potential misconfigurations.
NetDomCommand-line tool for managing Active Directory domains and trusts.netdom query fsmo to identify FSMO roles and ensure proper placement.
LAPS (Local Administrator Password Solution)Helps secure local administrator accounts with unique passwords for each machine.Automates password management for local admin accounts across all domain-joined machines.
Active Directory Replication Status Tool (ADREPLSTATUS)Monitors replication status and ensures AD replication health.Check for replication issues and ensure no vulnerabilities or delays in replication.
MimikatzTool for credential extraction and attack testing in AD environments.Can be used for testing credential theft, password hashes, and Kerberos ticket vulnerabilities.
SecEventEvent log management tool to monitor AD events and audit logs for suspicious activities.Monitor AD logs for events such as user creation, elevation of privileges, and more.
ADACL (Access Control List)Scans and analyzes Active Directory ACLs for overly permissive or incorrect configurations.Review AD object permissions and detect misconfigurations or excessive access rights.

Tools for Hardening:​

  • Security Compliance Toolkit (SCT) – Provides scripts and templates to help with the configuration and auditing of Windows security settings.
  • Group Policy Object (GPO) Backup – Backup and restore your GPOs to ensure security configurations can be restored if needed.
  • Windows Defender ATP – Provides security monitoring, auditing, and response automation for Active Directory.

Tools for Monitoring:​

  • Sysmon (System Monitor) – Part of Sysinternals Suite, helps monitor system activity in real-time, especially useful in detecting malicious activity targeting AD.
  • EventSentry – Monitors system events, including Active Directory logs for signs of compromise or misconfiguration.
  • Windows Event Forwarding (WEF) – Helps aggregate event logs from Domain Controllers and other AD-related services to a central server.

Security Auditing Tools:​

  • NSS Labs – Provides an automated analysis of Windows Server Active Directory security configurations.
  • Qualys – Helps run vulnerability assessments to check for weaknesses within Active Directory and associated systems.
  • PowerShell DSC (Desired State Configuration) – Used for enforcing consistent security settings across AD infrastructure.

These tools, when used appropriately, can significantly improve the security of your Active Directory environment. Let me know if you need further explanations or details on how to use any of these tools.