Securing Active Directory

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Oct 2023 16:30 UTC

Apply suggestions from code review

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit f52cc6e · +7 −7 lines · also on GitHub

⋯ 24 unchanged lines

2525

2626 In order to learn how to best protect your infrastructure, you first need to understand where attacks are most likely to strike and how they work. This article only covers general recommendations, but if you want to go into more detail, we've included links to more thorough articles.

2727

28 −Now, let's look at the most common security vulnerabilities in the average AD deployment.

28 +Now, let's look at the most common security vulnerabilities.

2929

3030 ### Common entry points

3131

⋯ 9 unchanged lines

4141

4242 ### Credential theft

4343

44 −Credential theft attacks are when an attacker gains privileged access to a computer on a network by using tools to extract credentials from sessions of accounts that are currently signed in. Attackers often go for specific accounts that already have elevated privileges. The attacker steals the credentials of this account to mimic its identity, fooling the security system into letting them into the network.

44 +Credential theft attacks are when an attacker gains privileged access to a computer on a network by using tools to extract credentials from sessions of accounts that are currently signed in. Attackers often go for specific accounts that already have elevated privileges. The attacker steals the credentials of this account to mimic its identity to gain access to the system.

4545

4646 Credential thieves usually target these kinds of accounts:

4747

⋯ 13 unchanged lines

6161

6262 - Browsing the internet while signed in to a privileged account

6363

64 −You should also avoid engaging in the following risky behaviors at all costs to protect the credential security of your users:

64 +You should also avoid poor and risky configurations to protect the credential security of your system, such as:

6565

6666 - Configuring local privileged accounts with the same credentials across all systems.

6767

⋯ 5 unchanged lines

7373

7474 ## Reduce Active Directory attack surface

7575

76 −You can prevent attacks is by reducing the *attack surface* on your Active Directory. In other words, you make your deployment safer by closing up gaps in security that we mentioned in the previous section.

76 +You can prevent attacks by reducing the *attack surface* on your Active Directory deployment. In other words, you make your deployment safer by closing up gaps in security that we mentioned in the previous section.

7777

7878 ### Avoid granting excessive privileges

7979

80 −Credential theft attacks depend on the admins granting certain accounts excessive privileges. You can prevent these attacks is to do the following things:

80 +Credential theft attacks depend on admins granting certain accounts excessive privileges. You can prevent these attacks is to do the following things:

8181

8282 - Remember there are three built-in groups that have the highest privileges in Active Directory by default: Enterprise Admins, Domain Admins, and Administrators. Make sure you take steps to protect those three groups, along with any other groups your organization gave elevated privileges to.

8383

⋯ 16 unchanged lines

100100 When configuring a secure administrative host, you must follow these general principles:

101101

102102 - Never administer a trusted system from a less-trusted host.

103 −- Only use multi-factor authentication when using privileged accounts or doing administrative tasks.

103 +- Require multi-factor authentication when using privileged accounts or doing administrative tasks.

104104 - Physical security for your administrative hosts is as important as system and network security.

105105

106106 For more information, see [Implementing secure administrative hosts](Implementing-Secure-Administrative-Hosts.md).

⋯ 28 unchanged lines

135135

136136 - Classify all AD data as systems, applications, or users

137137

138 −Once again, to read about these practices in more detail, see [Maintaining a more secure environment](Maintaining-a-More-Secure-Environment.md).

138 +To continue reading more detail about these practices, see [Maintaining a more secure environment](Maintaining-a-More-Secure-Environment.md).

139139

140140 ## Security measure summary table

141141

⋯ 52 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.