Active Directory Security

Scanner legend

Quick rule: the scanners see AD objects, ACLs, GPO existence and permissions, SYSVOL scripts, and (Guerrilla) a good share of GPO contents and relay preconditions. None of them sees user-rights assignments as they land on a DC, which servers inherit which GPOs because of where they sit, stored task passwords, service logon accounts, NTFS ACLs on script folders on member servers, missing updates, or anything in Google. Phases 4, 6 and 8 are mostly MANUAL; run every scanner anyway, because the rows they do cover are the ones that are easiest to miss by hand.

What each scanner reads

Scoring trap: PingCastle's global score is the highest of its four category scores, not a sum. Fixing ten small items in one category does nothing to the score if another category still has a 50-point finding. Use the score as a lagging indicator; fix attack paths, not points.

Before you start

Phase 0: Inventory (what to read before changing anything)

One day of reading finds the paths that matter. Do all of these before Phase 1; Recipe R1 has the commands.

Gate: inventory written down, backup taken, break-glass account tested from the admin host, pilot OU chosen.

Phase 1: Privileged accounts and tiering

Gate: admin group membership matches the written list; every removed account has adminCount cleared; break-glass signs in from the admin host; deny-logon GPO verified present on a workstation and absent on a DC.

Phase 2: Authentication protocols

Gate: 30 days of NTLM and LDAP audit reviewed and every legacy source named; copiers and appliances moved to LDAPS/NTLMv2 or isolated; no 4769 with 0x17 from a Windows client.

Phase 3: Group Policy and SYSVOL

Gate: RSOP on both DCs shows default user rights; SYSVOL ACL and ownership identical on every DC; no cpassword hits; every Enforced link documented.

Phase 4: Tier 0 servers, hypervisors and backups

Tier 0 is anything that can yield a DC: the DCs, the hypervisors that run them, the backup server and its repository, the Entra Connect server, any server holding ntds.dit copies, and (for driver reasons, Phase 5) the print server. Treat all of them like DCs.

Gate: every Tier 0 host patched to the current cumulative update; local Administrators on each = Domain Admins plus documented service accounts; weekly AD backup produced output twice; no object left in CN=Computers.

Phase 5: Workstations

Gate: LAPS password readable for every pilot PC; Point-and-Print pilot building one week with no prompts; no long host names without SPNs; firewall rules verified from a student VLAN.

Phase 6: Service accounts, scheduled tasks and applications

Gate: Recipe R1's task and service query returns only svc-, gMSA and built-in accounts; every svc- account documented with owner, host and purpose.

Phase 7: Directory hygiene

Gate: zero enabled accounts inactive over 180 days; zero pwdLastSet=0 on enabled accounts; FGPPs in place; CN=Users holds only built-ins; BitLocker export file verified readable.

Phase 8: Cloud sync boundaries (Entra Connect, Google sync)

Gate: Entra Connect scope documented; no sync tool exists without an owner; a bulk test delete of one disabled test user and one disabled test computer produces the expected (and only the expected) cloud effect.

Phase 9: Detection

Gate: a test DCSync (DSInternals Get-ADReplAccount -SamAccountName <test> -Server <dc> run from the admin host by an account holding replication rights) produces an alert within the hour; a test addition to Domain Admins produces an alert; the helpdesk runbook is written.

Phase 9a: Seams the review surfaced

These close the gaps between the two directories, between "detect" and "respond", and in the threat model itself. The attacker's agent never touches your endpoints; it reaches you over LDAP, SMB, Kerberos and HTTPS with credentials it harvested, and its command-and-control is a legitimate AI API. Everything here assumes that: the sync server and the backup server as Tier 0, servers that cannot reach the internet, the devices that are not Windows, decoys in the places an agent looks first, automated response on the rules that are never legitimate, and the procedures a vishing call and a real compromise actually test.

The sync bridge and the backup server

Egress and DNS from the server side

Wired access and the devices that are not Windows

Finding the agent after it is in

The procedure the vishing simulation tests

Recovery you have actually rehearsed

Gate: sync and backup servers in the Tier 0 OU or off-domain; server VLAN egress in enforce mode with the deny log reviewed; one honeytoken of each kind placed and its alert tested; the baseline diff has run for four weeks; the verification procedure is written and the help desk has been tested against it; the rotation runbook is printed; one forest-recovery rehearsal timed.

