Protecting your Active Directory environment

Active Directory plays a critical role in the IT infrastructure and ensures the consistency and security of various network resources in a globally interconnected environment. 

Attackers persistently attempt to compromise Active Directory services due to their role in authorizing access to critical and sensitive data.

As organizations expand, their infrastructure becomes more complex, making them much more vulnerable to attack as it becomes increasingly difficult to track important system changes, events, and permissions.

Additionally, it is becoming increasingly difficult for organizations to determine where their sensitive data resides and the type of security policy most appropriate to protect that data.

In this article, we'll look at some Active Directory best practices that will help you improve the overall security of your Active Directory environment.

The AD environment protection techniques discussed are largely based on the experience of the Microsoft Information Security and Risk Management (ISRM) organization, which is responsible for protecting the assets of Microsoft IT and other Microsoft business units, and also advises a select number of Microsoft Global 500 clients.

Why Active Directory Security Is Important

In many organizations, Active Directory is the centralized system that authenticates and authorizes network access. Even in cloud or hybrid environments, this can be a centralized system that provides access to resources. When accessing a document online, OneDrive, printing to a network printer, accessing the Internet, checking email, etc., all of these resources often go through Active Directory to grant you access.

Active Directory has been around for a long time, and over the years, attackers have discovered vulnerabilities in the system and how to exploit them. In addition to the vulnerabilities, it becomes very easy for hackers to simply steal or obtain user credentials, which then gives them access to your data. If they can gain access to your computer or your login, then they can potentially have full access to Active Directory and your network.

Now let's dive into the list of Active Directory security best practices.

1. Clear your IT environment of clutter

The first step to protecting your Active Directory is reducing the attack surface. Several Active Directory security best practices can help here, including the following:

1. Get your Active Directory in order.
2. Optimize and automate ongoing cleaning.
3. Implement both patch management and vulnerability management.
4. Avoid weak authentication protocols.
5. Protect your domain controllers.
   • Limit local administrator rights on each domain controller and minimize the number of accounts that can log on online. Additionally, strictly adhere to password strength and expiration guidelines for all accounts that can access the domain controller.
   • Install only those applications and services that are necessary for the functioning and security of the domain controller.
   • Minimize network access to all your domain controllers and never allow a domain controller to access the Internet.
   • Tightly control physical access to all domain controllers.

2. Ensure the least privilege possible

Another key to reducing the attack surface is to adhere to the principle of least privilege. Really, least privilege are perhaps the most fundamental of all Active Directory security best practices. By giving each user exactly the access they need to do their job, no more and no less, you limit the damage a user can cause, intentionally or accidentally. Additionally, you limit the power an account puts into the hands of an attacker who compromises it, including how far software infections can spread. extortionists using your account.

3. Pay attention to highly privileged accounts

Accounts that have access to sensitive systems and data require additional controls in addition to strict enforcement of least privilege to protect your Active Directory. This includes both administrator accounts and many service accounts:

1. Administrator Accounts
2. Service accounts

4. Implement attack path management and attack path monitoring

AD allows groups to be members of other groups, and nesting can be multiple levels (group A is a member of group B, which is a member of group C). You can even nest groups that are not part of the same domain. Add in years of technical debt from previous builds of Windows Server, high IT staff turnover, and a global shortage of AD security specialists, and the result is often a very complex Active Directory that is at high risk because it is almost impossible to pinpoint. who has elevated permissions in your environment.

What's even more alarming is that attackers can easily increase their permissions without being noticed. In fact, in many IT environments, an attacker who compromises a regular user's account can often become a domain administrator in just a few steps. The only way to understand and block these attack paths is through attack path management and attack path monitoring.

5. Collect and consolidate audit data from multiple sources.

Using the strategies described above can significantly reduce the attack surface to help protect your Active Directory. But even the best security strategy can't guarantee that no attacker will ever break into your network, or that no insider will ever use their privileges intentionally or make a serious mistake that results in downtime or data loss.

Therefore, you also need to collect comprehensive audit data about the activity in your IT environment. Microsoft logs contain a lot of valuable information, but they are not enough to protect Active Directory. You also need to collect critical audit information that is not captured in system logs. For example, proprietary logs often record that a change has occurred, but not critical information about the who, what, when, where, and workstation, or important before and after values.

6. Promptly identify and investigate suspicious activity.

One of the most important types of suspicious activity to look for is privilege escalation attempts. A common way for attackers to gain elevated privileges is to become members of built-in administrator groups. The most influential groups include enterprise administrators, schema administrators, and domain administrators. But it's equally important to keep a close eye on groups at the local Windows system level, such as Administrators, Backup Operators, Power Users, and Hyper-V Administrators. Note that attackers can escalate their privileges by not only making direct changes to privileged groups (which can be tracked in their own security logs), but also by adding themselves as members to nested groups (which Windows servers do not log). 

7. Audit of server login rights

Local security policies are controlled by Group Policy through a number of user rights assignments, including:

1. Allow local login
2. Login as a batch job
3. Allow login via Remote Desktop Services
4. Login as a service, etc.

These assignments allow non-administrator users to perform functions that are normally only available to administrators. If these features are not analyzed, limited, and thoroughly tested, attackers can use them to compromise the system by stealing credentials and other sensitive information.

8. Backup Active Directory and prepare a recovery method

It is recommended that you regularly create Active Directory backups at intervals not exceeding 60 days. This is because the default lifetime of AD tombstone objects is 60 days. You should strive to include an AD backup in your disaster recovery plan to help you prepare for any catastrophic events. Typically, you should back up at least one domain controller.

You may want to consider using a more sophisticated recovery solution that will help you back up and restore AD objects to their original state. Using solutions instead of relying on your own recovery methods will save you a ton of time in the long run.

9. Enable Active Directory security monitoring for signs of compromise

The ability to proactively and continuously audit and monitor Active Directory will help you detect signs of compromise or compromise. In most cases, serious security breaches can be avoided by using monitoring solutions.

Recent surveys have shown that despite evidence that monitoring helps improve security, more than 80% organizations still do not actively use it.

10. Remove public access

Well-known security identifiers such as Everyone, Authenticated Users, and Domain Users are commonly used to grant inappropriate privileges to users over network resources such as file shares. Using these SIDs could allow hackers to exploit an organization's network since they would have access to a large number of user accounts.

Conclusion

Following the best practices outlined here will help you protect Active Directory. However, remember that security is not a one-time configuration event, but an ongoing process. In addition to actively auditing suspicious activity, be sure to periodically review security group memberships, clean up inactive and disabled accounts, ensure systems are patched and properly configured, and identify and mitigate attack paths in your environment. If you want to go even further in your quest to protect your Active Directory, consider implementation of the Zero Trust model. If you have any questions, Contact us. Fanetech is a Microsoft gold partner in Kazakhstan.