Best Practices for Securing Active Directory

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012

This document provides a practitioner’s perspective and contains a set of practical techniques to help IT executives protect an enterprise Active Directory environment. Active Directory plays a critical role in the IT infrastructure, and ensures the harmony and security of different network resources in a global, interconnected environment. The methods discussed are based largely on the Microsoft Information Security and Risk Management (ISRM) organization’s experience, which is accountable for protecting the assets of Microsoft IT and other Microsoft Business Divisions, in addition to advising a selected number of Microsoft Global 500 customers.

• Foreword

• Acknowledgements

• Executive Summary

• Introduction

• Avenues to Compromise

• Attractive Accounts for Credential Theft

• Reducing the Active Directory Attack Surface

• Implementing Least-Privilege Administrative Models

• Implementing Secure Administrative Hosts

• Securing Domain Controllers Against Attack

• Monitoring Active Directory for Signs of Compromise

• Audit Policy Recommendations

• Planning for Compromise

• Maintaining a More Secure Environment

• Summary of Best Practices

• Appendices

• Appendix A: Patch and Vulnerability Management Software

• Appendix B: Privileged Accounts and Groups in Active Directory

• Appendix C: Protected Accounts and Groups in Active Directory

• Appendix D: Securing Built-In Administrator Accounts in Active Directory

• Appendix E: Securing Enterprise Admins Groups in Active Directory

• Appendix F: Securing Domain Admins Groups in Active Directory

• Appendix G: Securing Administrators Groups in Active Directory

• Appendix H: Securing Local Administrator Accounts and Groups

• Appendix I: Creating Management Accounts for Protected Accounts and Groups in Active Directory

• Appendix J: Third-Party RBAC Vendors

• Appendix K: Third-Party PIM Vendors

• Appendix L: Events to Monitor

• Appendix M: Document Links and Recommended Reading