Phase 10: Keep it that way

Recipes

R1: Inventory pass

# Effective user rights (run on each DC, one hypervisor, one server, one workstation)
Get-CimInstance -Namespace root\rsop\computer RSOP_UserPrivilegeRight |
  Select-Object UserRight, AccountList, GPOID | Sort-Object UserRight
# Domain-root and Enforced links
Get-GPInheritance -Target (Get-ADDomain).DistinguishedName | Select-Object -Expand GpoLinks
Get-GPO -All | % { $r=[xml](Get-GPOReport $_.Id -ReportType Xml); $r.GPO.LinksTo | ? NoOverride -eq 'true' | Select @{n='GPO';e={$r.GPO.Name}},SOMName }
# Privileged group membership with password age
foreach ($g in 'Domain Admins','Enterprise Admins','Schema Admins','Administrators',
         'Group Policy Creator Owners','Account Operators','Server Operators',
         'Backup Operators','Print Operators','DnsAdmins','Protected Users') {
  Get-ADGroupMember $g -Recursive -ErrorAction SilentlyContinue | Get-ADUser -Properties PasswordLastSet,LastLogonDate,Enabled,Description,adminCount |
    Select-Object @{n='Group';e={$g}},SamAccountName,Enabled,PasswordLastSet,LastLogonDate,adminCount,Description
}
# Local Administrators, stored-credential tasks, domain-account services, patch level on every server
$servers = (Get-ADComputer -Filter {OperatingSystem -like '*Server*' -and Enabled -eq $true}).DNSHostName
Invoke-Command -ComputerName $servers -ErrorAction Continue {
  [pscustomobject]@{
    Host     = $env:COMPUTERNAME
    Admins   = (Get-LocalGroupMember Administrators).Name -join ';'
    Tasks    = (Get-ScheduledTask | ? { $_.Principal.LogonType -eq 'Password' -and $_.Principal.UserId -match '\\' } |
                % { "$($_.TaskName)=$($_.Principal.UserId)" }) -join ';'
    Services = (Get-CimInstance Win32_Service | ? StartName -match '^(?!LocalSystem|NT AUTHORITY|NT SERVICE|$)' |
                % { "$($_.Name)=$($_.StartName)" }) -join ';'
    Build    = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild + '.' +
               (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
    AU       = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue).AUOptions
  }

} | Export-Csv servers-inventory.csv -NoTypeInformation

# Default containers
Get-ADComputer -SearchBase "CN=Computers,$((Get-ADDomain).DistinguishedName)" -Filter * -Properties OperatingSystem,LastLogonDate
Get-ADUser -SearchBase "CN=Users,$((Get-ADDomain).DistinguishedName)" -Filter {Enabled -eq $true} -Properties LastLogonDate

# SYSVOL / NETLOGON ACL and ownership, per DC
foreach ($dc in (Get-ADDomainController -Filter *).HostName) {
  icacls "\\$dc\SYSVOL\$env:USERDNSDOMAIN\scripts"
  Get-ChildItem "\\$dc\SYSVOL\$env:USERDNSDOMAIN\Policies" -Recurse | Get-Acl | Group-Object Owner | Select Count,Name
}

# After removing an account from a protected group
Set-ADUser <sam> -Clear adminCount
$acl = Get-Acl "AD:\$((Get-ADUser <sam>).DistinguishedName)"
$acl.SetAccessRuleProtection($false, $true); Set-Acl "AD:\$((Get-ADUser <sam>).DistinguishedName)" $acl

R2: Editing a GPO or SYSVOL directly (when the GroupPolicy module is unavailable or double-hops)

1. Back up: copy the GPO's SYSVOL folder and Get-ADObject <gPC DN> -Properties * to a dated folder.
2. Edit on the PDC emulator: GptTmpl.inf (UTF-16LE), Registry.pol (binary "PReg" format; use a proper writer), or GPP XML.
3. Bump versionNumber on the gPC object and in GPT.INI: +1 for a machine-side change, +65536 for a user-side change. Clients skip a GPO whose version did not change.
4. repadmin /syncall <pdc> <domain DN> /e /d /A /P, then confirm the version and file contents on every other DC.
5. gpupdate /target:computer /force on a test machine; verify with RSOP (user rights) or gpresult /h.
6. For permission changes under SYSVOL: apply on each DC's UNC path and read back on each. Do not assume DFSR carried the ACL.
7. Deleting a GPO by hand: unlink from every gPLink, Remove-ADObject -Recursive on the gPC, then delete the SYSVOL folder on the PDC.

