Module 7

Securing Active Directory

Domain Services
Module Overview

Securing domain controllers

Implementing account security
Implementing audit authentication
Configuring managed service accounts
Lesson 1: Securing domain controllers

Security risks that can affect domain controllers

Modifying the security settings of domain
controllers
Implementing secure authentication
Securing physical access to domain controllers
What are RODCs?
Deploying an RODC
Planning and configuring an RODC password
replication policy
Demonstration: Configuring a password
replication policy
Separating RODC local administration
Security risks that can affect domain controllers

Domain controllers are prime targets for attacks

and the most important resources to secure
Security risks include:
Network security
Authentication attacks
Elevation of privilege
DoS attack
Operating system, service, or application attacks
Operational risks
Physical security threats
Modifying the security settings of domain controllers

Use a GPO to apply the same security settings to all

domain controllers
Consider custom GPOs that link to the Domain
Controllers OU
Security options include:
Account policies, such as passwords and account lockout
Local policies, such as auditing, user rights, and security options
Event log configuration
Restricted groups
Secure system services
Windows Firewall with advanced security
Public key policies
Advanced auditing
Implementing secure authentication

Consider the following factors when implementing

secure authentication:
Secure user accounts and passwords
Secure groups with elevated permissions
Audit critical object changes
Deploy secure authentication, such as smart cards or
multi-factor authenication
Secure network activity
Establish deprovisioning and cleanup processes
Secure client computers
Securing physical access to domain controllers

When securing physical access to your domain

controllers, consider the following:
Only deploy domain controllers where physical security is
ensured
Use RODCs
Use BitLocker on domain controller disk volumes
Monitor hot-swap disk systems because they can lead to
domain controller theft
Protect virtual disks; virtual machine admins must be
highly trusted
Store backups in secure locations
 What are RODCs?

Datacenter Branch office

Writable Windows Server 2008 or RODC:
newer domain controller All objects
Password replication policy: Subset of attributes:
Specifies which user and No secrets
computer passwords can be Not writable
cached by the RODC
Users sign in:
RODC forwards authentication
Password is cached:
If password replication policy allows
Has a local administrators group

AD DS AD DS
What are RODCs?

Consider the following limitations when deploying

RODCs:
RODCs cannot be operations master role holders
RODCs cannot be bridgehead servers
You should have only one RODC per site, per
domain
RODCs cannot authenticate across trusts when a
WAN connection is not available
No replication changes originate at an RODC
RODCs cannot support any app properly that
needs to update AD DS interactively
Deploying an RODC

Prerequisites:
ADPrep /RODCPrep
Sufficient Windows Server 2008 or newer replication partners for
the RODCs
For a one-step deployment, perform either of the following steps:
In Server Manager, open Add Roles and Features, and then use
Active Directory Domain Services Configuration Wizard
Windows PowerShell: Install-ADDSDomainController
ReadOnlyReplica
For a two-step deployment, perform the following steps:
1. Prestaging: Create the account by using Active Directory
Administrative Center or Add-
ADDSReadOnlyDomainControllerAccount
2. Delegated promotion: Join the RODC as delegated admin: Server
Manager or Install-ADDSDomainController -ReadOnlyReplica
Planning and configuring an RODC password
replication policy

A password replication policy determines which users or computers

credentials that a specific RODC caches
You can configure these credentials by using a:
Domain-wide password replication policy
RODC-specific password replication policy
RODC filtered attribute set
Demonstration: Configuring a password replication policy

In this demonstration, you will see how to:

Stage a delegated installation of an RODC
View an RODCs password replication policy
Configure an RODC-specific password replication policy
Verify the resultant password policy
Separating RODC local administration

Administrator role separation allows performance of local

administrative tasks on the RODC for nondomain
administrators
Each RODC maintains a local Security Accounts Manager
database of groups for specific administrative purposes
Configure the local administrator by:
Adding the user or group when precreating or installing
the RODC
Adding a user or group on the Managed By tab on the
RODC account properties
Lesson 2: Implementing account security

Account security in Windows Server 2016

Password policies
Account lockout policies
Kerberos policies
Demonstration: Configuring domain account policies
Protecting groups in AD DS
Fine-grained password and lockout policies
Tools for creating PSOs
Demonstration: Configuring a fine-grained password policy
PSO precedence and resultant PSO
Account-security options in Windows Server 2016
Configuring user account policies
Enhancing password authentication with Windows Hello
and MFA
Account security in Windows Server 2016

