Step One: Document and Audit

Proper AD hardening can keep attackers contained and prevent lateral movement, privilege escalation, and access to sensitive data and resources. One of the essential steps in AD hardening is understanding everything present in your AD environment. An audit of everything listed below should be done annually, if not every few months, to ensure your records are up to date. We care about:

Things To Document and Track

• Naming conventions of OUs, computers, users, groups
• DNS, network, and DHCP configurations
• An intimate understanding of all GPOs and the objects that they are applied to
• Assignment of FSMO roles
• Full and current application inventory
• A list of all enterprise hosts and their location
• Any trust relationships we have with other domains or outside entities
• Users who have elevated permissions

People

In even the most hardened environment, users remain the weakest link. Enforcing security best practices for standard users and administrators will prevent "easy wins" for pentesters and malicious attackers. We should also strive to keep our users educated and aware of threats to themselves. The measures below are a great way to start securing the Human element of an AD environment.

• The organization should have a strong password policy, with a password filter that disallows the use of common words (i.e., welcome, password, names of months/days/seasons, and the company name). If possible, an enterprise password manager should be used to assist users with choosing and using complex passwords.
• Rotate passwords periodically for all service accounts.
• Disallow local administrator access on user workstations unless a specific business need exists.
• Disable the default RID-500 local admin account and create a new admin account for administration subject to LAPS password rotation.
• Implement split tiers of administration for administrative users. Too often, during an assessment, you will gain access to Domain Administrator credentials on a computer that an administrator uses for all work activities.
• Clean up privileged groups. Does the organization need 50+ Domain/Enterprise Admins? Restrict group membership in highly privileged groups to only those users who require this access to perform their day-to-day system administrator duties.