Active Directory Hardening: Protecting the Foundation of Your IT Environment

Nearly every major security breach involves Active Directory at some point. The attacker compromises one machine, extracts credentials from memory, moves laterally through the network, escalates privileges — and suddenly Domain Admin has been reached. The entire process can take less than an hour in an unhardened environment.

Active Directory is the foundation of most organizations' IT infrastructure. It controls authentication, authorization, and access to all resources. When AD falls, everything falls.

Why is AD the Attacker's Favorite Target?

Active Directory was designed for usability and backward compatibility — not for withstanding targeted attacks. The default configuration is full of weaknesses:

• All authenticated users can read large parts of the AD catalog
• Legacy protocols like NTLM are often still active
• Service accounts tend to have excessive privileges and passwords that never change
• Group Policy objects can expose sensitive information
• Delegated permissions accumulate over years without review

Common Attack Techniques

Kerberoasting

The attacker requests a service ticket (TGS) for a service account with an SPN (Service Principal Name). The ticket is encrypted with the service account's password hash and can be cracked offline. If the password is weak, the attacker has the credentials within minutes.

**Countermeasure:** Use long, complex passwords (30+ characters) on service accounts with SPNs. Use Group Managed Service Accounts (gMSA) where possible — they rotate passwords automatically.

Pass-the-Hash

The attacker extracts NTLM hashes from memory on a compromised machine and uses them directly to authenticate against other systems — without knowing the actual password.

**Countermeasure:** Disable NTLM where possible. Use the Protected Users group for privileged accounts. Implement Credential Guard on Windows 10/11.

DCSync

With sufficient rights in AD (often achieved through poor delegation), the attacker can impersonate a domain controller and replicate all password hashes from AD — including the KRBTGT account.

**Countermeasure:** Strictly limit who has replication rights. Monitor Directory Services replication requests from non-DC machines.

Golden Ticket

After obtaining the KRBTGT hash via DCSync, the attacker can issue arbitrary Kerberos tickets with any privileges and a long lifetime. This provides persistent access even after the original compromise has been discovered.

**Countermeasure:** Rotate the KRBTGT password regularly (twice in quick succession to invalidate old tickets). Monitor for unusual Kerberos activity.

The Tiered Administration Model

Microsoft recommends segmenting AD administration into three tiers:

Tier 0 — Domain Controllers and AD Infrastructure

• Only dedicated admin accounts with access to DCs
• No internet access from Tier 0 systems
• Dedicated admin workstations (PAW — Privileged Access Workstations)
• Minimal software installed

Tier 1 — Servers and Applications

• Separate admin accounts for server administration
• Tier 1 accounts should never log in to workstations
• Tier 1 accounts have no rights on DCs

Tier 2 — Workstations and Users

• Helpdesk and desktop administrators
• These accounts should never log in to servers or DCs
• LAPS (Local Administrator Password Solution) for local admin passwords

The principle is simple: credentials from a higher tier should never be exposed at a lower tier. A Domain Admin should never log in to a regular workstation.

Practical Hardening Steps

1. Disable NTLM Where Possible

NTLM is vulnerable to relay attacks and pass-the-hash. Enable NTLM audit logging first to identify dependencies, then disable it gradually.

2. Implement LAPS

LAPS gives each machine a unique, automatically rotated local admin password. This eliminates the risk that one compromised local admin password grants access to every machine.

3. Use the Protected Users Group

Accounts in the Protected Users group cannot authenticate via NTLM, cannot be delegated, and have shorter TGT lifetimes. Add all privileged accounts.

4. Dedicated Admin Workstations

Privileged operations should only be performed from dedicated, hardened workstations that are not used for email, web browsing, or other daily tasks.

5. Clean Up Delegated Permissions

Review all delegated permissions in AD. Remove unnecessary delegations, especially GenericAll, WriteDACL, and permissions on sensitive objects like the Domain Admins group.

What Should You Monitor?

Detection is just as important as hardening. Configure logging and alerting for:

• Event ID 4769 — with encryption type 0x17 — possible Kerberoasting
• Event ID 4624 — with NTLM authentication from unexpected sources
• Event ID 4662 — with replication rights from non-DCs — possible DCSync
• Changes to privileged groups — (Domain Admins, Enterprise Admins, Schema Admins)
• New GPOs and changes to existing GPOs
• Creation of new service accounts — with SPNs

Forward these events to a SIEM like Microsoft Sentinel for correlation and automated response.

ForSec conducts AD security assessments and implements hardening based on best practices. We help you identify weaknesses and close them — before the attacker finds them.