This document provides tips and best practices for securing an Active Directory environment, including mitigating pass-the-hash attacks, restricting privileged user access, enabling Kerberos authentication, running an enterprise CA, disabling anonymous access, implementing security monitoring, using read-only domain controllers, backing up data, auditing the environment, and staying informed of the latest threats. It discusses technical approaches for hardening Active Directory against common attacks while maintaining usability.

1. Securing Your Data in an Open
World
Developing a Secure Active Directory

2. INTRODUCTION

3. Agenda
Risks
Mitigations
ValidationandAuditing
TipsfromtheField

4. PASS THE HASH
Convenienceof SSOat cost of additional risk.
What makesa“hash” inthiscontext?
h= 𝑓(𝑥)
PredatesWindowsNT3.1but still verymuchapplicabletoday.
Astolenhashcreatesthepotential for impersonation.
Astolenhashinheritsanyauthorizationsgrantedtotheaccount.

5. PASS THE HASH
BASIC SCENARIO
BoblogsontoCORPBOB-E550.
WindowsSAMstoreshishashinkernel memory.
AlicelogsonremotelytoBOB-E550.
Aliceisamember of BUILTINAdministrators.
Aliceperformsamemorydumpof BOB-E550fromanelevatedprocess.
Aliceexfiltratesthememorydumptoher workstationusingSMB.
AliceextractsBob’shashfromthememorydumpoffline.

6. PASS THE HASH
BASIC LESSONS
Limitingopportunitiesfor untrustedprocessestoelevateisimportant.
User AccessControl (UAC) isafirst lineof defense.
What if BobwasaDomainAdmin?
If Alicehaslocal admin, doyoutrust AliceenoughtoseeeverythinginRAMonthat
system.
If wecan’t protect auser’sidentity, theconcept of identityor authenticationonour
networkisweakened.

7. PASS THE HASH
CROSS-SYSTEM
PC-AandPC-Bbothhavealocal user named“helpdeskadmin”
Theplaintext passwordfor .helpdeskadminisTr1viAl&triNg.
Theequivalent hashfor theaccount isthesameonbothmachines.
Acompromiseof thehashbyaprocessonPC-Acanbeusedtoattackanyother
Windowshost that hasthat sameusernameandpasswordcombination, evenwithout
knowledgeof theplaintext password.

8. PASS THE HASH
CROSS-SYSTEM LESSONS
Again, processelevationcreatestheopportunity.
Diversificationof local user passwordsacrossmachinesisimportant.
SeeMSKB3062591: Local Administrator PasswordSolution(LAPS)
Bewareprevioussolutions; not all similar solutionsusesecurecommunicationsfor
storingthelocal adminpassword.
Restrict remotelogonof local accountswhereit isn’t needed.

9. PASS THE HASH
RECENT DEVELOPMENTS
Windows10/Server 2016introducesIsolatedUser Mode.
StoreNTLMhashesinavirtualizedmicro-kernel.
Hypervisor executingthemicro-kernel actsasagatekeeper.
Limitedimplementationdetailsavailable.
Concernsof howmuchprotectionthisreallyprovides.
Ultimately, will needtobeauditedandtestedbeforeweknow.

10. LANMAN and NTLM
For compatibility, ADcanstill communicateusingLMor NTLM.
Bothhaveknownandeasytoexploit weaknesses.
Allowingolder protocolscreatesopportunityfor downgradeattacks.
Similar toSSL/TLSdowngradeattackspopular in2014.
GroupPolicycanbeusedtorestrict or eliminateuseof NTLM.

11. LMv1 and NTLMv1
Source: SANS Digital Forensics
http://bit.ly/1JXjuuG

12. PRIVILEGED GROUPS AND USERS
BEST PRACTICES
DisableBUILTINAdministrator.
Disablenetworklogonfor thelocal administrator account .
Donot performday-to-dayactivities aswithyour adminaccount.
Donot keepusersinEnterpriseor SchemaAdmins.
Donot logontoclient systemswithprivilegednetworkaccounts.
Don’t disablepasswordexpirationonprivilegedaccounts.
Don’t useDomainAdminasashortcut for domain-wideneeds.

