Why AD is so attractive
Whoever takes control of Active Directory controls practically the whole network. Attacks often follow the same pattern: an account is taken over, rights are escalated until a domain administrator is reached. Defence addresses each of these stages.
The key measures
- Reduce privileged accounts: keep the domain admins group small, and admins use separate accounts not used for email and browsing.
- Tiering model: separate access to domain controllers, servers and workstations so a stolen account does not open the whole environment.
- Make local administrator passwords unique: Windows LAPS assigns each device its own password.
- Secure service accounts: long random passwords or group managed service accounts (gMSA) against Kerberoasting.
- Disable legacy protocols: NTLMv1, SMBv1 and weak encryption.
- Review delegation: avoid unconstrained Kerberos delegation.
- Review certificate services: misconfigured templates are a known attack path.
- Logging and monitoring: record changes to privileged groups and suspicious sign-ins.
- Protect domain controllers: regular, tested backups and a recovery plan for the directory.
Measure first, then change
Before changing settings you should know where you stand. An Active Directory audit examines accounts, groups, policies, trusts and configuration and delivers a prioritised action list. This avoids hardening that breaks applications relying on old protocols.