R3: Protected Users rollout

1. Inventory every use of each admin account (Recipe R1: tasks, services; plus application credential stores, RDP sessions via query user /server:<host>, 4768 source IPs via R13).
2. Move every task and service to a service account (R5). Give applications that authenticate over NTLM their own admin login. Give the backup product its own account.
3. Create the break-glass account (Before you start) and test it from the admin host.
4. Add one admin to Protected Users. Wait a day. Read the DC Security log for 4776 and 4625 with 0xC000006E and 4771 with 0x18 for that account; each source host is something still using NTLM or an old password. Fix it (FQDN, SPN, service account, log off the stale session).
5. Repeat for each admin, including the built-in Administrator last.
6. Tell every admin: FQDN only; expect to re-authenticate every 4 hours in long sessions; never klist purge; a stale disconnected RDP session will generate pre-auth failures until it is logged off.
7. Set a disconnected-session time limit on servers (Set time limit for disconnected sessions, Remote Desktop Session Host › Session Time Limits) so stale sessions stop accumulating.

R4: Deny admin logon to workstations

1. New GPO, user configuration disabled. Computer Configuration › Policies › Windows Settings › Security Settings › Local Policies › User Rights Assignment: - Deny log on locally, Deny log on through Remote Desktop Services, Deny log on as a batch job, Deny log on as a service = Domain Admins, Enterprise Admins (add the -adm accounts' group if it is separate). - Leave Deny access to this computer from the network unset for these groups.
2. Link at the workstation OU only. Verify the link list does not include servers, DCs, or a parent of either.
3. Verify on one workstation (RSOP_UserPrivilegeRight shows four SeDeny* entries), one server and one DC (none).
4. Give each admin a non-privileged account in the workstation-admin group for hands-on work at a PC.

R5: Service account for a scheduled task

# AD side
New-ADUser svc-<purpose> -Path "OU=Service Accounts,<domain DN>" -AccountPassword (Read-Host -AsSecureString) `
  -Enabled $true -PasswordNeverExpires $true -CannotChangePassword $true -KerberosEncryptionType AES256
Set-ADUser svc-<purpose> -LogonWorkstations '<host>'
# Host side (elevated)
icacls C:\Scripts\<purpose> /grant "DOMAIN\svc-<purpose>:(OI)(CI)M"
# Grant "Log on as a batch job": secedit export, add the SID to SeBatchLogonRight, secedit import; or Local Security Policy GUI
# Task: Register-ScheduledTask ... -User DOMAIN\svc-<purpose> -Password <pw> (LogonType Password)

Prefer a gMSA where the task is PowerShell or a service that supports it. Once per forest, a KDS root key must exist (Add-KdsRootKey). Then New-ADServiceAccount gmsa-<purpose> -DNSHostName gmsa-<purpose>.<domain> -PrincipalsAllowedToRetrieveManagedPassword <host>$ (name 15 characters or fewer; -DNSHostName is the gMSA's own name, not the host's); grant it Log on as a batch job on the host; Install-ADServiceAccount on the host; task principal DOMAIN\gmsa-<purpose>$ with no password.

R6: Windows LAPS

1. On the schema master, as a member of Schema Admins (add yourself, get a fresh ticket by signing out and in, remove yourself afterwards): Update-LapsADSchema.
2. Set-LapsADComputerSelfPermission -Identity "OU=Workstations,<domain DN>" and the same for the server OU.
3. GPO (Computer Configuration › Administrative Templates › System › LAPS): Configure password backup directory = Active Directory; Password Settings = complexity 4, length 24, age 30; Post-authentication actions = Reset the password and log off the managed account, 24 hours; Enable password encryption = Enabled (2016 DFL+); Configure authorized password decryptors = Domain Admins or the helpdesk group.
4. Link to the pilot OU; gpupdate; Get-LapsADPassword <computer> -AsPlainText from the admin host.
5. Delegate Get-LapsADPassword read to the helpdesk group with Set-LapsADReadPasswordPermission. With encryption on, the helpdesk must also be the authorized decryptor, which takes a single principal: use one group that holds both Domain Admins and the helpdesk.

