Securing Active Directory
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 11af270 · +156 −25 lines · also on GitHub
⋯ 4 unchanged lines
55
author: iainfoulds
66
ms.author: daveba
77
manager: daveba
8
−ms.date: 05/31/2017
8
+ms.date: 09/21/2023
99
ms.topic: article
1010
---
1111
1212
# Best Practices for Securing Active Directory
1313
14
+<!--Note to self: this is the base document I'm consolidating everything into.-->
15
+
1416
>Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
1517
16
−This document provides a practitioner's perspective and contains a set of practical techniques to help IT executives protect an enterprise Active Directory environment. Active Directory plays a critical role in the IT infrastructure, and ensures the harmony and security of different network resources in a global, interconnected environment. The methods discussed are based largely on the Microsoft Information Security and Risk Management (ISRM) organization's experience, which is accountable for protecting the assets of Microsoft IT and other Microsoft Business Divisions, in addition to advising a selected number of Microsoft Global 500 customers.
18
+Attacks against computing infrastructure have increased over the last decade in all parts of the world. We live in an age of cyber-warfare, cybercrime, and hacktivism. As a result, organizations of all sizes all over the world have had to deal with information leaks, theft of intellectual property (IP), denial-of-service (DDoS) attacks, or even destroyed infrastructure.
1719
18
−- [Executive Summary](../../../ad-ds/manage/component-updates/Executive-Summary.md)
20
+However, as the threat landscape has changed over the years, the security landscape has also adapted to counter these threats. While no organization with an information technology (IT) infrastructure is ever perfectly immune to attack, the ultimate goal of security isn't preventing attack attempts altogether, but protecting the IT infrastructure from being compromised by attacks. With the right policies, processes, and controls, you can protect key parts of your IT infrastructure from compromise.
1921
20
−- [Introduction](../../../ad-ds/manage/component-updates/Introduction.md)
22
+In this article, we describe the most common types of vulnerabilities we've observed in Active Directory (AD) deployments. Next, we arm you with recommendations for how to protect these weak points from compromises. We designed these recommendations based on the expertise of our Microsoft IT (MSIT) and Microsoft Information Security and Risk Managment (ISRM) organizations. We also show you steps you can take to reduce how much vulnerable infrastructure, or attack surface, on your AD is exposed to the outside world. In the event of total system compromise, we also include suggestions for how to recover vital data and infrastructure function.
2123
22
−- [Avenues to Compromise](../../../ad-ds/plan/security-best-practices/Avenues-to-Compromise.md)
24
+## Common security vulnerabilities
2325
24
−- [Attractive Accounts for Credential Theft](../../../ad-ds/plan/security-best-practices/Attractive-Accounts-for-Credential-Theft.md)
26
+In order to learn how to best protect your infrastructure, you first need to understand where attacks are most likely to strike and how they work. This article only covers general recommendations, but if you want to go into more detail, we've included links to more thorough articles.
2527
26
−- [Reducing the Active Directory Attack Surface](../../../ad-ds/plan/security-best-practices/Reducing-the-Active-Directory-Attack-Surface.md)
28
+Now, let's look at the most common security vulnerabilities in the average AD deployment.
2729
28
−- [Implementing Least-Privilege Administrative Models](../../../ad-ds/plan/security-best-practices/Implementing-Least-Privilege-Administrative-Models.md)
30
+### Common entry points
2931
30
−- [Implementing Secure Administrative Hosts](../../../ad-ds/plan/security-best-practices/Implementing-Secure-Administrative-Hosts.md)
32
+Initial breach targets, or entry points, are areas where attackers can most easily enter your IT infrastructure. Entry points are usually gaps in security or updates that attackers can exploit to gain access to a system within your infrastructure. Attackers usually start with one or two systems at a time, then escalate their attack as they spread their influence across more and more systems undetected.
