Active Directory Security
Active Directory security focuses on protecting Microsoft's directory service from credential theft, privilege escalation, and domain compromise. It covers attack paths adversaries use to move from a single compromised workstation to full control of the domain, and the defenses that stop them.
itWindows and Microsoft infrastructure | OpenSkills.info
Intro
Active Directory Security
Active Directory Domain Services is the identity control plane in a Windows domain. It supplies the directory data, authentication services, groups, and policy scope that domain members trust. Compromise the directory, and you can undermine the systems and accounts that depend on it.
This course builds the security mental model on top of what Active Directory Fundamentals already covers: objects, domains, forests, domain controllers, authentication, and groups. Here, the question changes from "how does AD work" to "how does AD get attacked, and what stops that." You will not walk away able to run a penetration test. You will walk away able to reason about privilege, trust, and exposure the way a defender needs to.
Why Active Directory is the top target
After compromising a workstation, an attacker can steal credentials from signed-in sessions and use them to reach more privileged systems. Microsoft's guidance treats privileged accounts, domain controllers, and adjacent identity infrastructure as primary credential-theft targets. Once an attacker holds privileged control of a domain controller, they can modify, corrupt, or destroy the directory itself. That threatens every AD-managed system and account in the organization.
Credential theft attacks specifically target accounts that already carry elevated privilege: permanently privileged accounts, VIP accounts, domain controllers, and adjacent infrastructure such as public key infrastructure servers. The behaviors that make this easy are common and avoidable: signing in to a privileged account on an ordinary workstation, browsing the internet from a privileged session, reusing the same local administrator password across every machine, and handing out membership in privileged groups more freely than the work requires.
The tier model: containing the blast radius
The core defensive idea in modern AD security is the tier model. It groups every identity, workstation, and server into one of three tiers based on how much control it has over the environment, and it enforces a single rule: a credential from a higher tier must never be exposed to a lower tier.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Supports
- Domain controller compromise threatens every AD-managed system and account
- Credential theft attacks target permanently privileged, VIP, and infrastructure accounts
- Risky behaviors that expose privileged credentials: signing in to privileged accounts on unsecured hosts, browsing the internet while signed in as a privileged account
- Three built-in groups with the highest default privilege: Enterprise Admins, Domain Admins, Administrators
- Secure administrative host principles: never administer a trusted system from a less-trusted host, require MFA for privileged tasks
- Domain controller security priority and physical/configuration hardening
- Monitoring AD for signs of attack via audit policy
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/tier-model
Supports
- Tier model definition and purpose: separates identities, workstations, and assets into trust tiers to prevent credential escalation
- Tier 0, Tier 1, Tier 2 scope and example assets table
- Core rule: higher-tier credentials must never be exposed to lower-tier systems
- Privileged access workstation requirement per tier
- Trust starts at the physical keyboard; jump servers inherit the trust level of any credential that touches them
- Anti-patterns: collapsing everything into Tier 0, daily use of Domain Admins, agents with Domain Admins rights on lower tiers, shared service accounts across tiers, treating jump servers as a separate tier
- Relationship between the AD DS tier model and the Enterprise Access Model
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/securing-domain-controllers-against-attack
Supports
- Forest-wide consequences of privileged domain controller compromise
- Current supported domain controller operating systems and Server Core recommendation
- Dedicated secured remote administration, minimal software, and separate management paths
- Physical, virtualization, network, browser, and internet-exposure controls
- Recovery from a known-good backup after domain controller compromise
- https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model
Supports
- Enterprise Access Model as the broader framework for privileged access across on-premises, multi-cloud, and application access paths
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
Supports
- Full list of protected groups in Active Directory Domain Services
- AdminSDHolder object purpose, location, and ownership
- SDProp process: runs every 60 minutes by default on the PDC Emulator, resets drifted permissions on protected objects to match AdminSDHolder
- Permission inheritance disabled on protected accounts/groups even after being moved
- AdminSDProtectFrequency registry value and valid range for changing the SDProp interval
- https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group
Supports
- Protected Users group purpose: nonconfigurable credential-theft protections
- Device protections: no CredSSP/WDigest/NTLM plaintext credential caching, no DES/RC4 Kerberos keys
