Active Directory: Securing Active Directory Domain Services

Explore account security in Windows Server 2016 and later, covering password and lockout policies, Kerberos settings, fine-grained policies, protected groups, and Windows Hello plus Azure MFA authentication.

Explore user rights in Windows Server security, distinguish system-level privileges from resource permissions, and learn how misconfigurations affect security while enforcing least privilege via Local Security Policy or Group Policy.

Master how user rights empower system-wide actions in Windows Server, distinguish them from permissions, and configure them via local security policy or group policy to enforce least privilege.

Learn best practices for managing user rights on Windows Server, applying the principle of least privilege, auditing rights, using built in groups, and documenting changes to prevent privilege escalation.

Apply best practices for managing user rights on Windows Server by enforcing least privilege, controlling remote access, auditing rights, documenting changes, and safeguarding security logs.

Configure user rights and account security options in Windows Server with the Local Security Policy tool, assigning rights such as log on locally to enforce least privilege.

Enforce strong password policies with complexity, expiration, and history; configure account lockout thresholds to deter brute-force attempts, then test user rights and policy effectiveness on Windows Server.

Configure password policy and account lockout in Active Directory Domain Services via group policy or local policy; apply password history, maximum and minimum password age, minimum length, and complexity requirements.

Explore Active Directory domain services security through password policy knowledge checks, covering enforce password history, minimum password age, password complexity, and domain-wide account policy application.

Configure account lockout policies with thresholds and durations to deter brute-force attacks, implement auto-unlock rules, monitor failed sign-ins, and balance security with potential DoS risks, and Kerberos policies.

Learn how account lockout policies protect Active Directory environments by detecting brute-force attempts and preventing denial-of-service through proper lockout threshold and duration, especially for high-security accounts.

Configure Kerberos policy settings from the default domain policy to govern ticket lifetimes and TGTs for domain user and computer accounts. Enforce clock synchronization tolerance to ensure accurate Kerberos operations.

Explore Kerberos policies that enable single sign-on, enforce user logon restrictions, manage ticket lifetimes, time synchronization tolerance, and claims and compound authentication with Kerberos.

demonstrates configuring a domain-based password policy and a group policy management account lockout policy, with password history 20, max age 45, min length 10, and lockout 30 with 15 reset.

Use restricted groups in group policy to manage group membership with Members and MemberOf, and protected users to prevent ntlm, digest, and cred-ssp, enforcing kerberos aes and 4-hour tgt lifetimes.

Explore how restricted groups and protected users strengthen Active Directory domain services, then test your understanding of their membership controls, authentication protocols, and encryption types.

Discover how fine-grained password policies in Windows Server 2008 let administrators apply password and lockout settings to users or groups using password settings objects, containers, and shadow groups, without GPO.

Explore fine-grained password policies in Active Directory by reviewing password settings objects, their container storage, and how to apply policies to groups or users, including shadow groups for OUs.

Configure fine-grained password policies (PSOs) in Active Directory using PowerShell or the Active Directory Administrative Center, detailing settings like password length, complexity, history, lockout, and reversible encryption.

Explore knowledge-check questions on fine-grained password policies (PSOs): password history, precedence, tools like ADAC, linking PSOs to groups, lockout behavior, and complexity settings.

Configure a fine-grained password policy in the Active Directory Administrative Center by creating a password settings object with minimum length 15, password history 20, complexity, and account lockout parameters.

Explore how PSO precedence determines the resultant PSO for a user when multiple PSOs apply, with the PSO having the lowest MSDS password settings precedence winning.

Discover how Active Directory determines the effective PSO when multiple sources apply, using precedence and the object grid as a tie-breaker, and how to view the MSDS resultant attribute.

Learn to protect Kerberos credentials with authentication policies and DEC claims, configure TGT lifetimes, and apply policies via silos for users, services, and computers.

Understand how protected users prevent sensitive credentials from being cached locally and reduce credential theft. See how authentication policies and silos enforce the same policy across users, services, and computers.

Configure ADDS user account policies with local security policy and domain group policy, covering password, Kerberos, and lockout settings, noting default domain policy governs and may override local settings.

Explore configuring user account policies in an Active Directory domain services environment, covering local security policy, group policy precedence, Kerberos, password and account lockout policies, and the default domain policy.

Configure auditing for authentication on Windows Server 2016 domain controllers, including account logon events, the security log, and auditing policies, to monitor logon activity.

Explore the differences between account logon events and logon events, and learn how advanced and basic audit policies shape auditing on domain controllers and computer logons.

Configure and verify authentication audits in Group Policy, enabling success and failure events for account logon and Kerberos authentication, then view event IDs 4771 and 4768 in Event Viewer.

Define the scope of GPO audit policies by linking logon event auditing to OU containing remote desktop servers and human resources computer objects, and account logon auditing across DCs.

Explore how managed service accounts and group MSAs in Windows Server 2016 simplify and secure Active Directory service authentication for applications and background processes, with Kerberos, delegation, and SPNs.

Explore why using Domain Admins or local administrator accounts for services can compromise security, and compare built-in local accounts (Local System, Local Service, Network Service) for safer access.