Account security features in Windows Server 2016 include:

Password policies
Account lockout policies
Fine-grained password policies
Protected users
Authentication policies
Authentication policy silos
Password policies

Set password requirements by using the following

settings:
Enforce password history
Maximum password age
Minimum password age
Minimum password length
Password complexity requirements:
Does not contain name or user name
Must have at least six characters
Contains characters from three of the following four groups
groups: uppercase, lowercase, numeric, and special characters
Account lockout policies

Account lockout policies define whether accounts

should be locked automatically after several failed
attempts to sign in
To configure these policy settings, you must
consider:
Account lockout duration
Account lockout threshold
Reset account lockout counter after
Account lockout policies provide a level of security
but also provide an opportunity for DoS attacks
Kerberos policies

Kerberos policy settings determine timing for Kerberos

tickets and other events
Setting Default
Enforce user logon restrictions Enabled

Maximum lifetime for service ticket 600 minutes

Maximum lifetime for user ticket 10 hours

Maximum lifetime for user ticket renewal 7 days

Maximum tolerance for computer clock 5 minutes

synchronization

Kerberos claims and compound authentication for DAC

requires Windows Server 2012 or newer domain controllers
Demonstration: Configuring domain account policies

In this demonstration, you will see how to

configure:
A domain-based password policy
An account lockout policy
Protecting groups in AD DS

Restricted groups:
You can control membership for local groups on
workstations and servers by using the following
attributes:
Members
Member of
You cannot use these with domain groups
Protected Users group:
Provides additional protection against the compromise
of credentials during authentication processes
Members of this group automatically have
nonconfigurable protection applied to their accounts
Fine-grained password and lockout policies

You can use fine-grained password policies to

specify multiple password policies within a single
domain
Fine-grained password policies:
Apply only to user objects, InetOrgPerson objects, or
global security groups
Do not apply directly to an OU
Do not interfere with custom password filters that you
might use in the same domain
Tools for creating PSOs

Windows Server 2012 and newer operating systems

provide two tools for configuring PSOs:
Windows PowerShell cmdlets:
New-ADFineGrainedPasswordPolicy

Add-FineGrainedPasswordPolicySubject
Active Directory Administrative Center
Demonstration: Configuring a fine-grained
password policy

In this demonstration, you will see how to configure

and apply a fine-grained password policy
PSO precedence and resultant PSO

If multiple PSOs apply to a user:

The PSOs that you directly apply take precedence rather than the
PSOs that you apply by using group memberships
The PSO with the lowest precedence wins
If two PSOs have the same precedence, the smallest objectGUID
wins
To evaluate a user object to see which PSO has been applied, you
can use the msDS-ResultantPSO Active Directory attribute
To view the effective PSO that AD DS applies to a user:
1. Open Active Directory Users and Computers, and on the View
menu, ensure that Advanced Features is enabled
2. Open the properties of a user account
3. On the Attribute Editor tab, view the msDS-ResultantPSO
attribute if you have configured the Show Constructed Attributes
option under the Filter options
Account-security options in Windows Server 2016

Protected Users group:

Protects users in the Protected Users group
Prevents locally cached user profiles and credentials
Requires Kerberos authentication, limits TGT to four hours
No offline sign in
Windows 8.1, Windows 10, Windows Server 2012 R2 and
Windows Server 2016 domain members only

Authentication policies:
Configured as authentication policy object in AD DS, applied to user,
service, or computer accounts
Custom TGT
Uses claims (DAC) for custom conditions

Authentication policy silos:

AD DS object
Centrally apply authentication policies to multiple objects
Additional claim allows administrators to configure file access per silo
Configuring user account policies

Local Security Policy account settings:

Configure with secpol.msc
Apply to local user accounts

Group Policy account settings:

Configure with the Group Policy Management console
Apply to all accounts in AD DS and local accounts on
computers joined to the domain
Can apply only once in a domain and in only one GPO
Take precedence over Local Security Policy settings
Enhancing password authentication with
Windows Hello and MFA

To enhance security of the authentication process,

you can use:
Windows Hello:
For biometric-based sign in to Windows
Microsoft Passport:
To leverage Windows Hello and TPM

Azure Multi-Factor Authentication:

To enhance account security by adding second factor of
verification
Can be used in cloud or for on-premises applications
Enhancing password authentication with
Windows Hello and MFA
How Windows Hello works

