For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how…
Remove SMBv1: Check older NAS devices, scanners, and applications for SMBv1 dependencies so you know what needs updating before removing it.
Enforce SMB signing: Start with your file servers and NAS devices and verify that they support signing and whether they actually require it.
Enforce LDAP signing: Identify applications making unsigned LDAP connections to your domain controllers and work with their owners to secure those connections.
Enforce LDAP channel binding: Check applications using LDAP over TLS, such as LDAPS, for channel binding support before enforcing it on domain controllers.
Implement least privilege: Admin rights and delegated AD permissions for accounts with more access than their jobs require. Pay close attention to tier-0 resources.
Enforce AES for Kerberos: Investigate accounts still using RC4 and confirm they have usable AES keys and compatible applications before disabling RC4.
Disable NTLMv1: Look for legacy devices and applications using NTLMv1, resolve those dependencies, then configure policy to refuse LM and NTLMv1.
I’ve loosely ordered this in terms of difficulty to implement, however, your experience and results will vary.
By the way this comes straight from the Active Directory hardening series by Jerry Devore.
These changes help reduce opportunities for attackers. That’s what hardening is all about. Reducing attack surface.
Now that you know what to harden, the question becomes how do you operationalize this.
First, pick one item on the list. Identify the requirements to do that thing.
For example, before removing SMBv1, check whether an old NAS, scanner, or application still uses it. Address that dependency, test with a small group, then expand the rollout.
It would be a big mistake to try and tackle all seven at once. You can make a lot of progress by working on these little by little, consistently, over time.
Reply and tell me: Which of these would be hardest in your environment?
Long live Active Directory!
All the best
Spencer
By the way - I’m speaking at Workplace Ninjas US in January. It’s in Scottsdale Arizona January 11-13th. I’ll be debating Merill Fernando on the topic of, “Is Active Directory defensible?” If you do anything with the Microsoft ecosystem including Security, this event is perfect for you. You should totally come. Check out the full agenda and speaker list here.