Hardening Active Directory in practice
You actually close the problems an audit finds: shrinking privileged groups, applying tiered administration, rolling out LAPS and protected users, and removing legacy protocols and dangerous permissions.
Level 301 · 17 lessons · 15 practice labs
Lessons
Privileged accounts
- Shrinking and monitoring privileged groups
- Separating admin accounts from everyday accounts
- The Protected Users group and the sensitive account flag
- Identifying and protecting tier 0 assets
- Short task: cut Domain Admins down to two members and justify it
Authentication
- Rolling out Windows LAPS
- Auditing and restricting NTLM
- Kerberos hardening: AES, pre-authentication, SPN hygiene
- Group managed service accounts (gMSA)
- Short task: move accounts exposed to Kerberoasting to gMSA
Permissions and policy
- Cleaning up dangerous ACLs
- AdminSDHolder and protected objects
- GPO permissions and SYSVOL hygiene
- Dangerous settings in certificate services templates
- Short task: find and remove three permissions that would let a user take over the domain
Capstone
- A hardening roadmap: sequencing without outages
- Capstone: close ten findings from the audit report and prove it
Practice labs
- List the members of privileged groups with their last logons: Put the members of Domain Admins, Enterprise Admins and Backup Operators in one table with last logon dates and flag those unused for 90 days.
- Split a person who administers with their everyday account into two: At Mavikaya Lojistik find a mail-reading account in Domain Admins, create a separate admin account, move the membership and show the everyday account has no privilege left.
- Move privileged accounts into Protected Users without an outage: Determine from events which accounts rely on NTLM or delegation, add the suitable ones to the group, set the sensitive-account flag and resolve one broken job with a rollback plan.
- Read a machine’s LAPS password with an authorised account: Read the local admin password and its expiry for a Windows LAPS member server with PowerShell and show an unauthorised account cannot read it.
- Roll out a LAPS policy for the Servers OU: Prepare the schema and OU permissions, link a GPO that sets password length and rotation, and verify the password changed on one server.
- Audit who can read LAPS passwords and remove the excess: Scan the extended rights on the OU for an unexpected group able to read the password attribute, remove it and turn on auditing for reads.
- Count the logons that still use NTLM in the domain: Turn on NTLM auditing and list from an hour of events the accounts and source machines that authenticate with NTLM.
- Fix accounts with pre-authentication off and RC4 in use: Find accounts that do not require pre-authentication and service accounts limited to RC4, enable AES and confirm the ticket encryption type from the event.
- Restrict NTLM in stages with an exception list: Identify from audit data the two servers that truly need NTLM, add them to the exception list, apply the restriction policy elsewhere and watch the denied attempts.
- List user accounts that have an SPN with their password age: Find user accounts with a service principal name set and flag those whose password is older than a year.
- Move a Windows service to a group managed service account: Verify the KDS root key, create a gMSA, install it on the member server and show the service starting under the new account.
- Retire an old service account without breaking its dependants: Inventory the tasks, services and SPNs that use the account, move them all to the gMSA, disable the old account and write a one-week monitoring plan.
- Read the delegations on an OU: Extract the non-default entries from the Users OU’s access list and state which group can reset passwords.
- Find and remove the dangerous right on the domain root: Find a directory replication right mistakenly granted to the helpdesk group, remove it and check how AdminSDHolder affects protected objects.
- Clean up GPO permissions, SYSVOL and certificate templates in one audit: Find a GPO standard users can edit, a script with a password in SYSVOL and a template that lets the requester supply the subject name, fix all three and prove it.
About this course
You actually close the problems an audit finds: shrinking privileged groups, applying tiered administration, rolling out LAPS and protected users, and removing legacy protocols and dangerous permissions.
What you will learn
- Privileged accounts
- Authentication
- Permissions and policy
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.