Active Directory permission hardening

1. Audit / monitoror later 9 Nov 2021 Published timing is qualified; effectiveness is not confirmed.
2. Audit / monitor15 Dec 2023 Published timing is qualified; effectiveness is not confirmed.

1. 9 Nov 2021 4 years agoor laterAudit / monitor · unconfirmed
   • Take ActionMilestone
   • November 9, 2021: Initial deployment phaseMilestone
2. 15 Dec 2023 2 years agoAudit / monitor · unconfirmed
   • (Updated 12/15/2023) Final deployment phaseMilestone1 condition

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• Audit-By-Default
• DS-Heuristics
• Read-Only

Requirements, exceptions and scope

• SummaryRequirement1 passage
  CVE-2021-42291

  CVE-2021-42291 addresses a security bypass vulnerability that allows certain users to set arbitrary values on security-sensitive attributes of specific objects stored in Active Directory (AD)…

• Timing of Windows updatesScope1 passage
  Audit-By-Default
• Setting Configuration InformationException1 passage
  CVE-2021-42291DS-Heuristics
• Character 28 – Additional AuthZ verifications for LDAP Add operationsRequirementRecommendation2 conditions3 passages
• Character 29 – Temporary removal of Implicit Owner for LDAP Modify operationsRequirementExceptionScopeRecommendation4 conditions5 passages
• Mode Change Events – Additional AuthZ verification for LDAP Add operationsRequirementExceptionRecommendation1 condition1 passage
• Mode Change Events – temporary removal of Implicit Owner rightsRequirementExceptionRecommendation2 conditions1 passage
• Audit mode eventsException1 condition1 passage
• Enforcement Mode - LDAP Modify failuresScope1 passage
• Frequently asked questionsRequirementExceptionScopeRecommendation2 conditions4 passages
  Read-Only

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.