13. KERBEROS
Providesenhancedauthenticationarchitectureandcryptography.
Not aPass-the-Hashmitigation; seePass-the-Ticket.
Keepingyour entireWindowsenvironment patchediskeytomaintainingasecure
Kerberosenvironment.
Vectorsexist whereKerberostickets areforged; SeeMS14-068.
Kerberos, likeanymanyprotocols, requiresiterationtoimproveitssecurityandso
wemustpatch.

14. Source: SANS Digital Forensics
http://bit.ly/1JXjuuG

15. ENTERPRISE CA
WhyrunanEnterpriseCA?
For existingWindowsCAs, implicationsof SHA-1deprecation.
http://bit.ly/mscasha1to2
AWindowsCAisnot fire-and-forget; it needsmaintenance, too.

16. ANONYMOUS BINDS & ENUM
EnabledonmanydomainsupgradedfromNT/Server 2000.
Anonymousbindoff bydefault inServer 2003andlater for newdomains.
Easyintelligencesourcefor hostileactors.
For binds, modifydsHeuristicsobject inaneditor likeADSI.
For enumeration, aGroupPolicysettingexists.
Canimpact pre-2000clientsanddomaintrust functionality.
Needtounderstandwhat reliesonanonymousaccesstoday.
Maynot befeasibletodisable; part of thehardeningprocess.

17. MONITORING
Whenactivedefensefails, apassiveapproachcanhelp.
Changestoprivilegedgroups(integritymonitoring).
InvalidattributesinKerberosrequests.
Presenceof NTLMautheventsSecuritylog.
Statistical anomalies(Fail Audit volume, request volume, lockouts).
SecurityInformationandEvent Management productsexist for this.
AD/ NTFSAuditingisextremelyvaluableif configuredwell.

18. READ-ONLY DCs
ManyassociateRODCs withbranchofficesor poor connectivity.
Anoptionfor providingLDAPdatainpotentiallyhostileor untrustedenvironments:
Lowphysical security.
Multi-tenant environments.
Canrestrict thereplicationof passwordhashestoRODCs.
Why?Offlineattacksafter physical loss.
Bythesametoken, must physicallysecurewriteableDCs’ disksandtheirbackups.

19. DATA PROTECTION
Not anactiveprotection, but likeanydata, abackupisequallycritical.
Whilenot exactlyasecuritytopic, it isoftenoverlooked.
It’snot enoughtosnapshot your virtual DCs.
Infact, it’sdangerousif theDCisanythingolder than2012R2.
AWindowsSystemStatebackupof anyDCwill backuptheADdatabase.
Several agent-basedbackupproductscancapturethesystemstate.

20. AUDIT AND VALIDATION
All of thesemeasuresarehelpful, but lessmeaningful without validation.
Thirdpartyfirms.
Microsoft Consultingopportunities.
SaaSvulnerabilityscanningservices.
In-housetesting(MBSA).

21. OTHER TIPS
EnforceCTRL+ALT+DELasthesecurekeystrokeonclients.
Avoidusingwebbrowsersonservers.
Inspect softwarethoroughlybeforeexecutingonaserver.
Don’t disabletheWindowsFirewall.
Don’t disableUAConanyWindowssystemsif it canbeavoided.

22. STAY INFORMED
Attendsecuritysessionsat conferences(MSIgnite, VMworld, etc).
EngagewithanITsecurityprovider whereit makessensefor you.
Monitor consistent, well-maintainedsources:
US-CERT(us-cert.gov)
SANSISC(isc.sans.edu) andThreat Level status.
Microsoft Technical SecurityNotifications(http://bit.ly/mssecnot)
Talkabout securitywithinyour organizations.

23. Thank You