Securing Active Directory
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit fcc559a · +2 −2 lines · also on GitHub
⋯ 78 unchanged lines
7979
8080
- Remember there are three built-in groups that have the highest privileges in Active Directory by default: Enterprise Admins, Domain Admins, and Administrators. Make sure you take steps to protect those three groups, along with any other groups your organization gave elevated privileges to.
8181
82
−- Implement a least-privilege administrative model. Don't use highly privileged accounts for everyday administrative tasks if you can avoid it. Also, make sure your admin accounts only have the baseline privileges required to do their jobs, with no extra privileges they may not need. Avoid giving excessive privileges to user accounts that don't need them. Make sure you don't accidentally give an account the same privileges across systems unless they absolutely need them.
82
+- Implement a least-privilege administrative model. Don't use highly privileged accounts for everyday administrative tasks if you can avoid it. Also, make sure your admin accounts only have the baseline privileges required to do their jobs, with no extra privileges they don't need. Avoid giving excessive privileges to user accounts that don't need them. Make sure you don't accidentally give an account the same privileges across systems unless they absolutely need them.
8383
8484
- Check the following areas of your infrastructure to make sure you aren't granting excessive privileges to user accounts:
8585
⋯ 12 unchanged lines
9898
When configuring a secure administrative host, you must follow these general principles:
9999
100100
- Never administer a trusted system from a less-trusted host.
101
−- Require multi-factor authentication when using privileged accounts or doing administrative tasks.
101
+- Require multifactor authentication when using privileged accounts or doing administrative tasks.
102102
- Physical security for your administrative hosts is as important as system and network security.
103103
104104
For more information, see [Implementing secure administrative hosts](Implementing-Secure-Administrative-Hosts.md).
⋯ 87 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.