1. Active Directory as the Primary Enterprise Attack Vector
Microsoft Active Directory Domain Services (AD DS) authenticates identities, authorizes resource permissions, and enforces endpoint security policies across more than 90% of enterprise environments. Because Active Directory holds the "keys to the kingdom," it is the foremost target for advanced persistent threats (APTs) seeking domain dominance via Kerberoasting, AS-REP roasting, NTDS.dit credential dumping, and pass-the-hash attacks.
2. Implementing the Tiered Administrative Architecture (NIST / Microsoft ESAE)
To prevent lateral credential theft from compromising domain controllers, organizations must strictly partition administrative identities into isolated operational tiers:
- Tier 0 (Identity & Domain Control): Domain Controllers, PKI Certificate Authorities, and Domain Admin accounts. Tier 0 credentials must never be used to log into member servers or end-user workstations.
- Tier 1 (Server Infrastructure): Enterprise member servers, storage arrays, database clusters, and hypervisors. Managed by dedicated Server Admin accounts isolated from desktop fleets.
- Tier 2 (Workstations & Mobile Devices): End-user client machines, laptops, and peripheral hardware. Desktop support accounts cannot log into Tier 1 or Tier 0 assets.
3. Critical Group Policy Security Baseline Configurations
- Deprecate Insecure Protocols: Explicitly disable NTLMv1, SMBv1, and LanMan authentication across all domain systems. Enforce NTLMv2 session security and Kerberos AES-128/AES-256 encryption.
- Mandate LDAP Signing and Channel Binding: Protect domain controllers against LDAP relay attacks by enforcing
LDAPServerIntegrity = 2(Require signing) and TLS channel binding tokens. - Restrict Local Administrator Privileges: Deploy Microsoft Local Administrator Password Solution (LAPS) to automatically randomize and rotate unique local administrator passwords across every client workstation.