3133
32
−- [Securing Domain Controllers Against Attack](../../../ad-ds/plan/security-best-practices/Securing-Domain-Controllers-Against-Attack.md)
34
+The most common vulnerabilities are:
3335
34
−- [Monitoring Active Directory for Signs of Compromise](../../../ad-ds/plan/security-best-practices/Monitoring-Active-Directory-for-Signs-of-Compromise.md)
36
+- Gaps in antivirus and antimalware deployments
37
+- Incomplete patching
38
+- Outdated applications and operating systems
39
+- Misconfiguration
40
+- Lack of secure application development practices
3541
36
−- [Audit Policy Recommendations](../../../ad-ds/plan/security-best-practices/Audit-Policy-Recommendations.md)
42
+### Credential theft
3743
38
−- [Planning for Compromise](../../../ad-ds/plan/security-best-practices/Planning-for-Compromise.md)
44
+Credential theft attacks are when an attacker gains privileged access to a computer on a network by using tools to extract credentials from sessions of accounts that are currently signed in. Attackers often go for specific accounts that already have elevated privileges. The attacker steals the credentials of this account to mimic its identity, fooling the security system into letting them into the network.
3945
40
−- [Maintaining a More Secure Environment](../../../ad-ds/plan/security-best-practices/Maintaining-a-More-Secure-Environment.md)
46
+Credential thieves usually target these kinds of accounts:
4147
42
−- [Appendices](../../../ad-ds/plan/security-best-practices/Appendices.md)
48
+- Permanently privileged accounts
4349
44
−- [Appendix B: Privileged Accounts and Groups in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-B--Privileged-Accounts-and-Groups-in-Active-Directory.md)
50
+- VIP accounts
4551
46
−- [Appendix C: Protected Accounts and Groups in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-C--Protected-Accounts-and-Groups-in-Active-Directory.md)
52
+- Privilege-attached Active Directory accounts
4753
48
−- [Appendix D: Securing Built-In Administrator Accounts in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-D--Securing-Built-In-Administrator-Accounts-in-Active-Directory.md)
54
+- Domain controllers
4955
50
−- [Appendix E: Securing Enterprise Admins Groups in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-E--Securing-Enterprise-Admins-Groups-in-Active-Directory.md)
56
+- Other infrastructure services that affect identity, access, and configuration management, such as public key infrastructure (PKI) servers or systems management servers
5157
52
−- [Appendix F: Securing Domain Admins Groups in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-F--Securing-Domain-Admins-Groups-in-Active-Directory.md)
58
+Users with highly privileged accounts raise the risk of having their credentials stolen by engaging in the following behaviors:
5359
54
−- [Appendix G: Securing Administrators Groups in Active Directory](../../../ad-ds/plan/security-best-practices/Appendix-G--Securing-Administrators-Groups-in-Active-Directory.md)
60
+- Signing into their privileged accounts on unsecured computers
5561
56
−- [Appendix H: Securing Local Administrator Accounts and Groups](../../../ad-ds/plan/security-best-practices/Appendix-H--Securing-Local-Administrator-Accounts-and-Groups.md)
62
+- Browsing the internet while signed in to a privileged account
5763
58
−- [Appendix I: Creating Management Accounts for Protected Accounts and Groups in Active Directory](../../../ad-ds/manage/component-updates/Appendix-I--Creating-Management-Accounts-for-Protected-Accounts-and-Groups-in-Active-Directory.md)
64
+You should also avoid engaging in the following risky behaviors at all costs to protect the credential security of your users:
5965
60
−- [Appendix L: Events to Monitor](../../../ad-ds/plan/Appendix-L--Events-to-Monitor.md)
66
+- Configuring local privileged accounts with the same credentials across all systems.
6167
62
−- [Appendix M: Document Links and Recommended Reading](../../../ad-ds/manage/Appendix-M--Document-Links-and-Recommended-Reading.md)
68
+- Assigning too many users to privileged domain groups, encouraging overuse.
69
+
70
+- Insufficiently managing domain controller security.
71
+
72
+For more information about vulnerable accounts, see [Attractive accounts for credential theft](Attractive-Accounts-for-Credential-Theft.md).
73
+
74
+## Reduce Active Directory attack surface
75
+
76
+You can prevent attacks is by reducing the *attack surface* on your Active Directory. In other words, you make your deployment safer by closing up gaps in security that we mentioned in the previous section.