Explore the challenges of using service accounts for programs like SQL Server and IIS, including domain versus local accounts, password management, SPN administration, and MSA in Windows Server 2016.

Explore how a msds-managed-service-accounts object automates password and SPN management for services in AD DS, with automatic password updates and domain-level automation.

Learn how grouped MSAs extend managed service accounts across multiple servers, enabling automatic password maintenance and simplified SPN management in Active Directory Domain Services environments.

Demonstrate configuring group managed service accounts in Active Directory, including creating and associating an MSA, installing it on a server, and configuring its logon for a service.

Implement and audit security policies for Active Directory Domain Services, including password policies and account lockout. Configure restricted groups and group MSA, with auditing of AD DS changes.

Configure password policies and restricted groups to protect IT administrators and local administrator accounts. Enable auditing to monitor changes to domain admins and security groups.

This lab guides deploying a read-only domain controller, configuring a password replication policy, and creating a managed service account, then securing an IIS app pool with that account.

Create a PSL for all users, link it to domain users group, and centralize password policy management. Use a low precedence for administrative PSLs to allow future more precise groups.

Emphasize physical security for domain controllers, implement consistent auditing via the default domain controllers policy or a GPO, and assess account lockout considerations for Outlook Web Access.

Explore common attack techniques, including malware (viruses, trojans, ransomware, spyware) and phishing, and learn how social engineering, denial of service, password attacks, insider threats, and advanced persistent threats threaten organizations.

Explore vulnerabilities and attack types that threaten Windows Server security, including ransomware, malware, denial of service attacks, zero-day exploits, and man-in-the-middle attacks, with examples like zero-logon and elevation of privilege.

Explore pass-the-hash attacks as credential theft using password hashes to authenticate across systems, enabling lateral movement, and apply defenses like least privilege, multi-factor authentication, network segmentation, and credential guards.

Install and configure Sysmon on LitSrv1 to capture detailed Windows events, including process creation, network connections, and file timestamp changes, and log them for security monitoring and SIEM analysis.

Learn how Sysmon logs Windows event IDs—process creation, network connections, service state changes, registry value sets, and DNS queries—to monitor and detect malicious activity.

Discover how AutoRuns reveals startup programs and autostart locations on Windows, including startup folders and registry keys, and how to analyze, disable, and verify entries.

install and use logon sessions to view active Windows logon sessions for security analysis and troubleshooting, with details on domain, user, authentication method, and built-in administrator RID 500.

Explore how to use Process Explorer to monitor and examine Windows processes, view CPU usage, process IDs, loaded DLLs, and environment details for system administration and troubleshooting.

Retire SMB v1 and deploy SMB v2/v3 with encryption, signing, pre-authentication integrity, and secure dialect negotiation, to guard against man-in-the-middle attacks, configurable via PowerShell or group policy.

Audit SMB v1 usage and learn how to enable it when needed, explore SMB v2/3 security, and implement signing and encryption on shares using group policy and registry settings.

Demonstrates configuring SMB signing and encryption across a domain using group policy and PowerShell to prevent man-in-the-middle attacks, negotiate signing, enable encryption, and reject unencrypted access.

Examine NTLM security, including LAN Manager version 1 and version 2 challenge-response, hash formats, pass-the-hash attacks, and the shift toward Kerberos for stronger network authentication.

Audit ntlm usage with event id 4624 and logon type 3, then enable ntlm version 2 across the domain, audit all accounts via policy, and progressively restrict or disable ntlm.

Explore DNS vulnerabilities from lack of authentication and integrity, including DNS spoofing and cache poisoning. Learn how dedsec uses digital signatures, rrsig records, and zone signing to validate DNS responses.

implement dnssec to secure the section company dot primary zone between the primary domain controller and dc two, configure signing keys and trust anchors, and verify via powershell.

Manage servers from a Windows Admin Center app, connect on-premises to Azure for monitoring, storage, backup, and disaster recovery, and deploy via local client, gateway, managed server, or failover cluster.

Manage servers securely with Windows Admin Center connected to the domain controller and Active Directory. Use extensions, PowerShell, role-based access control, and remote desktop to administer servers and automate tasks.

Explore tiered administration model for Active Directory, from tier zero to tier two, including red forest concept, separate admin accounts, and a privileged access workstation to prevent cross-tier credential exposure.

Describe the three-tier Microsoft tiering model for Active Directory, showing tier zero to tier two, how credential protections limit lateral movement, and note updates adding cloud services.

Add the domain admins account to the protected users group in PowerShell, then rerun mimikatz to confirm no hash is exposed and Kerberos authentication is used.

Authentication policies and silos restrict privileged credentials to selected users, computers, or services, configurable via AD DS, ADAC, or PowerShell, and enforce Kerberos ticket rules to guard against credential theft.

Protect privileged accounts by creating an authentication policy and silo in the Active Directory Administrative Center, assign domain admins and domain controllers, and enforce logins only to the domain controller.

LAPS randomizes the local admin password to stop lateral movement, integrates with Active Directory on domain joined Windows endpoints, and lets groups view or reset the local admin password.

