Most people get Active Directory hardening wrong. They think they need to add security controls and tools. Do this instead...
I was a sysadmin for 10 years, I’ve pentesting hundreds of internal networks (thousands of hours), and the one common trait among organizations who do hardening well is, first they delete.
Hardening is the process of reducing opportunities for attackers.
In other words, deleting or removing unnecessary features, permissions, and attack paths.
Ex. Disabling the Print Spooler on Domain Controllers because it can be easily abused in coerced authentication attacks.
What should you delete to harden Active Directory?
Legacy Authentication Extinction — Remove outdated authentication protocols that attackers commonly exploit to steal credentials and move laterally.
Example: Disable NTLMv1 across the domain
Kerberos Service Trust Reduction — Reduce unnecessary Kerberos trust relationships and service account exposures that can be abused for privilege escalation.
Example: Remove unused SPNs from service accounts
Directory Credential Exposure Elimination — Eliminate stored credentials and other sensitive secrets that attackers can extract from Active Directory environments.
Example: Remove passwords stored in Group Policy Preferences (GPP) & file shares
Authentication Relay Erasure — Remove conditions that allow attackers to relay authentication requests and gain unauthorized access.
Example: Enable LDAP Signing & Channel Binding on domain controllers
Quick note…In a recent internal pentest I was able to validate the organization had properly enabled these controls such that all my attempts at relaying attacks failed. I would have fully compromised their domain. But I was stopped cold.Privileged Identity Mobility Restriction — Limit where privileged accounts can log on and operate to reduce opportunities for credential theft.
Example: Prevent Domain Admins from logging into workstations
Directory Replication Path Elimination — Prevent unauthorized accounts from accessing Active Directory replication capabilities that can expose password data.
Example: Remove Replicating Directory Changes permissions from non-admin accounts
Certificate Trust Path Reduction — Remove insecure Active Directory Certificate Services configurations that enable certificate-based attacks.
Example: Fix exploitable certificate templates, like ESC1, ESC2, etc.
Domain Controller Surface Area Pruning — Reduce the number of services, features, and applications running on domain controllers to minimize attack opportunities.
Example: Disable the Print Spooler service on domain controllers
Directory Network Segmentation — Restrict network access to Active Directory systems so only authorized users and systems can communicate with them.
Example: Allow RDP to domain controllers only from designated admin jump servers/PAWs
AD Data Exposure Reduction — Limit unnecessary access to Active Directory information that attackers use for reconnaissance and attack path discovery.
Example: Follow the principle of least privilege to restrict access for users where it’s not needed
Some of these are quicker wins than others.
Removing credential files from shares is easier than restricting NTLM across your domain.
Every environment is different.
So how do you know what to remove and in what order?
By focusing on exploitability, in your unique environment.
That’s one of the questions we help answer for organizations with our internal pentesting engagements.
What can be exploited and how bad would it be…
The key to hardening is identifying what’s a prime target for attackers, then eliminating, reducing or restricting that thing.
Do this and you make your environment harder to attack.
All the best
Spencer Alessi
PS - OWASP recently created a Top 10 Subtractive Hardening list for Active Directory, which aligns perfectly to what I’ve always been preaching. It was the inspiration for this weeks newsletter. Hallelujah!
PPS - Long live Active Directory! ✌️