Securing Active Directory
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit afc973d · +12 −0 lines · also on GitHub
⋯ 31 unchanged lines
3232
The most common vulnerabilities are:
3333
3434
- Gaps in antivirus and antimalware deployments
35
+
3536
- Incomplete patching
37
+
3638
- Outdated applications and operating systems
39
+
3740
- Misconfiguration
41
+
3842
- Lack of secure application development practices
3943
4044
### Credential theft
⋯ 43 unchanged lines
8488
- Check the following areas of your infrastructure to make sure you aren't granting excessive privileges to user accounts:
8589
8690
- Active Directory
91
+
8792
- Member servers
93
+
8894
- Workstations
95
+
8996
- Applications
97
+
9098
- Data repositories
9199
92100
For more information, see [Implementing least-privilege administrative models](Implementing-Least-Privilege-Administrative-Models.md).
⋯ 5 unchanged lines
98106
When configuring a secure administrative host, you must follow these general principles:
99107
100108
- Never administer a trusted system from a less-trusted host.
109
+
101110
- Require multifactor authentication when using privileged accounts or doing administrative tasks.
111
+
102112
- Physical security for your administrative hosts is as important as system and network security.
103113
104114
For more information, see [Implementing secure administrative hosts](Implementing-Secure-Administrative-Hosts.md).
⋯ 3 unchanged lines
108118
If an attacker gains privileged access to a domain controller, they can modify, corrupt, and destroy the AD database. An attack on the domain controller potentially threatens all AD-managed systems and accounts within your organization. Therefore, it's important you take the following measures to keep your domain controllers safe:
109119
110120
- Keep your domain controllers physically secure within their datacenters, branch offices, and remote locations.
121
+
111122
- Become familiar with your domain controller operating system.
123
+
112124
- Configure your domain controllers with built-in and freely available configuration tools to make security configuration baselines you can enforce with group policy objects (GPOs).
113125
114126
For more information, see [Securing domain controllers against attack](Securing-Domain-Controllers-Against-Attack.md).
⋯ 77 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.