Securing Active Directory

This page's changes and edits · All guidance changes

Microsoft's edit · 20 Sep 2023 22:21 UTC

Acrolinx cleanup.

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit e5c1755 · +7 −7 lines · also on GitHub

⋯ 16 unchanged lines

1717

1818 Attacks against computing infrastructure have increased over the last decade in all parts of the world. We live in an age of cyber-warfare, cybercrime, and hacktivism. As a result, organizations of all sizes all over the world have had to deal with information leaks, theft of intellectual property (IP), denial-of-service (DDoS) attacks, or even destroyed infrastructure.

1919

20 −However, as the threat landscape has changed over the years, the security landscape has also adapted to counter these threats. While no organization with an information technology (IT) infrastructure is ever perfectly immune to attack, the ultimate goal of security isn't preventing attack attempts altogether, but protecting the IT infrastructure from being compromised by attacks. With the right policies, processes, and controls, you can protect key parts of your IT infrastructure from compromise.

20 +However, as the threat landscape has changed over the years, the security landscape has also adapted to counter these threats. While no organization with an information technology (IT) infrastructure is ever perfectly immune to attack, the ultimate goal of security isn't preventing attack attempts altogether, but protecting the IT infrastructure from attacks. With the right policies, processes, and controls, you can protect key parts of your IT infrastructure from compromise.

2121

22 −In this article, we describe the most common types of vulnerabilities we've observed in Active Directory (AD) deployments. Next, we arm you with recommendations for how to protect these weak points from compromises. We designed these recommendations based on the expertise of our Microsoft IT (MSIT) and Microsoft Information Security and Risk Managment (ISRM) organizations. We also show you steps you can take to reduce how much vulnerable infrastructure, or attack surface, on your AD is exposed to the outside world. In the event of total system compromise, we also include suggestions for how to recover vital data and infrastructure function.

22 +In this article, we describe the most common types of vulnerabilities we've observed in Active Directory (AD) deployments. Next, we arm you with recommendations for how to protect these weak points from compromises. We designed these recommendations based on the expertise of our Microsoft IT (MSIT) and Microsoft Information Security and Risk Management (ISRM) organizations. We also show you steps you can take to reduce how much vulnerable infrastructure, or attack surface, on your AD is exposed to the outside world. We also include suggestions for how to recover vital data and infrastructure function if there's a security compromise.

2323

2424 ## Common security vulnerabilities

2525

⋯ 3 unchanged lines

2929

3030 ### Common entry points

3131

32 −Initial breach targets, or entry points, are areas where attackers can most easily enter your IT infrastructure. Entry points are usually gaps in security or updates that attackers can exploit to gain access to a system within your infrastructure. Attackers usually start with one or two systems at a time, then escalate their attack as they spread their influence across more and more systems undetected.

32 +Initial breach targets, or entry points, are areas where attackers can most easily enter your IT infrastructure. Entry points are usually gaps in security or updates that attackers can exploit to gain access to a system within your infrastructure. Attackers usually start with one or two systems at a time, then escalate their attack as they spread their influence across more systems undetected.

3333

3434 The most common vulnerabilities are:

3535

⋯ 43 unchanged lines

7979

8080 Credential theft attacks depend on the admins granting certain accounts excessive privileges. You can prevent these attacks is to do the following things:

8181

82 −- Remember there are three built-in groups that have the highest privileges in Active Directory by default: Enterprise Admins, Domain Admins, and Administrators. Make sure you take steps to protect those three groups as well as any other groups your organization gave elevated privileges to.

82 +- Remember there are three built-in groups that have the highest privileges in Active Directory by default: Enterprise Admins, Domain Admins, and Administrators. Make sure you take steps to protect those three groups, along with any other groups your organization gave elevated privileges to.

8383

8484 - Implement a least-privilege administrative model. Don't use highly privileged accounts for everyday administrative tasks if you can avoid it. Also, make sure your admin accounts only have the baseline privileges required to do their jobs, with no extra privileges they may not need. Avoid giving excessive privileges to user accounts that don't need them. Make sure you don't accidentally give an account the same privileges across systems unless they absolutely need them.

8585

⋯ 9 unchanged lines

9595

9696 ### Use secure administrative hosts

9797

98 −Secure administrative hosts are computers configured to support administration for Active Directories and other connected systems. These hosts don't run non-administrative software like email applications, web browsers, or productivity software like Microsoft Office.

98 +Secure administrative hosts are computers configured to support administration for Active Directories and other connected systems. These hosts don't run nonadministrative software like email applications, web browsers, or productivity software like Microsoft Office.

9999

100100 When configuring a secure administrative host, you must follow these general principles:

101101

102102 - Never administer a trusted system from a less-trusted host.

103103 - Only use multi-factor authentication when using privileged accounts or doing administrative tasks.

104 −- Physical security for your administrative hosts is just as important as system and network security.

104 +- Physical security for your administrative hosts is as important as system and network security.

105105

106106 For more information, see [Implementing secure administrative hosts](Implementing-Secure-Administrative-Hosts.md).

107107

⋯ 46 unchanged lines

154154 | Eliminate permanent membership in highly privileged groups. | Tactical | Preventative |

155155 | Implement controls to grant temporary membership in privileged groups when needed. | Tactical | Preventative |

156156 | Implement secure administrative hosts. | Tactical | Preventative |

157 −| Use application allowslists on domain controllers, administrative hosts, and other sensitive systems. | Tactical | Preventative |

157 +| Use application allowlists on domain controllers, administrative hosts, and other sensitive systems. | Tactical | Preventative |

158158 | Identify critical assets, and prioritize their security and monitoring. | Tactical | Both |

159159 | Implement least-privilege, role-based access controls for administration of the directory, its supporting infrastructure, and domain-joined systems. | Strategic | Preventative |

160160 | Isolate legacy systems and applications. | Tactical | Preventative |

⋯ 33 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.