Hardening Active Directory: Defensive Measures

A good tester is only useful if the client can fix what you found. So far you looked at Active Directory like an attacker. Now you will wear the administrator's hat and learn the measures that remove most of the paths we discussed. This is also what impresses recruiters: someone who can both find a weakness and explain how to close it.

Start with the biggest idea: tiering

Most directory compromises follow a pattern: an attacker gets a foothold on an ordinary workstation, then moves toward more powerful accounts, usually by collecting credentials left behind on machines where administrators had signed in. The defensive answer is administrative tiering, a separation of privilege levels:

• Tier 0: the identity infrastructure itself, such as domain controllers and the most powerful groups. Accounts here must never sign in anywhere else.
• Tier 1: servers and business applications.
• Tier 2: user workstations and standard devices.

The rule is simple: a higher tier account never signs in to a lower tier machine. A domain administrator who reads email on a workstation leaves credentials on a machine that is far easier to compromise. A hospital analogy helps: the head surgeon never uses the waiting room's shared computer to open patient files.

Putting this into practice usually means separate administrative accounts (an ordinary account for daily work, a different account for administration), dedicated administration workstations and clear rules enforced by policy.

Reduce privileged membership

• Keep the most powerful groups nearly empty. Check them monthly.
• Use just-in-time or time-limited elevation where possible, so that rights exist only during the task.
• Remove old accounts and unused groups. A leaver should lose access the same day.
• Review who can modify groups and policies. Control over an object often matters as much as membership.
• Place sensitive accounts in a protected group that reduces exposure to weaker authentication and credential caching, available in current Windows domains.

Passwords: local administrators and service accounts

A classic weakness is the same local administrator password on every computer. If one machine falls, the attacker can walk into all the others. The remedy is a tool that sets a unique, random local administrator password per machine and rotates it automatically; Windows includes such a feature in recent versions (often called LAPS).

For service accounts, use managed service accounts as discussed in lesson 1.3, or long random passwords stored in a proper password vault. Never put such passwords in a script or a shared spreadsheet.

Reduce old protocols

• NTLM: audit where it is still used, then restrict it step by step. Do not disable it everywhere on a Monday morning; an old application will break. Measure first.
• Signing: require signing for directory and file-sharing traffic so that messages cannot be silently altered or relayed.
• Legacy encryption types: phase out weak ones where applications allow.
• Unneeded services: domain controllers should do one job. Do not install extra roles or software on them.

Protect the domain controllers

• Patch them quickly and test updates on a small group first.
• Limit who can sign in locally or remotely.
• Isolate them on a protected network segment with strict firewall rules.
• Keep tested, offline, recent backups of the directory. If everything is lost, a backup that you have actually restored once is worth more than a thick policy document.
• Plan the recovery procedure ahead, including how to reset the most sensitive internal secrets after a serious compromise.

Review delegation and permissions

Go back to the permissions we saw in lesson 1.1 and 1.2. List computers and accounts that are trusted for delegation, remove unrestricted delegation where possible and prefer constrained forms. Review who has write permissions on groups and users, especially for broad groups like "Helpdesk" that often carry too much power. Use the same graph tools that attackers use, but with permission and as a regular check, to confirm that no short path leads to privileged groups.

See what is happening: logging and monitoring

Hardening without visibility is blind. Make sure these are logged and sent to a central place:

• Sign-in events, including failures and unusual times.
• Changes to privileged groups.
• Service ticket and other Kerberos events.
• Creation or modification of accounts, policies and trusts.

Alerts on a handful of high-value events, such as "a user was added to a very powerful group", provide excellent value for little effort. You will design such rules in chapter 4.

Prioritize, because you cannot do everything at once

When you present recommendations, use a simple method: impact (how bad if it happens), effort (how costly to fix) and urgency (is it being exploited now?). Quick wins with high impact, such as unique local administrator passwords or emptying privileged groups, go first. Long projects, like full tiering, are planned in phases. The NIST Cybersecurity Framework (nist.gov) and the ANSSI guidance on directory security (cyber.gouv.fr) are good references for structuring such a plan.

Your turn: build a hardening checklist

You are asked to prepare a one-page checklist for the administrator of a small company with one domain, two domain controllers, 150 workstations and a handful of service accounts. Choose the eight most valuable actions from this lesson and order them in a priority list with one line of justification each.

See a solution

One reasonable answer (yours may differ, as long as you justify it):

1. Empty and review the most privileged groups: smallest quick win with the largest impact.
2. Separate administrative and daily accounts: removes the most common route to credential theft.
3. Unique local administrator passwords on all workstations: prevents spread from one machine to others.
4. Replace service account passwords with managed accounts or long random secrets.
5. Patch and isolate domain controllers.
6. Centralize logs and alert on changes to privileged groups.
7. Audit NTLM use and require signing step by step.
8. Test a full directory restore from backup.

The justification for each item should mention a risk from this chapter (graph paths, Kerberoasting, credential reuse).

Portfolio step

Turn your solution into ad-hardening-checklist.md in the 01-active-directory folder: a one-page, well formatted checklist with priority, effort and the risk each action reduces. This will be the first of three "defender-friendly" artifacts in your portfolio.

You have closed the Active Directory chapter. Next, you will learn Python, the language that lets you automate your own work.