Overview of services and procedures that are part of Active Directory Hardening

• 1. Audit and assessment of the current state of AD

  • Security analysis: Identification of current vulnerabilities, weaknesses and deficiencies in Active Directory configurations
  • Authorization control: Overview of the current authorizations of users, groups and administrators
  • Evaluation of group policy settings (Group Policy Settings): Checking the current settings, whether they comply with security recommendations

• 2. Strengthening access rights and authorizations

  • Reduction of administrators' authorizations: Ensuring the principle of minimum authorizations (least privilege), where users have only the authorizations they absolutely need
  • Segmentation of administrative accounts: Separation of accounts for common use and accounts for administrative purposes (e.g. use of 'privileged access management' tools)
  • Elevated account review and management: Ensuring that elevated accounts have adequate security measures such as two-factor authentication (2FA)

• 3. Implementation of security policies

  • Hardening Group Policy Objects (GPO): Setting security policies that minimize the risk of misuse (eg limiting user access, auditing system changes)
  • Password security: Enforcing strong password policies and deploying a password policy that requires minimal length, complexity, and regular password changes
  • Implementation of LAPS (Local Administrator Password Solution): Automatic generation of unique and regularly changing passwords for local administrator accounts on computers
  • AD Tiering

• 4. Improving authentication and login

  • Multi-factor authentication (MFA): Implementation of MFA for all users and especially for accounts with high privileges
  • Kerberos hardening: Strengthening authentication settings using the Kerberos protocol to reduce the risk of abuse of sessions or tickets (eg Golden Ticket attacks)
  • NTLM (NT LAN Manager) security: Reduce or eliminate the use of dangerous protocols such as NTLM that are vulnerable to attack

• 5. Monitoring and detection of threats

  • Access Auditing and Monitoring: Set up logging of accesses and changes in Active Directory, including access to sensitive accounts and systems
  • Integration with SIEM system: Real-time monitoring of AD events through SIEM tools to identify and respond to suspicious activities
  • Threat Detection and Incident Response: Setting up reaction plans in case of identification of suspicious behavior (e.g. detection of misuse of authorizations or access to sensitive data)

• 6. Securing backups and restoring AD

  • Secure AD backup: Regular and secure backup of Active Directory objects and configurations
  • Incident recovery plans: Ensuring processes for rapid AD recovery after an attack or failure, including preparation for password recovery and policy recovery

• 7. Protection against authorization escalation

  • Security of key groups: Protection of highly privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, including membership restrictions and auditing
  • Privileged Access Workstations (PAWs): Creation of dedicated workstations for managing critical systems that are separated from regular user devices

• 8. Limiting attacks on passwords and accounts

  • Security against Pass-the-Hash and Pass-the-Ticket attacks: Implementation of policies and technologies that reduce the risk of misuse of stolen credentials
  • Account Lockout Thresholds: Setting security measures for automatic blocking of accounts after multiple failed login attempts

• 9. Training and awareness raising

  • Admin Training: Educating IT staff on the latest security threats and how to properly manage and monitor AD
  • User Awareness: Raising user awareness of password security, phishing attacks, and AD security policies

• 10. Periodic evaluation and testing

  • Penetration testing and security audits: Regular testing of AD vulnerabilities through ethical hacking or security audits
  • Red Team exercises: Simulations of AD attacks that help identify weak points in security measures