> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/active-directory/secure-ad.md).

# Secure AD

{% embed url="<https://activedirectorypro.com/active-directory-security-best-practices/#use-laps>" %}

{% embed url="<https://techcommunity.microsoft.com/t5/microsoft-security-baselines/blocking-remote-use-of-local-accounts/ba-p/701042>" %}

{% embed url="<https://www.reddit.com/r/msp/comments/ea78f3/stop_logging_in_as_a_domain_admin_everywhere/>" %}

{% embed url="<https://paularquette.com/lock-down-your-active-directory-domain-controllers-internet-access-part-of-my-active-directory-hardening-series/>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/securing-domain-controllers-against-attack#blocking-internet-access-for-domain-controllers>" %}

{% embed url="<https://www.hub.trimarcsecurity.com/post/securing-active-directory-performing-an-active-directory-security-review>" %}

{% embed url="<https://www.hub.trimarcsecurity.com/post/implementing-controls-in-active-directory-protecting-against-privileged-credential-sprawl>" %}

## Admin Activities

### Best Practices:

**Enable Credential Guard GPO** - Protects secrets in memory to prevent credential theft.

**Use LAPS for Local Admins** - Randomizes passwords for local admins to prevent password reuse.

**Non-priv'd accounts for admins** - Administrators should use their own, non-privileged accounts for everyday use.&#x20;

**Disabling priv'd accounts** - DA, EA, and SA accounts should remain disabled until they are needed

**Protected Users Group** - All service accounts, admin accounts, and DA/EA/SA accounts should be put into the Protected Users group in AD.

{% embed url="<https://www.manageengine.com/products/active-directory-audit/learn/what-are-protected-user-groups-in-active-directory.html>" %}

**Least Privilege Service Accounts** - Service accounts should be privileged with only what they truly need to function

**Do not let a vendor dictate the security within your entire organization**. - We often find these accounts compromised because they are used where they shouldn’t be, such as for running tasks, services, and processes on servers along with laptops and workstations.

**Clear cached admin passwords** - If they are in Protected User group then the credentials shouldn't be cached, but it's always a good move to clear the cache with a password reset after adding them into the Protected User group.

{% embed url="<https://www.reddit.com/r/sysadmin/comments/183t9by/clearing_cached_credentials_from_all_machines/>" %}

#### 3 tiers of accounts.

* Tier 2: normal user daily productivity accounts. No administrative permissions on the domain at all. Restricted to workstation logon only, enforced via GPO.
* Tier 1: Server (non-DC) admin accounts. Elevated, but not DA, administrative permission on the domain. Restricted to server logon only, enforced via GPO.
* Tier 0: Domain admins. Restricted to DC logon only, enforced via GPO.

{% embed url="<https://posts.specterops.io/what-is-tier-zero-part-2-6e1d14fddcaf>" %}

## Credentials:

### Registry Hives:

| Hive     | Details                                                        | Format or credential material                                                                                                                                                                                           |
| -------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SAM      | stores locally cached credentials (referred to as SAM secrets) | LM or NT hashes                                                                                                                                                                                                         |
| SECURITY | stores domain cached credentials (referred to as LSA secrets)  | <p>Plaintext passwords</p><p>LM or NT hashes</p><p>Kerberos keys (DES, AES)</p><p>Domain Cached Credentials (DCC1 and DCC2)</p><p>Security Questions (<code>L$</code><em><code>SQSA</code></em><code>\<SID></code>)</p> |
| SYSTEM   | contains enough info to decrypt SAM secrets and LSA secrets    | N/A                                                                                                                                                                                                                     |

### Cleartext Protocols:

* Wdigest
* LiveSSP
* TsPkg

### LSA Secrets:

* Users passwords
* Internet Explorer passwords
* Service account passwords (Services on the machine that require authentication with secret)
* Cached domain password encryption key
* SQL passwords
* SYSTEM account passwords
* Account passwords for configured scheduled tasks
* Time left until the expiration of an unactivated copy of Windows

{% embed url="<https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets>" %}

<br>

### Worst Practices

Grant administrator privileges to all users.&#x20;

* Malware and TA tools/scripts often require admin privs
* Making all users admin on their hosts eases the TA’s job
* Privilege Access Management solutions such as BeyondTrust are useful here.

Over-provisioned service accounts.&#x20;

* Service accounts may be Domain Admin accounts (NO!!!)&#x20;
* Service accounts should be created for a specific purpose, not used anywhere.
* Third-party vendors often “require” these settings. NO! Push back on them!
* Many ransomware incidents involve service account abuse.

Mitigation:

## Logging

### Best Practices

Must be enabled:

* Servers Event ID 5140 - A network share object was accessed.
* Servers Event ID 5145 - A network share object was checked to see whether client can be granted desired access.