Install laps on management server and extend AD schema, granting read and reset rights to admins and readers; then configure a labs policy on the servers OU to enforce laps.

Install the LAPS client side extension via the installer or by registering the DLL, with the installer showing absent features and manual registration activating the extension.

Obtain local admin passwords with LAPS via the Labs UI or PowerShell, view and convert expiration times in AD attributes, and enforce read vs reset permissions with auditing.

Credential Guard uses virtualization based security to isolate secrets, protecting password hashes and Kerberos tickets from pass-the-hash and pass-the-ticket attacks, requiring Hyper-V and hardware like secure boot and TPM 1.2.

Run the Microsoft hardware readiness PowerShell script to assess hardware compatibility for credential guard and device guard, verify TPM, secure boot, and drivers, and enable via script or group policy.

Enable credential guard using group policy to turn on virtualization-based security, secure boot, and DMA protection, configure UEFI lock and secure launch, then verify isolated hash prevents pass the hash.

Configure user rights assignments via group policy to control logon methods and tasks, while denying specific users or groups and reviewing defaults against secure baselines to mitigate risks.

Explore user rights assignment policies in Group Policy for Windows Server, covering key settings like network access, act as part of the operating system, and local logon with best-practice focus.

Operate a privileged access workstation with the highest security configuration to secure extremely sensitive roles, enforcing the clean source principle with restricted apps, no internet, IPsec, VLANs, and firewalls.

Explore how domain functional levels in Active Directory Domain Services unlock security features, authentication policies, and protected users, guiding upgrades and secure authentication planning.

Learn how to plan Active Directory Domain Services upgrades by migrating from FRS to DFS and understand functional level rollback limitations for Windows Server 2016 and beyond.

Onboard Windows Server to Microsoft Defender Security Center using a local script or group policy, then tune Defender settings—maps, block at first sight, exclusions, and scan behavior—via policy.

Configure Defender with group policy to enable attack surface reduction, controlled folder access, and network protection, then manage definition updates via wsus with automatic approvals.

Configure an app locker policy via group policy to audit and enforce executable rules on servers. Test on server one and review event logs to confirm blocking when enforced.

Configure Windows Defender Application Control using the policy wizard, create a base policy in default mode, add a deny rule for seven zip, and deploy via group policy.

Copy a template user to create a new account, automatically inheriting department and manager attributes while overwriting placeholders, and configure password reset requirements for the new live user.

Configure user rights in the default domain policy via the group policy management console, noting undefined rights apply to all domain users and can affect time, remote desktop, and shutdown.

Learn offline domain join in two steps: prepare a provisioning text file on a domain-admin machine, then apply it on the offline workstation to join the domain.

Unlock user accounts from the graphical user interface or automate with PowerShell to handle lockouts quickly and efficiently in active directory domain services.

Discover how to reset Active Directory passwords for a single user with ADUC and for many users with PowerShell, including unlocking accounts and enforcing password changes at login.

Use PowerShell to identify stale accounts by password age, then safely disable and review them before deletion. Apply the same workflow to computer accounts to keep Active Directory clean.

Sync Active Directory users from a CSV with a PowerShell script. Import the CSV, create users and computers, and assign group memberships while avoiding duplicates.

Learn to organize Active Directory by managing containers and organizational units, creating and nesting OUs, setting default placements for users and computers, and creating groups with security or distribution scopes.

Learn to manage and secure groups in Active Directory using PowerShell, ADUC, and Group Policy, including nesting, scopes, restricted groups, and delegated administration.

Configure and verify service principal names (SPNs) to link a service instance to an account, using spn with list and s switches, and d to remove, for http and classes.

Explore group managed service accounts (gMSA) and how a password-synced identity serves services across a domain, with Microsoft Key Distribution Service; learn to create and attach gMSAs via PowerShell.

Explore Kerberos policy settings and constrained delegation in Active Directory, including KDC validation, ticket lifetimes for new connections, and clock synchronization requirements for reliable domain access.

Configure virtual accounts to run services as local accounts, avoiding password management. Assign by prefixing with mNt service to a specific local service for auditable, isolated activity.

Navigate the group policy management console to configure domain password policies and account lockout settings. Review history, age, length, complexity, reversible encryption; adjust lockout threshold, duration; unlock with PowerShell.

Grant delegate control to an IT group to manage password resets. Create and apply fine-grained password policies, called password setting objects or pesos, with unique precedence.

Discover how to monitor and troubleshoot Active Directory replication using the sites and services console, rep admin commands (show ripple, Shoken, rep sum), and PowerShell get replication failure.

Configure password replication policies for an RODC in Active Directory by using the GUI or Rep Admin to allow or deny groups, ensuring passwords aren’t cached on remote domain controllers.

Install Windows Server Backup via GUI or PowerShell, configure backup policy with system state and selected volumes, set a network target, and start backup to protect Active Directory Domain Services.

Learn how to back up and restore Active Directory and SYSVOL using DSM, perform authoritative and non-authoritative restores, and recover the system state with Windows backup.

Enable the Active Directory recycle bin, recover deleted objects using Deleted Objects and PowerShell, and perform maintenance tasks such as defragmentation and metadata cleanup.