Beyond the MCSE:
Active Directory for the Security
Professional
Sean Metcalf (@Pyrotek3)s e a n [@] TrimarcSecurity.com
www.ADSecurity.org
TrimarcSecurity.com

ABOUTFounder Trimarc, a security company.
Microsoft Certified Master (MCM) Directory Services
Microsoft MVP
Speaker: Black Hat, BSides, DEF CON, DerbyCon, Shakacon
Security Consultant / Security ResearcherOwn & Operate ADSecurity.org(Microsoft platform security info)
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

AGENDAKey AD details security professionals should know.
Most common AD Security issues
Active Directory security enhancements by OS
Windows 10/2016 Security Features
Security Pro’s Checklist
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Differing Views of Active Directory• Administrator• Security Professional• Attacker

Complete picture is not well understood by any single one of them
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

AD Administrator/Engineer

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Security Pro

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Attacker

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

YOUR SECURITYACCESS CONTROLS…

Active Directory
Security
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

GRATEFULLY ACCEPTED

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

https://technet.microsoft.com/en-us/library/cc759073%28v=ws.10%29.aspx

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com

https://technet.microsoft.com/en-us/library/cc759073%28v=ws.10%29.aspx

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Admins in One Domain

Can Control Another Domain
in the Forest!?!
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

On-premises Active Directory• Authentication, Directory, &Management• AD Forest for single entity• Internal corporate network• Authentication• Kerberos• NTLM• LDAP• Group Policy

Azure AD (Office 365)

• Identity• Designed for multi-tenant• Cloud/web-focused• Authentication• SAML 2.0• OpenID Connect• OAuth 2.0• WS-Federation• REST API: AD Graph API
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Azure AD Domain Services (Preview)• Active Directory managed by Microsoft in the cloud.
• “DC as a Service”• Custom names• Domain-join support• Integrated with Azure AD• NTLM & Kerberos auth support• Group Policy• Full LDAP support (read/write)• AD management tools supported

https://azure.microsoft.com/en-us/documentation/articles/active-directory-ds-features/
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Amazon Hosted Active Directory• “Simple version” = Samba 4• < 5,000 users• “Premium version” = Microsoft Active Directory• > 5,000 users• Note: No support for Fine Grained Password Policies• AD Connector – proxy service• Not sync or federation• Forwards auth & queries to DCs
https://docs.aws.amazon.com/directoryservice/latest/admin-guide/what_is.html
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Federation

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

TrustFederation• Connects domains• NTLM & Kerberos• Trusts between internal &external domains =security issue.
• Credential theft potential.

• Leverages PKI “trust”• Enables “non-trusted” user
access.
• User authenticated locallywhich creates token used
for fed auth.
• Ideal for partner org.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Domain Controllers• Contains & replicates domain data.
• Provides authentication & directory services.
• Central set of servers for client communication.
• Security settings define AD baseline security.
• Stores the domain AD database (NTDS.dit).
• Hosts the domain DFS root (\\domain.com\) &NETLOGON & SYSVOL shares.
• DNS (AD-Integrated)
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

The Global Catalog• Partial replica of all object for all forest domains.
• GC attribute replication is configurable (PartialAttributeSet).
• Enables quick forest-wide object searches.
Security Note:
Check the attributes included in the PartialAttributeSet.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Read-Only Domain Controllers (RODCs)• DC services without storing passwords.
• Only receives inbound replication from writable DCs.
• Requires cached passwords for local site authentication.
• Enables delegation of RODC administration to non AD
admins.
• Use cases:• Physical security issues.
• Third party software install on DC.
• “Untrusted admin” scenario.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

RODC Attributes• msDS-Reveal-OnDemandGroup• “Allowed RODC Password Replication Group”• msDS-NeverRevealGroup• “Denied RODC Password Replication Group”• msDS-AuthenticatedToAccountList• msDS-RevealedList
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Denied RODC Password Replication Group Membership• Cert Publishers• Domain Admins• Enterprise Administrators• Schema Admins• Group Policy Creator Owners• Krbtgt• Domain Controllers• Read Only Domain Controllers
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

DSRM? What’s DSRM?
• Directory Services Restore Mode.
• “Break glass” access to DC.
• DSRM password set when DC is promoted.
• Rarely changed.
• Password Change Process?
• Access DSRM without Rebooting (2k8+)• DsrmAdminLogonBehavior = 2• Console logon
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Pass-the-Hash with DSRM Account – Success!

