Active Directory security: auditing and hardening
You audit a Windows domain with a defender’s eye: you find privileged groups, forgotten and service accounts, the password policy, shares and traces of attacks, and report them with hardening advice.
Level 201 · 22 lessons · 24 practice labs
Lessons
Getting to know Active Directory
- First audit: get to know the domain, find the privileged accounts
- What Active Directory is: domain, forest, OU
- Domain controllers and DNS: SRV records
- Authentication: Kerberos and NTLM
- Querying the directory with LDAP: filters and attributes
Accounts and groups
- Privileged groups: Domain Admins, Enterprise Admins, Backup Operators
- Finding unused and disabled accounts
- Service accounts and passwords that never expire
- Password policy and fine-grained password policies (FGPP)
- Local administrator passwords: LAPS
Permissions, shares and Group Policy
- Auditing SMB shares and their permissions
- Group Policy (GPO) basics
- Delegation risks
- Object permissions (ACLs) and dangerous rights
Detecting attack traces
- Windows event IDs that matter for AD
- Detecting password spraying
- Detecting and preventing Kerberoasting
- DCSync and the abuse of replication rights
Hardening and reporting
- The tiered administration model (tier 0/1/2)
- SMB and LDAP signing, LDAPS
- The krbtgt password, backup and recovery
- Capstone: the CORP.LAB audit report
Practice labs
- List the privileged accounts in the domain: Extract the members of Domain Admins and Enterprise Admins including nested groups.
- Find accounts whose password never expires with an LDAP filter: Write a filter using the userAccountControl flag and list the results.
- Find the domain controllers from SRV records: Query the LDAP and Kerberos SRV records in DNS and write down the controllers with their roles.
- Extract enabled accounts unused for 90 days: Filter by lastLogonTimestamp, separate service accounts and list the ones to disable.
- Find the account with a password written in its description: Scan every user’s description field and report the entry containing a password.
- Find service accounts with an SPN and an old password: List accounts with an SPN along with password age and choose the riskiest three.
- Apply a stricter password policy to administrators: Create a fine-grained password policy for the privileged group and show which accounts it applies to.
- Find the computers outside LAPS coverage: List computers whose local admin password attribute is empty and explain why through GPO scope.
- Find the sensitive file on a share open to everyone: List shares and their permissions and find the file containing a password on the one open to everyone.
- Find the computer with unconstrained delegation: Query the delegation flags and report unconstrained delegation outside the domain controllers.
- Find the dangerous ACL entry on a user object: Find the ordinary group holding GenericAll on an admin account and remove it.
- Find and clean up a password left in SYSVOL: Scan script and policy files, find the embedded password, remove it and change the account’s password.
- Recognise password spraying in the logs: Find attempts from one source against many accounts in 4625 and 4771 records and note the time range.
- Extract the trace of Kerberoasting from 4769 records: Find ticket requests with RC4 encryption for many services in a short time and note the requesting account.
- Find the quiet addition to a privileged group: Filter 4728 and 4756 records and identify the account added out of hours and who added it.
- Prove the trace of DCSync from replication events: Show in 4662 records that an account which is not a domain controller used replication rights.
- Place accounts into the tiered administration model: Review the hosts admin accounts log on to and find the logon that breaks the tiers.
- Verify LDAP and SMB signing are required: Query the signing settings on the controller, try an unsigned bind and show it is refused.
- Audit the krbtgt password age and backup state: Find krbtgt’s last password change and the last system state backup and write the risk note.
- Uncover the privileged members hidden through nested groups: Use the recursive LDAP matching rule to find accounts that are indirect members of Domain Admins and write the membership chain for each.
- Build the process that safely retires unused accounts: Identify candidates while allowing for lastLogonTimestamp lag, exclude service accounts, disable and move the rest to a quarantine OU and write the rollback step.
- List the tier 0 assets and accounts: Gather the domain controllers, the privileged groups and their members into a single tier 0 list.
- Read the domain’s signing and password policy settings: Extract password length, lockout threshold and SMB signing settings from the default domain policy and compare them with the recommended values.
- Read the recent changes to a user object: List the most recently changed attributes and their times from the object’s replication metadata.
About this course
This course teaches Active Directory from the defender’s side: how to audit a domain, find risky settings, recognise the traces attacks leave in logs, and prevent them. In every lesson you work in a practice domain called CORP.LAB with an auditor account that can only read.
It starts with the basics of domains, Kerberos and LDAP, and continues with privileged groups, unused accounts, service accounts, password policies, LAPS, shares, Group Policy, delegation and object permissions. Then you move to detection: you read the traces of password spraying, Kerberoasting and DCSync in event logs and learn the countermeasures. The course ends with an audit report in which you rank your findings.
What you will learn
- Recognise domains, forests, OUs, domain controllers and DNS SRV records
- Explain how Kerberos and NTLM authentication work
- Query accounts, groups and computers in the directory with LDAP filters
- Find privileged groups, unused accounts and service accounts whose passwords never expire
- Audit password policies, LAPS, SMB shares and Group Policy
- Spot dangerous rights in delegation and object permissions (ACLs)
- Detect traces of password spraying, Kerberoasting and DCSync in Windows event logs
- Plan hardening such as tiered administration, signing, LDAPS and the krbtgt password
Who this course is for
For system administrators, SOC analysts, auditors and students heading into enterprise network security. The course does not teach attack steps; every topic is treated as audit, detection and prevention.
Prerequisites
The basics of the Linux command line (reading files, grep, pipes) and basic networking concepts. No Windows administration experience is needed.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Do I need a Windows computer or server?
- No. Every lab starts with its own practice domain; you connect from the Kali terminal in your browser.
- Does the course teach attack techniques?
- No. It explains what the attacks are and which traces they leave; the exercises are about audit, detection and fixing.
- Is the lab domain realistic?
- CORP.LAB has dozens of users, computers, service accounts, shares and deliberately wrong settings. Some values change in every lab.
- What can I do at the end?
- You can audit a domain from start to end and report the findings in order of importance; the final lesson is exactly that.