Active Directory Security Checklist
Active Directory Security Checklist
A practical checklist for reviewing common Active Directory security risks, hardening priorities, and operational weaknesses.
This checklist is designed for administrators, consultants, and defenders who need a structured way to review Active Directory security posture. It focuses on practical controls that reduce common attack paths, improve identity hygiene, and make risky configurations easier to find.
Prioritize Tier 0
Start with domain controllers, privileged accounts, certificate services, and systems that can control identity.
Reduce Attack Paths
Review delegation, NTLM relay exposure, Kerberos weaknesses, excessive privileges, and weak object permissions.
Improve Hygiene
Clean up stale accounts, reduce legacy settings, rotate service account passwords, and remove unnecessary access.
Monitor Changes
Track changes to privileged groups, delegation settings, domain controllers, Group Policy, and certificate templates.
Domain Controllers
Domain controllers are among the most sensitive systems in an Active Directory environment. Protect them as Tier 0 assets.
- Limit interactive logon to domain controllers to authorized Tier 0 administrators only.
- Require strong administrative authentication for all domain controller management.
- Keep domain controllers fully patched and running supported operating systems.
- Disable unnecessary services and roles on domain controllers.
- Restrict internet access and general browsing from domain controllers.
- Ensure domain controllers are not used as general-purpose file, print, application, or management servers.
- Require LDAP signing on domain controllers where feasible.
- Review LDAP channel binding settings and work toward enforcement after testing.
- Require SMB signing on domain controllers.
- Monitor changes to domain controller computer objects, security settings, and privileged group membership.
Privileged Access
Privileged accounts are high-value targets. Reduce the number of privileged identities and limit where they can be used.
- Review membership of Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Server Operators, and Backup Operators.
- Remove unnecessary standing administrative access.
- Use separate administrative accounts for privileged work.
- Prevent privileged accounts from logging into lower-trust workstations and servers.
- Mark privileged accounts as sensitive and not delegable where appropriate.
- Consider Protected Users group membership for suitable privileged accounts after testing compatibility.
- Require strong passwords or passphrases for privileged accounts.
- Monitor privileged group membership changes.
- Review delegated permissions on organizational units and sensitive objects.
- Document all accounts with Tier 0 administrative capability.
Authentication Policy
Authentication settings affect how easily attackers can reuse, relay, crack, or abuse credentials.
- Enforce strong password policy and review fine-grained password policies.
- Review account lockout policy for reasonable protection against password guessing.
- Identify accounts with passwords that never expire.
- Identify accounts with old passwords, especially privileged and service accounts.
- Review accounts configured with reversible encryption.
- Review disabled accounts and remove or archive accounts that are no longer needed.
- Review stale enabled user accounts.
- Review authentication from unusual systems or unexpected locations.
- Reduce reliance on shared administrative accounts.
- Review legacy applications that require weak authentication behavior.
Kerberos Security
Kerberos is central to Active Directory authentication. Weak Kerberos settings can create offline cracking and impersonation paths.
- Identify accounts with Kerberos preauthentication disabled.
- Enable Kerberos preauthentication unless a documented exception exists.
- Find user accounts with Service Principal Names.
- Review service accounts with old or weak passwords.
- Review service accounts that support RC4 encryption.
- Prefer AES encryption where supported.
- Move eligible services to group Managed Service Accounts.
- Monitor Kerberos service ticket requests for unusual volume or RC4 usage.
- Rotate high-risk service account passwords.
- Review Kerberos ticket lifetime settings and align them with operational needs.
NTLM, LDAP, and SMB Protections
Relay-resistant authentication requires layered controls. NTLM, LDAP, and SMB settings should be reviewed together.
- Inventory NTLM usage before attempting broad NTLM restrictions.
- Identify systems and applications that still rely on NTLM.
- Require SMB signing on domain controllers and sensitive servers.
- Require LDAP signing on domain controllers where feasible.
- Review LDAP channel binding settings and enforce after compatibility testing.
- Use LDAPS or StartTLS for simple LDAP binds.
- Disable LLMNR and NBT-NS where feasible.
- Review WPAD exposure and proxy auto-discovery behavior.
- Harden AD CS web enrollment endpoints against NTLM relay.
- Monitor NTLM authentication patterns, especially to domain controllers and certificate services.
Kerberos Delegation
Delegation should be rare, documented, and limited. Unnecessary delegation can create serious impersonation paths.