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

DCSync Password Data with DSRM Account!

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sites & Subnets• Map AD to physical locations.
• Defines what DC clients authenticate to & which DC
provides GPO data.
• Subnet-Site association for resource discovery.
• Asset discovery:• Domain Controllers• Exchange Servers• SCCM• DFS sharesSean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Objects & Properties• Objects• User• Computer• Group• Organizational Unit (OU)

• Properties (Attributes)• Interesting info in ext. attributes• Sometimes contain passwords 
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Fun with User Attributes: SID History• SID History attribute supports migration scenarios.
• Security principals have a SID which determines rights &access to resources.
• Enables access cloning from one account to another.
• Works for SIDs in the same domain & throughout theforest.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Get-ADUser -Filter * -Property• Created• Modified• CanonicalName• Enabled• Description• LastLogonDate• DisplayName• AdminCount• SIDHistory• PasswordLastSet• PasswordNeverExpires• PasswordNotRequired• PasswordExpired• SmartcardLogonRequired• AccountExpirationDate• LastBadPasswordAttempt• msExchHomeServerName• CustomAttribute1 - 50
• ServicePrincipalName

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Get-ADComputer -Filter * -Property• Created• Modified• Enabled• Description• LastLogonDate (Reboot)• PrimaryGroupID(516 = DC)• PasswordLastSet(Active/Inactive)• CanonicalName• OperatingSystem• OperatingSystemServicePack• OperatingSystemVersion• ServicePrincipalName• TrustedForDelegation• TrustedToAuthForDelegation

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Group Policy• User & computer management• Create GPO & link to OU• Comprised of:• Group Policy Object (GPO) in AD• Group Policy Template (GPT) files in SYSVOL• Group Policy Client Side Extensions on clients• MS15-011 & MS15-014 MiTM Vulnerabilities(MS15-011 requires UNC Hardening GPO)

• Modify GPO or GPT…
| @PryoTek3 | sean @ adsecurity.org |Authentication“Badges? We don’t need no stinkin’ badges!”

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

NTLM

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

https://blogs.technet.microsoft.com/isrpfeplat/2010/11/05/optimizing-ntlm-authentication-flow-in-multi-domain-environments/

NLM Attacks• SMB Relay - simulate SMB server or relay to attacker
system.
• Intranet HTTP NTLM auth – Relay to Rogue Server• NBNS/LLMNR – respond to NetBIOS broadcasts• HTTP -> SMB NTLM Relay• WPAD (network proxy)• ZackAttack - SOCKS proxy, SMB/HTTP, LDAP, etc• Pass the Hash (PtH)
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

“Therefore, applications are generally
advised not to use NTLM”

https://msdn.microsoft.com/en-us/library/cc236715.aspx
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

KerberosSean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Kerberos Attacks• Replay Attacks• Pass the Ticket• Over-pass the hash (pass the key)
• Offline (User) Password Cracking (Kerberoast)• Forged Tickets - Golden/Silver• Diamond PAC• MS14-068
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

MS14-068: (Microsoft) Kerberos Vulnerability
MS14-068 (CVE-2014-6324) Patch released 11/18/2014
Domain Controller Kerberos (KDC) Service didn’t correctly
validate the PAC checksum.
Create a Kerberos “Golden Ticket” using a valid AD user account.

http://adsecurity.org/?tag=ms14068
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

NTLM

Weaknesses• Typically mix of NTLM v1 & v2.
• Encryption: DES or MD4 or
HMAC-MD5.
• No mutual authentication.
• Hash used behind the scenes.
• Stolen credentials reusable(until pw changed).
• Credential can be ‘leaked’ via
web browser.

