Active Directory review and hardening
Active Directory is the first target in a ransomware attack. We audit its permissions, accounts, and settings, then close the attack paths.
What we examine
Attack paths in the domain
Over the years, AD permissions become impossible to follow, and that is where an attacker looks for a path to domain admin rights. These are the areas we review.
Permission chains
Which account can write to a group that is a member of another group that has password reset rights over an administrator. Because of nested group memberships, most domains have an unintended path like this.
Admin and protected groups
Membership of Domain Admins and the other protected groups, and the permissions on the AdminSDHolder object. The most common mistake we find in AD reviews is a service account in Domain Admins whose password has never been changed and under which an application runs on a member server. If that server is compromised, so is the domain.
Service accounts, stale and inactive accounts
Service accounts with an SPN have tickets that can be cracked offline, and their passwords are often short and unchanged for years. This area also covers accounts without preauthentication and accounts nobody uses anymore that are still enabled.
Legacy protocols
NTLMv1, SMBv1, and LLMNR/NBT-NS name resolution either leak credentials or let authentication be relayed. A device placed on the network passively collects password hashes whenever machines send name resolution requests.
Credentials on machines
If a domain admin has ever signed in to a machine, an attacker can take those rights from its memory. A local admin password that is identical on every machine carries the same risk: a single machine is enough to reach the whole fleet.
How the work runs
Map first, then lock down
Hardening builds on the results of the assessment, so the two phases run one after the other.
-
Audit
We map the domain with the same tools an attacker would use, so the unintended paths come to light as well. The result is typically a handful of concrete paths that can be fixed.
-
Closing the attack paths
Based on the assessment, we clean up the admin groups and apply hardening at the Group Policy and protocol level, for example by disabling LLMNR and turning preauthentication back on. Further steps are advisable over the longer term: gMSA or long passwords on service accounts, LAPS, a banned password list, and eventually the tiered administration model, in which domain admin accounts can sign in only to domain controllers.
Deliverables
What you get at the end
items handed over
- A report on risky permissions and on stale and inactive accounts
- Cleanup of the admin groups
- Hardening at the Group Policy and protocol level
- Documentation of the changes
Related services
Built on a clean domain
Once AD is in order, these areas deserve attention.
The 8 most common attack pathsPrivileged access management (PAM)
Admin rights become temporary instead of standing, require approval, and are logged.
Identity and access management (IAM)
Who can access what, with which kind of authentication, and what happens when people join, change roles, and leave.
Log collection and alerting (SIEM)
Attacks on AD leave traces, provided logs are collected and someone actually watches the alerts.
Backup and disaster recovery
The backup system should not be reachable with the same domain credentials as production. Otherwise a compromised domain takes the backups with it.
Frequently asked questions
The questions we hear most
Why do ransomware attackers go after Active Directory?
Once inside the network, an attacker first wants domain admin rights. With them, the attacker can delete the backups, move on to the other machines, and encrypt everything at once. Encryption is therefore the last step of the attack. Privilege escalation happens well before it, and that is the window in which the attack can still be stopped. Our article on ransomware protection walks through the stages of an attack.
If we already have multi-factor authentication, do we still need an AD review?
Yes. MFA protects the perimeter, for example against password spraying through webmail or the VPN. Service account tickets, however, can be requested by any domain user without elevated rights, and accounts without preauthentication can be attacked without any authenticated access at all. MFA does not protect legacy authentication protocols. We covered the differences between the methods in our article on MFA types.
Do you also review the Entra ID settings?
We review the Entra ID tenant as part of Microsoft 365 security hardening. There we check and fix the settings for authentication, Conditional Access, sharing, email, and logging.