77
+
78
+### Avoid granting excessive privileges
79
+
80
+Credential theft attacks depend on the admins granting certain accounts excessive privileges. You can prevent these attacks is to do the following things:
81
+
82
+- Remember there are three built-in groups that have the highest privileges in Active Directory by default: Enterprise Admins, Domain Admins, and Administrators. Make sure you take steps to protect those three groups as well as any other groups your organization gave elevated privileges to.
83
+
84
+- Implement a least-privilege administrative model. Don't use highly privileged accounts for everyday administrative tasks if you can avoid it. Also, make sure your admin accounts only have the baseline privileges required to do their jobs, with no extra privileges they may not need. Avoid giving excessive privileges to user accounts that don't need them. Make sure you don't accidentally give an account the same privileges across systems unless they absolutely need them.
85
+
86
+- Check the following areas of your infrastructure to make sure you aren't granting excessive privileges to user accounts:
87
+
88
+ - Active Directory
89
+ - Member servers
90
+ - Workstations
91
+ - Applications
92
+ - Data repositories
93
+
94
+For more information, see [Implementing least-privilege administrative models](Implementing-Least-Privilege-Administrative-Models.md).
95
+
96
+### Use secure administrative hosts
97
+
98
+Secure administrative hosts are computers configured to support administration for Active Directories and other connected systems. These hosts don't run non-administrative software like email applications, web browsers, or productivity software like Microsoft Office.
99
+
100
+When configuring a secure administrative host, you must follow these general principles:
101
+
102
+- Never administer a trusted system from a less-trusted host.
103
+- Only use multi-factor authentication when using privileged accounts or doing administrative tasks.
104
+- Physical security for your administrative hosts is just as important as system and network security.
105
+
106
+For more information, see [Implementing secure administrative hosts](Implementing-Secure-Administrative-Hosts.md).
107
+
108
+### Keep your domain controllers secure
109
+
110
+If an attacker gains privileged access to a domain controller, they can modify, corrupt, and destroy the AD database. An attack on the domain controller potentially threatens all AD-managed systems and accounts within your organization. Therefore, it's important you take the following measures to keep your domain controllers safe:
111
+
112
+- Keep your domain controllers physically secure within their datacenters, branch offices, and remote locations.
113
+- Become familiar with your domain controller operating system.
114
+- Configure your domain controllers with built-in and freely available configuration tools to make security configuration baselines you can enforce with group policy objects (GPOs).
115
+
116
+For more information, see [Securing domain controllers against attack](Securing-Domain-Controllers-Against-Attack.md).
117
+
118
+## Monitor Active Directory for signs of attack or compromise
119
+
120
+Another way you can keep your AD deployment secure is to monitor it for signs of malicious attacks or security compromises. You can use legacy audit categories and audit policy subcategories, or use Advanced Audit Policy. For more information, see [Audit Policy Recommendations](Audit-Policy-Recommendations.md).
121
+
122
+## Plan for security compromises
123
+
124
+While you can protect your AD from outside attacks, no defense is ever truly perfect. It's important that in addition to taking preventative measures that you also plan for worst-case scenarios. When planning for security breaches, you should follow the guidelines in [Planning for compromise](Planning-for-Compromise.md), particularly the section [Rethinking the approach](Planning-for-Compromise.md#rethinking-the-approach), You should also read [Maintaining a more secure environment](Maintaining-a-More-Secure-Environment.md).
125
+
126
+Here's a brief summary of things you should do when planning for security compromises, as described in more detail in [Maintaining a more secure environment](Maintaining-a-More-Secure-Environment.md):
127
+
128
+- Maintain a more secure environment
129
+
130
+- Create business-centric security practices for AD
131
+
132
+- Assign business ownership to AD data
133
+
134
+- Implement business-driven lifecycle management
135
+
136
+- Classify all AD data as systems, applications, or users
137
+
138
+Once again, to read about these practices in more detail, see [Maintaining a more secure environment](Maintaining-a-More-Secure-Environment.md).
139
+
140
+## Security measure summary table
141
+
142
+The following table summarizes the recommendations listed in this article, listed in order of priority. The ones closer to the bottom of the table are the ones you and your organization should prioritize when setting up your Active Directory. However, you're also free to adjust the priority order and how you implement each measure based on your organization's unique needs.