Kerberos• Supported encryption types.
• RC4 enc. = NTLM Hash
• Compromise of LTK =compromise of Kerberos.
• Stolen credentials reusable
anywhere (until ticket expires).
• TGS PAC validation not typically
performed.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Microsoft Passport
Microsoft Passport is a two-factor authentication (2FA)
system that combines a PIN or biometrics (via Windows
Hello) with encrypted keys from a user’s device toprovide two-factor authentication.
https://blogs.windows.com/buildingapps/2016/01/26/convenient-two-factorauthentication-with-microsoft-passport-and-windows-hello/
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Microsoft Passport & Active Directory (beta)• TPM generates user public-private key pair.
• User credential device-specific secrets stored in VSM.
• Enrollment: user's public key (device-specific) added AD
user attribute.
• Leverages Kerberos FAST (RFC 6113) compound
authentication.
• Machine data & user credential info combined & sent to
DC for user TGT.
• Cred Guard owns system private key used to get TGT.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Microsoft Passport Active Directory Requirements•PKI Authentication• Windows Server 2012 R2 Domain Controllers• Windows Server 2016 schema update• Windows Server 2016 ADFS
• SCCM 2012 R2 SP2+

•Key-based Authentication• Same, except: Windows Server 2016 Domain
Controllers
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

The Most Common AD Security Issues… and how to fix them.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Active Directory’s Security Boundary• Forest, not Domain.
• Older AD forests have multiple domains for “security”.
• Trusts extend boundary & may introduce exploit paths(http://www.harmj0y.net/blog/redteaming/domain-trusts-why-youshould-care/)Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Microsoft Default Settings• No security policy = default (minimum).
• DCs need additional security policies (GPO).
• Windows Systems (DC) need to be configured forenhanced auditing (Vista/2008+).
auditpol.exe /get /category:*

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Unpatched Systems (including DCs)
• Attacks don’t typically use 0-days.
• Unpatched DCs (MS14-068) can result in total forest
compromise.
• Rapidly Deploy all “critical” & “important” patches,
especially those with a public PoC (~7 – 14 days).

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Run Out-dated OS Versions• Remove old, unsupported operating systems.
• If not, mitigate by isolating systems on the network.
• Newer Windows versions have greatly improved security.
• If DCs !=> 2008, no Kerberos AES encryption.
Win7/2008R2+ Kerberos DES disabled.
• AD security features are based on DC OS version.
2003 -> 2008 -> 2008R2 -> 2012 -> 2012R2 -> 2016
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Simple DSRM Password with no Management• Directory Services Restore Mode (DSRM)• “Break glass” access to DC (RID 500)
• Console logon w/ DSRM account (Administrator)• DSRM pw set when DC is promoted• Rarely changed - Password Change Process?
• Best to synchronize from AD account (2008R2+).
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Over-Permissioned Accounts• Service Accounts in Domain Admins.
• Accounts in admin groups, just because…
• User accounts in admin groups.
• Computer accounts in admin groups.
• Groups within Groups within Groups…
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Admin Groups• How many Domain Admins do you have?
• What about domain Administrators?
• Enterprise Admins?
• Accounts with domain admin rights?
Are You Sure?
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Groups with AD admin rights• Domain Admins• Enterprise Admins• Domain “Administrators”• Custom Delegation at domain/OU level• Groups with DC logon rights

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Groups with DC Logon Rights (default)• Account Operators• Backup Operators• Print Operators• Remote Desktop Users (RDP)• Server Operators

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Credentials in SYSVOL• Authenticated Users have read access to SYSVOL.
• SYSVOL often contains:• