Active Directory Security Checklist

1 minute read

I recently came across the Active Directory Pro blog post Top 25 Active Directory Security Best Practices. It’s a great read for anyone interested in AD security. I decided to type up the 25 points onto my blog so I could quickly reference them easily when required.


Top 25 Active Directory Security Best Practices

  1. Clean up the Domain Admins group
    • limit accounts
    • no day-to-day accounts
  2. Use at Least Two Accounts (Regular and Admin Account)
    • least privilege
    • accountA for day-to-day
    • accountB for admin tasks
  3. Secure The Domain Administrator account
    • 20+ char password
    • only used for domain setup and recovery
  4. Disable the Local Administrator Account (on all computers)
    • often same password
    • can mitigate pass-the-hash/pass-the-password
  5. Use Local Administrator Password Solution (LAPS)
    • sets random password for every admin account
  6. Use a Secure Admin Workstation (SAW)
    • for admin tasks
    • no internet access
    • login with secondary account
  7. Enable Audit policy Settings with Group Policy
    • audit policy on all pcs/devices
  8. Monitor Active Directory Events for Signs of Compromise
    • event logs
    • IoCs
  9. Password Complexity Sucks (Use Passphrases Instead)
    • article recommends 12 chars min
    • 12 isn’t exactly secure anymore
  10. Use Descriptive Security Group Names
    • avoid generic names
    • specific group names
    • prevents control permissions
  11. Cleanup Old Active Directory User & Computer Accounts
    • set up process
  12. Do NOT Install Additional Software or Roles on Domain Controllers
    • limited software/roles
    • use server core - no GUI
    • more software/roles == more security risk
  13. Continuous Patch Management & Vulnerability Scanning
    • don’t forget about 3rd parties
    • upgrade if no longer supported
  14. Use Secure DNS Services to Block Malicious Domains
    • Quad9
    • OpenDNS
    • Comodo Secure DNS
  15. Run Critical Infrastructure on latest Windows Operating System
    • better security
  16. Use Two Factor Authentication for Remote Access
    • DUO
    • RSA
    • Msoft MFA
  17. Monitor DHCP Logs for Connected Devices
    • DHCP logs
    • know what’s connected to network
    • identify anomalies
  18. Monitor DNS Logs for Security Threats
    • malicious DNS lookups
    • Windows DNS debug logs
    • identify anomalies
  19. Use Latest ADFS and Azure Security Features
    • security enhancements
  20. Use Office 365 Secure Score
    • reports/improves security posture
    • compare with benchmarks and establish KPIs
  21. Plan for Compromise (recovery plan)
    • NIST
    • IR/DR
  22. Document Delegation to Active Directory
    • control access to resources
    • security groups
    • know what groups use what
  23. Lock Down Service Accounts
    • often perms too high
  24. Disable SMBv1
    • unsecure
    • over 30 years old
  25. Use Security Baselines and Benchmarks
    • default installs unsecure
    • can be deployed with group policy
    • Security Compliance Toolkit
    • CIS SecureSuite