Active Directory: Securing Active Directory Domain Services

Explore account security in Windows Server 2016 and later, covering password and lockout policies, Kerberos settings, fine-grained policies, protected groups, and Windows Hello plus Azure MFA authentication.

Account lockout policies define thresholds, duration, and unlock methods to deter brute force attacks. Configure thresholds, auto-unlock, and 30-minute reset, and monitor sign-ins in real time.

Configure Kerberos policy settings from the default domain policy to govern ticket lifetimes and TGTs for domain user and computer accounts. Enforce clock synchronization tolerance to ensure accurate Kerberos operations.

Explore how restricted groups and protected users strengthen Active Directory domain services, then test your understanding of their membership controls, authentication protocols, and encryption types.

Explore fine-grained password policies in Active Directory by reviewing password settings objects, their container storage, and how to apply policies to groups or users, including shadow groups for OUs.

Explore credential protection in Active Directory by enforcing protected users for local sign-in and applying authentication policies and Dec claims to restrict sign-in to approved devices.

Understand how protected users prevent sensitive credentials from being cached locally and reduce credential theft. See how authentication policies and silos enforce the same policy across users, services, and computers.

Configure local and domain account policies via Secpol.msc and group policy management. The default domain policy applies domain-wide, including Kerberos settings, with precedence over local settings and changes requiring approval.

Explore configuring user account policies in an Active Directory domain services environment, covering local security policy, group policy precedence, Kerberos, password and account lockout policies, and the default domain policy.

Discover how group MSAs extend managed service accounts across multiple servers, enabling automatic password maintenance and simplified service principal management via domain controllers and the KDS root key.

Demonstrate configuring group managed service accounts in Active Directory, including creating and associating an MSA, installing it on a server, and configuring its logon for a service.

Implement and audit security policies for Active Directory Domain Services, including password policies and account lockout. Configure restricted groups and group MSA, with auditing of AD DS changes.

Learn how Sysmon logs Windows event IDs—process creation, network connections, service state changes, registry value sets, and DNS queries—to monitor and detect malicious activity.

install and use logon sessions to view active Windows logon sessions for security analysis and troubleshooting, with details on domain, user, authentication method, and built-in administrator RID 500.

Explore how to use Process Explorer to monitor and examine Windows processes, view CPU usage, process IDs, loaded DLLs, and environment details for system administration and troubleshooting.

Audit ntlm usage with event id 4624 and logon type 3, then enable ntlm version 2 across the domain, audit all accounts via policy, and progressively restrict or disable ntlm.

implement dnssec to secure the section company dot primary zone between the primary domain controller and dc two, configure signing keys and trust anchors, and verify via powershell.

Obtain local admin passwords with LAPS via the Labs UI or PowerShell, view and convert expiration times in AD attributes, and enforce read vs reset permissions with auditing.

Learn how to plan Active Directory Domain Services upgrades by migrating from FRS to DFS and understand functional level rollback limitations for Windows Server 2016 and beyond.

Configure Defender with group policy to enable attack surface reduction, controlled folder access, and network protection, then manage definition updates via wsus with automatic approvals.

Configure and verify service principal names (SPNs) to link a service instance to an account, using spn with list and s switches, and d to remove, for http and classes.