- Identify non-domain-controller systems trusted for unconstrained delegation.
- Remove unconstrained delegation wherever it is not explicitly required.
- Review accounts configured for constrained delegation.
- Review constrained delegation targets and remove unnecessary SPNs.
- Identify accounts using protocol transition.
- Remove protocol transition unless the application requires it.
- Identify objects with resource-based constrained delegation configured.
- Review permissions on computer objects that could allow RBCD abuse.
- Protect privileged accounts from delegation.
- Monitor changes to delegation-related attributes.
Service Accounts
Service accounts often have long-lived passwords, unclear ownership, and more access than they need.
- Inventory all service accounts and assign ownership.
- Identify service accounts with SPNs.
- Identify service accounts with privileged group membership.
- Review service accounts with passwords older than one year.
- Use group Managed Service Accounts where supported.
- Remove interactive logon rights from service accounts where possible.
- Restrict service accounts to the systems and applications that require them.
- Review service accounts configured for delegation.
- Remove unused service accounts.
- Monitor service account password and SPN changes.
Computer Accounts
Stale and misconfigured computer accounts can create unnecessary attack surface and operational confusion.
- Identify stale computer accounts that have not authenticated recently.
- Disable stale computer accounts before deleting them.
- Review computer accounts with old passwords.
- Review computer accounts with delegation configured.
- Review computer object ACLs for unexpected write permissions.
- Review systems with unsupported operating systems.
- Review systems missing endpoint management or patching coverage.
- Review MachineAccountQuota and reduce it if ordinary users do not need to create computer accounts.
- Monitor new computer account creation.
- Maintain a process for computer account cleanup after decommissioning.
Group Policy
Group Policy can enforce strong controls or introduce broad risk. Review both policy content and who can modify it.
- Review who can create, edit, link, and delete Group Policy Objects.
- Review GPOs linked to domain controllers and Tier 0 organizational units.
- Remove unused or duplicate GPOs after validation.
- Review security filtering and WMI filtering for unexpected scope.
- Review policies that configure local administrators.
- Review policies that configure user rights assignments.
- Review policies that weaken authentication, auditing, firewall, or security baseline settings.
- Ensure legacy Group Policy Preferences passwords are not present.
- Monitor changes to high-impact GPOs.
- Back up important GPOs before major changes.
Active Directory Certificate Services
AD CS can introduce powerful privilege escalation paths when certificate templates, enrollment rights, or CA settings are misconfigured.
- Inventory all enterprise certificate authorities.
- Review certificate templates that allow client authentication.
- Review who can enroll in high-impact certificate templates.
- Identify templates where enrollee supplies subject information.
- Review templates with weak manager approval or authorization controls.
- Review certificate template ACLs for excessive write permissions.
- Review CA permissions and certificate manager permissions.
- Harden or remove AD CS web enrollment services if they are not required.
- Enable Extended Protection for Authentication where appropriate on enrollment endpoints.
- Monitor certificate template changes, CA configuration changes, and unusual certificate enrollment activity.
Logging and Monitoring
Strong configuration is important, but defenders also need visibility into meaningful changes and suspicious behavior.
- Collect security logs from domain controllers.
- Monitor privileged group membership changes.
- Monitor user, computer, and service account changes.
- Monitor Kerberos authentication events, including service ticket requests.
- Monitor NTLM authentication usage.
- Monitor LDAP signing and channel binding events.
- Monitor changes to delegation-related attributes.
- Monitor Group Policy changes.
- Monitor certificate template and CA configuration changes.
- Review alert coverage for common Active Directory attack paths.
Backup and Recovery
Active Directory recovery planning is essential. A secure environment still needs a tested recovery path.
- Maintain system state backups for domain controllers.
- Protect AD backups from unauthorized access.
- Store recovery credentials securely and separately from normal administrative accounts.
- Document forest recovery procedures.
- Test domain controller restore procedures in a safe environment.
- Review backup operator permissions.
- Protect backup infrastructure as Tier 0 if it can restore or control domain controllers.
- Ensure AD recovery plans account for ransomware scenarios.
- Review dependencies such as DNS, PKI, time services, and identity-integrated applications.
- Validate that backups are usable, not just present.
Use Carefully
Validate before making production changes.
This checklist is intended as educational guidance. Active Directory environments vary widely, and some settings may affect legacy systems, applications, or business workflows. Review, test, and document changes before applying them broadly in production.