- Domain controller protections: no NTLM authentication, no DES/RC4 preauthentication, no unconstrained/constrained delegation, TGT lifetime capped at 240 minutes with no renewal
- Prerequisites: domain functional level and host OS version requirements
- Restriction against adding service/computer accounts; lockout risk when adding existing highly privileged accounts without testing
- Protected Users group Active Directory properties (well-known RID 525, Domain Global type, default container, no default members)
- Event log IDs for troubleshooting Protected Users authentication issues
- https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
Supports
- Constrained delegation restricts which services a server can act on behalf of a user for
- Delegation configuration authority shifts from domain admin to service admin under constrained delegation
- Resource-based constrained delegation depends on attributes of the resource service rather than the front-end service being trusted to delegate
- Cross-domain constrained delegation configuration
- https://learn.microsoft.com/en-us/defender-for-identity/security-posture-assessments/accounts
Supports
- Unconstrained delegation risk scenario: a compromised service with unconstrained delegation can request a ticket to any other service and act as the impersonated user, including modifying Enterprise Admins membership
- Delegation type risk comparison: unconstrained, constrained, and resource-based constrained delegation abuse conditions
- DCSync: Replicating Directory Changes and Replicating Directory Changes All permissions enable domain replication abuse to extract password data
- krbtgt account role in signing/encrypting Kerberos tickets; compromise enables Golden Ticket attacks; recommended remediation is resetting the password twice with at least 10 hours between resets
- Dual-privileged accounts (Microsoft Entra ID privileged role + AD privileged group) as an attack-surface risk
- Service accounts in privileged groups, and migrating them to gMSA for automatic password rotation, as a remediation
- Built-in operator groups (Server, Backup, Print, Account Operators) as broad-privilege targets
- Non-default primaryGroupId as a technique to hide group membership
- Admin SDHolder permission on non-sensitive accounts as a privilege-escalation risk
- Stale/dormant privileged and service account risk
- SID History attribute abuse for cross-domain privilege elevation
- Cleartext credentials stored in free-text attributes (description, info, adminComment)
- LAPS purpose: randomized, rotated local administrator passwords stored in AD behind ACLs
- The account is sensitive and cannot be delegated setting as the mitigation for privileged-account delegation risk
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/group-managed-service-accounts-overview
Supports
- gMSA provides a single identity for services across multiple servers, with Windows managing and rotating the password automatically
- Functional level and KDS root key prerequisites for gMSA
- https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview
Supports
- Windows LAPS as the current, supported local administrator password management feature
- Protection against pass-the-hash and lateral-traversal attacks via per-device password randomization
- Legacy Microsoft LAPS deprecation status
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/ldap-signing
Supports
- LDAP signing provides message integrity and authenticity
- LDAP channel binding ties authentication to the underlying TLS session
- Enforced signing rejects unsigned SASL binds and simple binds over unencrypted connections
- Audit and compatibility considerations before enforcement
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations
Supports
- Recommended audit subcategories for AD-relevant detection: Kerberos Authentication Service, Kerberos Service Ticket Operations, Directory Service Changes, Security Group Management, User Account Management
- Audit Special Logon / event 4964 as a high-confidence single-occurrence alert for privileged group members signing in unexpectedly
- Monitoring both workstations and servers, since early compromise indicators often appear on workstations
- Criteria for a good alerting event ID: high likelihood of indicating unauthorized activity, low false positives, warrants investigation
- AD objects/attributes to monitor: privileged group membership and account attribute changes
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4964
Supports
- Event 4964 occurs when a member of a configured Special Group signs in
- Special Groups require a configured list of group SIDs
- Monitoring privileged-group sign-ins on unauthorized workstations
- https://learn.microsoft.com/en-us/defender-for-identity/what-is
Supports
- Microsoft Defender for Identity as a cloud service monitoring on-premises Active Directory and Microsoft Entra ID identity signals
- Detection based on behavioral analytics and signal correlation rather than single events
- Integration into the Microsoft Defender portal with unified incidents across endpoints, email, SaaS, and cloud workloads
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-determine-how-to-recover
Supports
- Restoring at least one writable domain controller in every domain
- Selecting the last trusted backup and accepting post-backup data loss
- Required built-in Administrator and DSRM recovery credentials
- Multiple backups, isolated recovery, and tested restore planning