Active Directory Security: Hardening Your Identity Infrastructure

Introduction to Active Directory Security

Active Directory (AD) is the cornerstone of identity management for most enterprises. It controls authentication, authorization, and access to virtually every resource. This makes it the primary target for attackers—compromise AD, and you own the entire organization.

Active Directory Attack Surface

Common Attack Vectors

1. Credential Theft

2. Privilege Escalation

3. Lateral Movement

4. Persistence

High-Value Targets

Tiered Administration Model

Implement administrative tiers to contain compromise.

Tier 0 - Domain/Forest Administration

Tier 1 - Server Administration

Tier 2 - Workstation Administration

Implementation Rules

Tier 0 admin → Can only log into Tier 0 systems
Tier 1 admin → Can only log into Tier 1 systems
Tier 2 admin → Can only log into Tier 2 systems

Privileged Access Workstations (PAW)

Dedicated, hardened workstations for privileged administration.

PAW Requirements

PAW Configuration

# Enable Credential Guard
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\LSA" -Name "LsaCfgFlags" -Value 1
# Enable Device Guard
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 1
# Block credential caching
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DisableDomainCreds" -Value 1

Domain Controller Hardening

Core Security Configurations

1. Patch Management

2. Reduce Attack Surface

3. Network Protection

4. Authentication Hardening

# Disable NTLM where possible
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" -Value 5
# Require SMB signing
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
# Disable anonymous enumeration
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymous" -Value 1

Event Logging

| Event ID | Description |

|----------|-------------|

| 4624 | Successful logon |

| 4625 | Failed logon |

| 4648 | Explicit credential logon |

| 4672 | Special privileges assigned |

| 4720 | User account created |

| 4732 | Member added to security group |

| 4740 | Account locked out |

| 4768 | Kerberos TGT requested |

| 4769 | Kerberos service ticket requested |

| 4771 | Kerberos pre-auth failed |

# Enable command line logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1
# Enable PowerShell Script Block Logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1

Kerberos Security

Kerberoasting Defense

# Create gMSA
New-ADServiceAccount -Name svc_app -DNSHostName svc_app.domain.com -PrincipalsAllowedToRetrieveManagedPassword AppServers
# Install on server
Install-ADServiceAccount svc_app

AS-REP Roasting Defense

# Find accounts without pre-auth
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth

Golden/Silver Ticket Defense

# Reset KRBTGT (do twice, wait replication between)
Reset-ADAccountPassword -Identity krbtgt -NewPassword (ConvertTo-SecureString "ComplexPassword123!" -AsPlainText -Force)
# Wait for replication
Start-Sleep -Seconds 86400  # 24 hours
# Reset again
Reset-ADAccountPassword -Identity krbtgt -NewPassword (ConvertTo-SecureString "DifferentPassword456!" -AsPlainText -Force)

Group Policy Security

GPO Hardening

Protected Users Group

Add sensitive accounts to Protected Users:

Add-ADGroupMember -Identity "Protected Users" -Members admin_user

LAPS Implementation

Local Administrator Password Solution prevents lateral movement.

LAPS Deployment

# Extend schema
Import-Module AdmPwd.PS
Update-AdmPwdADSchema

# Grant read permissions
Set-AdmPwdReadPasswordPermission -OrgUnit "OU=Workstations,DC=domain,DC=com" -AllowedPrincipals "IT_Admins"
# Grant reset permissions
Set-AdmPwdResetPasswordPermission -OrgUnit "OU=Workstations,DC=domain,DC=com" -AllowedPrincipals "IT_Admins"

Attack Detection

High-Fidelity Alerts

Honeypot Accounts

Create decoy accounts to detect attackers:

# Create honey user
New-ADUser -Name "svc_backup" -SamAccountName "svc_backup" -UserPrincipalName "[email protected]" -AccountPassword (ConvertTo-SecureString "HoneyPassword123!" -AsPlainText -Force) -Enabled $true
# Set SPN (for Kerberoasting detection)
Set-ADUser -Identity svc_backup -ServicePrincipalNames @{Add="MSSQLSvc/honeypot.domain.com:1433"}
# Set description to lure attackers
Set-ADUser -Identity svc_backup -Description "Backup service account - password: Summer2023!"

Alert on ANY activity on this account.

Assessment Checklist

Quick Wins

Intermediate

Advanced

Conclusion

Active Directory security is fundamental to enterprise security. A compromised AD means a compromised organization. Implement defense in depth through tiered administration, privileged access workstations, and comprehensive monitoring.

Asfaleia-Tech offers Active Directory security assessments, attack path analysis, and hardening implementation. Contact us to secure your identity infrastructure.