← All cheat sheets

ACTIVE DIRECTORY DEFENSE

Plain-text reference · 9 KB. Read it, search it (Ctrl-F) or print it.

Defensive quick reference for hardening, monitoring and responding to
attacks against Active Directory. Blue-team only: every item below detects
or prevents abuse. Test changes in a lab and stage them before enforcing
in production. Commands assume an elevated PowerShell with RSAT / the AD
and LAPS modules installed on a management host.

TIERED ADMINISTRATION#

# Keep Tier 0 (DC / AD / PKI admins) off Tier 1/2 hosts so a workstation
# compromise never exposes domain-admin credentials.
- Tier 0: DCs, AD, ADFS, PKI, Entra Connect  # admin only from a PAW
- Tier 1: servers / applications
- Tier 2: user workstations
Get-ADGroupMember "Domain Admins"            # review; should be tiny
Add-ADGroupMember "Protected Users" -Members adminUser   # see below

# Authentication Policy Silos pin Tier 0 accounts to Tier 0 hosts only
New-ADAuthenticationPolicySilo -Name T0-Silo -Enforce
New-ADAuthenticationPolicy -Name T0-Policy -Enforce
Grant-ADAuthenticationPolicySiloAccess -Identity T0-Silo -Account admin

CREDENTIAL PROTECTION#

# Protected Users group (domain functional level 2012 R2+). Members:
#  - cannot authenticate with NTLM
#  - cannot use DES or RC4 in Kerberos pre-auth (AES required)
#  - no CredSSP/WDigest plaintext caching, no long-term Kerberos keys
#  - TGT lifetime fixed at 240 min, cannot be renewed past it
# Add admins/users only. NEVER add computer or service accounts.

# Windows LAPS: unique, rotated local-admin password per machine
Update-LapsADSchema                          # one-time, Schema Admins
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=corp,DC=com"
Get-LapsADPassword -Identity PC01 -AsPlainText   # recover (support only)
Reset-LapsPassword                           # force rotation after a breach

# group Managed Service Accounts (no human-known service password)
Add-KdsRootKey -EffectiveImmediately         # lab; prod: back-date 10h
New-ADServiceAccount -Name svc01 -DNSHostName svc01.corp.com `
  -PrincipalsAllowedToRetrieveManagedPassword "SQL-Servers"
Install-ADServiceAccount svc01; Test-ADServiceAccount svc01

# Credential Guard (VBS) + LSASS as a protected process
# GPO: Turn On Virtualization Based Security > Credential Guard = Enabled
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 1
msinfo32                                      # verify "Credential Guard Running"

# Delegation: unconstrained delegation is dangerous on anything but DCs
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation
Set-ADUser admin -AccountNotDelegated $true   # "sensitive, cannot be delegated"

PRIVILEGED GROUPS AND OBJECTS TO MONITOR#

Get-ADGroupMember "Enterprise Admins"        # expect empty day-to-day
Get-ADGroupMember "Schema Admins"            # expect empty day-to-day
Get-ADGroupMember "DnsAdmins"                # can load a DLL on the DC
# AdminSDHolder / SDProp re-stamps ACLs on protected accounts hourly
Get-ADObject "CN=AdminSDHolder,CN=System,DC=corp,DC=com" -Properties nTSecurityDescriptor
Get-ADUser -LDAPFilter "(adminCount=1)"      # review orphaned adminCount=1
# krbtgt: never delete; watch its pwdLastSet (see Golden Ticket below)
Get-ADUser krbtgt -Properties pwdLastSet,msDS-KeyVersionNumber

AUDIT POLICY TO ENABLE (on all DCs, via GPO advanced audit policy)#

auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
# Also enable PowerShell script-block logging (event 4104) and process creation (4688)