R7: Point and Print, done in the right order

1. On the print server: Get-PrinterDriver | Select Name, Manufacturer and the driver package paths (Get-PrinterDriver | Select InfPath).
2. Push the packages to every PC in machine context: pnputil /add-driver <inf> /install then Add-PrinterDriver -Name "<exact model name>" for each name in step 1, via the endpoint tool or a SYSTEM startup task. Verify Get-PrinterDriver on a sample of PCs lists every name.
3. GPO: Package Point and print - Approved servers = print server FQDN; Point and Print Restrictions = Enabled, users can only point and print to these servers, When installing drivers for a new connection = Do not show warning or elevation prompt is removed, i.e. NoWarningNoElevationOnInstall=0, UpdatePromptSettings=0; Limits print driver installation to Administrators = Enabled (RestrictDriverInstallationToAdministrators=1).
4. Link to one building OU for one week. Watch for "Printer driver software installation" UAC prompts and Group Policy Printers errors in the Application log.
5. Roll out. Keep a rollback copy of the GPO.
6. Independently (no user impact): Allow Print Spooler to accept client connections = Disabled on workstations and servers with a Deny-Apply ACE for the print server; spooler disabled on DCs, hypervisors and non-printing servers.

R8: DC backups

Tier 1: VM-level (the one you will restore from).

1. In the backup product, the DC VMs get application-aware (VSS) processing so the directory database is quiesced; verify the job log shows the VSS writer for NTDS succeeded.
2. Repository: immutable (object lock) or an offline/air-gapped copy; the backup service account is svc-backup, never a human admin (Phase 4).
3. Restore test annually into an isolated network. Never revert a DC VM to a hypervisor checkpoint.

Tier 2: system state (the authoritative-restore path).

4. On one DC (the PDC is fine): scheduled task as SYSTEM, wbadmin start systemstatebackup -backupTarget:\\ <tier0 share> -quiet, weekly. Share and NTFS: SYSTEM and Domain Admins only; the DC's computer account Modify.
5. Confirm its last-success date monthly (wbadmin get versions). This is the job that silently stops.

Tier 3: object-level exports (restore one thing without touching the DC).

6. Weekly script on the PDC as SYSTEM: Backup-GPO -All -Path <stage>\GPO; Get-GPOReport -All -ReportType Html; ldifde -f <stage>\domain.ldf -d "<domain DN>" -p subtree; CSV exports of users, groups, memberships, computers, OUs; INVENTORY.txt with FSMO roles, sites, subnets, trusts, password policy, DNS zones, counts; SHA-256 manifest; README with restore steps; robocopy to a Tier 0 share; prune older than 60 days.
7. Allow the script's hash in application control before the first run. Monday after: read the log, confirm the folder exists and is the expected size.

Optional and not generally advised: IFM.

8. ntdsutil "activate instance ntds" ifm "create sysvol full <stage>" quit quit produces a full ntds.dit plus SYSTEM/SECURITY hives: every hash, as files. Only take it if you have a stated forensic need (offline mount with dsamain -dbpath <copy> -ldapport 51389, which exists only on a DC or AD LDS server), keep it on a DC or an encrypted Tier 0 volume, and delete it on a schedule. It satisfies the scanners' backup-age rule, but so do tiers 1 and 2, so that is not a reason.

R9: Retiring student accounts (or any bulk delete) safely

1. List every system that reads the OU: Entra Connect (OU filter), GCDS (config), print management, library, cafeteria, LMS, RADIUS/NPS, any script. For each: does it delete, suspend or disable on sync? Neutralise or re-scope before deleting.
2. Confirm Google student accounts are provisioned from the SIS, not from AD.
3. Confirm no NPS/RADIUS server exists that authenticates Wi-Fi against student AD accounts.
4. Confirm the only GPOs linked to the student OU affect nothing else.
5. Export: every user (DN, GUID, memberOf, attributes) to CSV; every BitLocker key under every computer to be deleted; Backup-GPO -All; a system-state backup (R8 tier 2).
6. Confirm the Recycle Bin is on and msDS-DeletedObjectLifetime (blank means it equals tombstoneLifetime) is 180 days.
7. Delete in batches with Remove-ADObject -Recursive from the PDC; keep the result CSV (DN, GUID, status).
8. Keep OUs and groups unless nothing references them; remove the GPO links that now apply to nothing.
9. Expect: ntds.dit does not shrink until an offline defrag; Entra shows a large delete if the scope included the objects; sync tools re-scoped in step 1 do nothing.

R10: SPNs for host names over 15 characters

Get-ADComputer -Filter {Enabled -eq $true} -Properties DNSHostName,ServicePrincipalName |
  ? { ($_.DNSHostName -split '\.')[0].Length -gt 15 } | % {
    $c    = $_
    $full = ($c.DNSHostName -split '\.')[0]
    $add  = @("HOST/$full","RestrictedKrbHost/$full") | ? { $c.ServicePrincipalName -notcontains $_ }
    if ($add) { Set-ADComputer $c -ServicePrincipalNames @{Add=[string[]]$add} }
  }

Safe to re-run. Add to the weekly staging-OU check, or cap names at 15 characters at imaging.