143
+
144
+Each measure is also categorized based on whether it's tactical, strategic, preventative, or detective. *Tactical* measures focus on specific components of AD and any related infrastructure. *Strategic* measures are more comprehensive and therefore require more planning to implement. *Preventative* measures prevent attacks from bad actors. *Detective* measures help you detect security breaches as they happen, before they can spread to other systems.
145
+
146
+| Security measure | Tactical or Strategic | Preventative or Detective |
147
+|--|--|--|
148
+| Patch applications. | Tactical | Preventative |
149
+| Patch operating systems. | Tactical | Preventative |
150
+| Deploy and promptly update antivirus and antimalware software across all systems and monitor for attempts to remove or disable it. | Tactical | Both |
151
+| Monitor sensitive Active Directory objects for modification attempts and Windows for events that may indicate attempted compromise. | Tactical | Detective |
152
+| Protect and monitor accounts for users who have access to sensitive data | Tactical | Both |
153
+| Prevent powerful accounts from being used on unauthorized systems. | Tactical | Preventative |
154
+| Eliminate permanent membership in highly privileged groups. | Tactical | Preventative |
155
+| Implement controls to grant temporary membership in privileged groups when needed. | Tactical | Preventative |
156
+| Implement secure administrative hosts. | Tactical | Preventative |
157
+| Use application allowslists on domain controllers, administrative hosts, and other sensitive systems. | Tactical | Preventative |
158
+| Identify critical assets, and prioritize their security and monitoring. | Tactical | Both |
159
+| Implement least-privilege, role-based access controls for administration of the directory, its supporting infrastructure, and domain-joined systems. | Strategic | Preventative |
160
+| Isolate legacy systems and applications. | Tactical | Preventative |
161
+| Decommission legacy systems and applications. | Strategic | Preventative |
162
+| Implement secure development lifecycle programs for custom applications. | Strategic | Preventative |
163
+| Implement configuration management, review compliance regularly, and evaluate settings with each new hardware or software version. | Strategic | Preventative |
164
+| Migrate critical assets to pristine forests with stringent security and monitoring requirements. | Strategic | Both |
165
+| Simplify security for end users. | Strategic | Preventative |
166
+| Use host-based firewalls to control and secure communications. | Tactical | Preventative |
167
+| Patch devices. | Tactical | Preventative |
168
+| Implement business-centric lifecycle management for IT assets. | Strategic | N/A |
169
+| Create or update incident recovery plans. | Strategic | N/A |
170
+
171
+## Related content
172
+
173
+- [Avenues to Compromise](../../../ad-ds/plan/security-best-practices/Avenues-to-Compromise.md)
174
+
175
+- [Attractive Accounts for Credential Theft](../../../ad-ds/plan/security-best-practices/Attractive-Accounts-for-Credential-Theft.md)
176
+
177
+- [Reducing the Active Directory Attack Surface](../../../ad-ds/plan/security-best-practices/Reducing-the-Active-Directory-Attack-Surface.md)
178
+
179
+- [Implementing Least-Privilege Administrative Models](../../../ad-ds/plan/security-best-practices/Implementing-Least-Privilege-Administrative-Models.md)
180
+
181
+- [Implementing Secure Administrative Hosts](../../../ad-ds/plan/security-best-practices/Implementing-Secure-Administrative-Hosts.md)
182
+
183
+- [Securing Domain Controllers Against Attack](../../../ad-ds/plan/security-best-practices/Securing-Domain-Controllers-Against-Attack.md)
184
+
185
+- [Monitoring Active Directory for Signs of Compromise](../../../ad-ds/plan/security-best-practices/Monitoring-Active-Directory-for-Signs-of-Compromise.md)
186
+
187
+- [Audit Policy Recommendations](../../../ad-ds/plan/security-best-practices/Audit-Policy-Recommendations.md)
188
+
189
+- [Planning for Compromise](../../../ad-ds/plan/security-best-practices/Planning-for-Compromise.md)
190
+
191
+- [Maintaining a More Secure Environment](../../../ad-ds/plan/security-best-practices/Maintaining-a-More-Secure-Environment.md)
192
+
193
+- [Appendices](../../../ad-ds/plan/security-best-practices/Appendices.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.