Security Hardening Settings For Windows Servers

Security Hardening Settings for Windows Servers and
Active Directory Security Hardening

Based on #RSA Security Conference #Manage Engine #Connect to Protect #Microsoft AD Hardening Recourses
1. User accounts with non-expiring passwords
Issues
 Infinite time to be hacked.
 All internal users can determine these accounts.
 Resetting passwords at scheduled intervals improves security.
 Forces attackers to have time limit to break into account.
 Compromised accounts need to be re-compromised.
Solutions
All user accounts need to have expiring passwords:
 IT
 Developers
 Help desk
 Executives
 Service accounts...
2. User accounts that never logged in
Issues
 Accounts have “new user password.”

 All employees know “(default) new user password.”
 Any employee could log on to these accounts.
 Access and privileges are already granted at time of creation.
Solutions
 Delete user accounts that will never be used.

 Report on all user accounts that are not logged into regularly.
 Do not use same “new user password” for all new user accounts.
 Implement a random password generator for new user accounts.
3. Default privileged groups need evaluation
Issues
Domain level groups:
 Domain Admins
 Administrators
 DNSAdmins
 Etc.
Forest level groups:
 Enterprise Admins
 Schema Admins
Solutions
 Verify group membership regularly.

 Use tool that can get group members recursively.
 Use least privilege concepts.
4. Application and custom privileged groups need evaluation
Issues
 Microsoft applications:
 SQL
 Exchange
 SharePoint Etc.
 Third party applications
Solutions
 Document all privileged groups.

 Verify group membership regularly.
 Use tool that can get group members recursively.
5. Server-based user rights
Issues
 Provide privileges over computer where user rights are assigned.

 User rights supercede resource access.
 User rights can allow inappropriate access.
 User rights can allow denial of service attacks.
 User rights can allow to run malwares ;ransomware kind of attacks
Solutions
 Verify user rights using appropriate tool – secpol.msc.

 Use Group Policy to standardize and deploy user rights settings.
6. Active Directory delegations
Issues
 Delegations provide privileged access to AD objects:

 Resetting user passwords
 Creating groups
 Modifying group membership
 Delegations are difficult to report.
 Delegations can be difficult to remove
Solutions
 Verify delegations on all OUs and domain – dsacls.

 Use third party tool for delegations:
 Proxy user
 Easier and increased delegations
 Track all activity and actions
7. Group Policy delegations
Issues
 Group Policy is integral to Active Directory.

 Group Policy can decrease security providing access.
 Group Policy can cause significant issues and consequences.
 Delegations provide access over GPOs:
 Creating for domain
 Linking to domain, OU, site
 Modifying GPO setting
Solutions

 User GPMC, GPMC scripts, or PowerShell to obtain delegations.
8. Service accounts
Issues
 Service accounts are granted privileges at install or configuration.

 Service accounts often have non-expiring passwords.
 Service accounts often have original passwords.
 Service accounts are rarely monitored for access.
Solutions
 Associate all service accounts to servers where configured.

 User long and strong passwords.
 Configure accounts to only be able to log on to specified
 computers.
 Configure accounts to not be able to change own password.
9. Password policy
Issues
 Controls domain and local user password parameters.

 Most password policy settings are weak.
 Password policy changes are difficult to “see.”
 Password policy is misunderstood in GPOs.
 Fine-grained password policies are rarely used
Solutions
 Use correct tool(s) to report on current password policy – secpol.msc.

 Ensure password policies in GPOs linked to OUs are not considered
for domain users.
 User fine-grained password policies or third party tool to have
multiple password policies in same domain.
 Use security concepts to set password parameters, not compliance
10. Real-time monitoring of Active Directory changes
Issues
 Security settings change over time.

 Security settings are hard to “see” and report.
 Privileged accounts can alter security settings.
 Security settings change to solve problems.
 Without change monitoring of security settings, actual settings are
unknown until manually checked.
Solutions
 Establish a real-time change monitoring tool to track all Active

Directory changes. (SIEM will helps)
 Generate reports to see “drift” of security settings.
 Review reports often to ensure security is still intact.

Security Hardening Settings For Windows Servers

Uploaded by

Copyright:

Available Formats

Security Hardening Settings For Windows Servers

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Hardening Settings For Windows Servers

Uploaded by

Copyright:

Available Formats

Security Hardening Settings for Windows Servers and

Active Directory Security Hardening

1. User accounts with non-expiring passwords

All user accounts need to have expiring passwords:

2. User accounts that never logged in

 Accounts have “new user password.”

 Delete user accounts that will never be used.

Domain level groups:

Forest level groups:

 Verify group membership regularly.

4. Application and custom privileged groups need evaluation

 Document all privileged groups.

5. Server-based user rights

 Provide privileges over computer where user rights are assigned.

 Verify user rights using appropriate tool – secpol.msc.

6. Active Directory delegations

 Delegations provide privileged access to AD objects:

 Verify delegations on all OUs and domain – dsacls.

7. Group Policy delegations

 Group Policy is integral to Active Directory.

 Use least privilege concepts.

 Service accounts are granted privileges at install or configuration.

 Associate all service accounts to servers where configured.

 Controls domain and local user password parameters.

 Use correct tool(s) to report on current password policy – secpol.msc.

10. Real-time monitoring of Active Directory changes

 Security settings change over time.

 Establish a real-time change monitoring tool to track all Active

You might also like