KEY EVENT IDS (Security log, unless noted)#

4624 / 4625   # logon success / failure (watch type 3 network, odd hours)
4768          # Kerberos TGT requested (AS-REQ); type 0x17 = RC4 is suspect
4769          # TGS requested; RC4 (0x17) for an SPN = possible Kerberoasting
4771          # Kerberos pre-auth failed; spike = password spray / AS-REP roast
4648          # logon with explicit credentials (runas / lateral movement)
4672          # special privileges assigned to a new logon (admin logon)
4720/4722/4738 # account created / enabled / changed
4728/4732/4756 # member added to a global / local / universal security group
4662          # operation on an object; DCSync uses replication GUIDs (below)
5136          # a directory object (GPO, ACL) was modified
4697          # service installed, Security log (PsExec-style lateral)
7045          # service installed, System log (PsExec-style lateral)
1102          # the Security audit log was cleared (classic anti-forensics)

# DCSync (T1003.006) detection: 4662 with these extended-right GUIDs where
# the caller is NOT a domain controller account:
#  1131f6aa-9c07-11d1-f79f-00c04fc2dcd2  DS-Replication-Get-Changes
#  1131f6ad-9c07-11d1-f79f-00c04fc2dcd2  DS-Replication-Get-Changes-All
#  89e95b76-444d-4c62-991a-0facbeda640c  ...-Get-Changes-In-Filtered-Set
# Exclude Entra Connect / legitimate replication partners.

HARDENING: PROTOCOLS#

# SMB signing (blocks NTLM/SMB relay, T1557.001)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force
# Remove the legacy SMBv1 stack entirely
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# LDAP signing + channel binding on DCs (HKLM\...\Services\NTDS\Parameters)
# GPO: "Domain controller: LDAP server signing requirements" = Require signing
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v LDAPServerIntegrity /t REG_DWORD /d 2
# GPO: "...LDAP server channel binding token requirements" = Always (2); 1 = when supported
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" /v LdapEnforceChannelBinding /t REG_DWORD /d 2
# Watch first (Directory Service log): 2887 (unsigned binds allowed),
# 2889 (per-client unsigned bind), 3039/3074/3075 (channel binding)

# Stop LLMNR / NBT-NS poisoning (T1557.001)
# GPO: Network > DNS Client > "Turn off multicast name resolution" = Enabled
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0
# NBT-NS: set NetbiosOptions=2 per adapter, or push via DHCP option 001

AD CS (CERTIFICATE SERVICES) HARDENING#

# Turn on CA auditing (127 = all 7 categories) and restart the service
certutil -getreg CA\AuditFilter               # 0 = auditing OFF
certutil -setreg CA\AuditFilter 127
net stop certsvc && net start certsvc
# Audit template loads (events 4898/4899/4900)
certutil -setreg policy\EditFlags +EDITF_AUDITCERTTEMPLATELOAD
# ESC6: remove the attacker-friendly SAN flag if present
certutil -getreg policy\EditFlags             # look for EDITF_ATTRIBUTESUBJECTALTNAME2
certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
# Review template enrollment rights; no low-priv Enroll on auth templates

ASSESSMENT TOOLS (run against your OWN directory)#

PingCastle          # free AD risk score + report (schedule it)
Purple Knight       # free AD / Entra posture assessment (Semperis)
BloodHound CE       # map attack paths so you can cut them (blue use)
Microsoft Defender for Identity   # DC sensor: DCSync, recon, golden ticket
# Also: the "Local Administrator Password" and delegation findings above

BACKUP AND RECOVERY#

# System State backup of at least two DCs, stored offline
wbadmin start systemstatebackup -backupTarget:E:
# Golden Ticket (T1558.001) containment: reset krbtgt TWICE, waiting for
# full replication AND past the max TGT lifetime (default 10h) between
# resets, so both current and previous keys are rotated out.
# Maintain an offline, tested AD Forest Recovery runbook (rebuild order,
# metadata cleanup, krbtgt reset, DNS, FSMO seizure).

REFERENCES#

# Microsoft Learn: Protected Users, Windows LAPS, LDAP signing/channel
#   binding (KB4520412), Securing privileged access (tier model)
# NSA / CISA: "Detecting and Mitigating Active Directory Compromises" (2024)
# MITRE ATT&CK: T1558 (Kerberos ticket abuse), T1003.006 (DCSync),
#   T1557.001 (LLMNR/NBT-NS + SMB relay), T1484 (domain policy modification)

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.