R11: Finding plaintext credentials in script and export folders

# Files whose first line looks like a header with a password column
Get-ChildItem C:\Scripts,C:\Tools,C:\Automation -Recurse -Include *.csv,*.txt,*.text,*.log -ErrorAction SilentlyContinue |
  ? { (Get-Content $_.FullName -First 1 -ErrorAction SilentlyContinue) -match '(?i)pass(word|wd)' } |
  Select-Object FullName, Length, LastWriteTime
# Who can read the folder
icacls C:\Scripts
# Service-account keys, DPAPI blobs, private keys
Get-ChildItem C:\Scripts -Recurse -Include *.json,*.cred,*.ppk,*.pem,*.key,.env* | Select FullName

For each hit: is it still produced? (If the producer is dead, delete the archive.) Who reads it? (ACL to that account only.) Can the producer stop writing the column? (Usually yes.)

R12: Helpdesk delegation groups

Apply with Set-Acl on an AD: drive pinned to one DC (-Server), then repadmin /syncall. Export each container's SDDL before and after. The technician signs out fully before testing; a reconnected session keeps the old token.

R13: DCSync rights and admin credential locations

# Who can replicate
$dn = (Get-ADDomain).DistinguishedName
(Get-Acl "AD:\$dn").Access | ? { $_.ObjectType -in '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2','1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' } |
  Select IdentityReference, ObjectType, AccessControlType
# AdminSDHolder write access (should be built-ins only)
(Get-Acl "AD:\CN=AdminSDHolder,CN=System,$dn").Access | ? { $_.ActiveDirectoryRights -match 'Write|GenericAll' } | Select IdentityReference,ActiveDirectoryRights

# Where admin passwords are typed (TGT requests by source IP), last 7 days, all DCs
$admins = (Get-ADGroupMember 'Domain Admins' -Recursive).SamAccountName
foreach ($dc in (Get-ADDomainController -Filter *).HostName) {
  Get-WinEvent -ComputerName $dc -FilterHashtable @{LogName='Security';Id=4768;StartTime=(Get-Date).AddDays(-7)} |
    ? { $_.Properties[0].Value -in $admins } |
    Select @{n='User';e={$_.Properties[0].Value}}, @{n='IP';e={$_.Properties[9].Value}}, TimeCreated
} | Group User, IP | Select Count, Name

# NTLM refused by Protected Users (0xC000006E) by account and source
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4776} -MaxEvents 5000 |
  ? { $_.Properties[-1].Value -eq '0xc000006e' } | Group { "$($_.Properties[1].Value) from $($_.Properties[2].Value)" } | Select Count,Name

Gotchas: what breaks when you turn things on

Rollout order

Pilot (one server, one building OU) › Tier 0 servers › remaining servers › workstation OUs by building

Each step waits for the previous step's gate.

1. Before you start and Phase 0 (read, back up, break-glass, baseline PingCastle). One day.
2. Phase 3 user rights and SYSVOL ACLs, Phase 1 admin group cleanup, Phase 6 dead stored-password tasks: under an hour each, zero user impact, each closes a critical path. Do these the same week.
3. Phase 4 tiering: redircmp, servers into OUs, local admins on Tier 0, Entra Connect cleanup, patch policy and a patch window.
4. Phase 6 service accounts for everything that runs as a human.
5. Phase 1 Protected Users, one admin at a time, after step 4.
6. Phase 1 deny-logon GPO and separate -adm accounts.
7. Phase 4 backups: VM-level with application-aware processing, system state on a DC, exports; confirm two runs of each; delete any IFM job nobody can justify.
8. Phase 5: LAPS, spooler inbound block, firewall; Point-and-Print only after driver pre-staging.
9. Phase 2 protocol hardening with its audit periods (NTLM, LDAP, SMB, RC4), copiers and appliances fixed as they surface.
10. Phase 7 hygiene and Phase 8 sync boundaries; student retirement if applicable.
11. Phase 9 detection, in parallel from step 3 so the retests themselves show up in the logs.
12. Phase 1 Authentication Silos and Phase 2 armoring, audit mode first, last of all.
13. Phase 10 on the calendar.

DCs vs. servers vs. workstations at a glance

Group Policy paths and PingCastle rule names move between releases. If one is wrong, open an issue or PR.