Active Directory configuration audit
You build the directory inventory of the lab domain; you audit privileged groups, password policies, service accounts, object permissions, delegation, group policies, certificate templates and legacy protocols, harden them and monitor changes.
Level 301 · 20 lessons · 18 practice labs
Lessons
Getting to know the directory
- Domains, forests, OUs and trusts
- Directory inventory with PowerShell and LDAP queries
- Privileged groups and their members
- Short task: build the directory’s user, group and computer inventory
Accounts and passwords
- The domain password policy and fine-grained password policies
- Unused accounts and passwords that never change
- Service accounts with SPNs and their password strength
- Finding and fixing accounts without Kerberos pre-authentication
- Moving to group managed service accounts
- Short task: find and fix risky account settings
Permissions and policy
- Auditing permissions on directory objects
- Auditing Kerberos delegation settings
- Auditing group policy objects and their permissions
- Finding and cleaning passwords left in SYSVOL
- Auditing certificate template misconfigurations
- Short task: find and remove permissions that grant too much
Protocols and monitoring
- Auditing NTLM, LLMNR and SMB signing settings
- Hardening the domain controller
- Monitoring directory changes and suspicious requests
- Capstone: audit an Active Directory environment and apply the hardening plan
Practice labs
- Inventory the directory's users, groups and computers: List object counts, OU distribution and inactive computers with PowerShell queries.
- Audit privileged group memberships: Expand nested memberships of admin groups, find the unexpected member and remove it.
- Audit and report domain trust relationships: Extract trust direction and filtering for Demirsu Enerji's forest and report the unnecessary trust.
- Find unused accounts and passwords never changed: List accounts with old last-logon and password dates and mark those to disable.
- Find and fix accounts with Kerberos pre-authentication disabled: Query accounts with the setting off, turn it on and confirm the account still logs in.
- Move SPN service accounts to group managed accounts: Find an SPN service account with a weak password, move it to a group managed account and confirm the service runs.
- Read the domain password policy and compare with the standard: Extract length, history, lockout and age settings and note deviations from the standard.
- Apply a fine-grained password policy for admins: Assign a stricter policy to the admin group and confirm the effective policy with a query.
- Fix accounts with non-expiring or not-required passwords: Find accounts with these flags, question the business need, fix them and record exceptions.
- Find and remove over-permissive directory ACLs: Find write and full-control rights given to standard users on privileged objects and remove them.
- Audit Kerberos delegation settings: Find computers with unconstrained delegation, switch to constrained delegation and protect sensitive accounts.
- Clean up GPO permissions and passwords left in SYSVOL: Find a GPO with excess edit rights and an old SYSVOL preference containing a password, fix them and rotate the password.
- List certificate templates and enrolment rights: Tabulate published templates, who can enrol and subject name settings.
- Fix a template that lets the requester supply the subject: Find an authentication template where the subject is supplied in the request, fix it and narrow enrolment rights.
- Audit certificate services and write the findings report: Audit templates, CA permissions and enrolment settings in Pusulaya Sigorta's environment, apply fixes and report.
- Disable LLMNR and NetBIOS name resolution by policy: Turn off LLMNR via group policy and confirm on a client that the setting applied and the queries stopped.
- Require SMB signing and measure NTLM use: Require signing on domain controllers and servers, enable NTLM auditing and report which systems still use it.
- Harden a domain controller and monitor directory changes: Remove unneeded services and logon rights, enable directory change auditing and find the test change's record.
About this course
You build the directory inventory of the lab domain; you audit privileged groups, password policies, service accounts, object permissions, delegation, group policies, certificate templates and legacy protocols, harden them and monitor changes.
What you will learn
- Getting to know the directory
- Accounts and passwords
- Permissions and policy
- Protocols and monitoring
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.