Server

User Your app

PIN

TPM
Windows
Hello
Enhancing password authentication with
Windows Hello and MFA

Multi-Factor Authentication adds a second level of

authentication:
Text message

Phone call

Mobile app
Lesson 3: Implementing audit authentication

Account logon and logon events

Demonstration: Configuring authentication-
related audit policies
Scoping audit policies
Demonstration: Viewing logon events
Account logon and logon events

AD DS
Account logon events:
The system that authenticates the
account registers these events
For domain accounts: domain Account logon
controllers event
For local accounts: local computer

Logon
Logon events: event
The machine at or to which a user
logged on registers these events
Interactive logon: user's system
Network logon: server

Logon
event
Demonstration: Configuring authentication-related
audit policies

In this demonstration, you will see how to configure

authentication-related audit policies
Scoping audit policies

Default Domain Custom

Controllers Policy GPO

Account Logon
logon events
events

Remote
Domain HR clients
Desktop
controllers OU
Server OU
Demonstration: Viewing logon events

In this demonstration, you will see how to view

logon events
Lesson 4: Configuring managed service accounts

Overview of service accounts

Challenges of using service accounts
Overview of managed service accounts
What are group MSAs?
Demonstration: Configuring group MSAs
SPNs and Kerberos delegation
Overview of service accounts

Sometimes, applications require resource access:

For this purpose, you can create domain or local
accounts to manage such access. However, this might
compromise security

Use the following service accounts instead:

Local System:
Most privileged, still vulnerable if compromised
Local Service:
Least privileged, may not have enough permissions to access all
required resources
Network Service:
Can access network resources with proper credentials
Challenges of using service accounts

Extra administration effort to manage the service

account password
Difficulty in determining where a domain-based
account is used as a service account
Extra administration effort to mange the SPN
Overview of managed service accounts

Use MSAs to automate password and SPN management

for service accounts that services and applications use
Requires a Windows Server 2008 R2 or newer installed
with:
.NET Framework 3.5.x
Active Directory module for Windows PowerShell

Recommended to run with AD DS configured at the

Windows Server 2008 R2 functional level or higher
What are group MSAs?

Group MSAs extend the capability of standard

MSAs by:
Enabling MSAs for use on more than one computer in
the domain
Storing MSA authentication information on domain
controllers

To support group MSA, your environment:

Must have at least one Windows Server 2012 or
newer domain controller
Must have a KDS root key created for the domain
Demonstration: Configuring group MSAs

In this demonstration, you will see how to configure

group MSAs
SPNs and Kerberos delegation

Kerberos delegation of authentication:

Services can delegate service tickets issued to them by
the KDC to another service
Constrained delegation:
Allows administrators to define which services can use
service tickets issued to other services
SPNs help identify services uniquely
Windows Server 2016 allows:
Constrained delegation across domains
Service administrators to configure constrained
delegation
Lab: Securing AD DS

Exercise 1: Implementing security policies for

accounts, passwords, and administrative groups
Exercise 2: Deploying and configuring an RODC
Exercise 3: Creating and associating a group MSA

Logon Information
Virtual machines: 20742B-LON-DC1
20742B-LON-SVR1
User name: Adatum\Administrator
Password: Pa55w.rd

Estimated Time: 60 minutes

Lab Scenario

The security team at A. Datum Corporation has been examining

possible security issues in the organization, focusing on AD DS.
The security team is particularly concerned with AD DS
authentication and security of branch-office domain controllers.
You must help improve security and monitoring of
authentication against the enterprises AD DS domain.
Additionally, management at A. Datum has instituted a
password policy, and you must enforce it for all user accounts
and develop a more-stringent password policy for security-
sensitive administrative accounts. It also is important that you
implement an appropriate audit trail to help monitor
authentication attempts within AD DS.
The second part of your assignment includes deploying and
configuring RODCs to support AD DS authentication within a
branch office. Lastly, you should evaluate the usage of a group
MSA by deploying it to the test server.
Lab Review

In the lab, you configured the password settings

for all users within the Default Domain Policy, and
you configured the password settings for
Administrators within a PSO. What other options
were available to help you accomplish the
solution?
In the lab, you were using precedence for the
administrative PSO with a value of 10. What is the
reason for this?
Module Review and Takeaways

Review Questions
Tools
Common Issues and Troubleshooting Tips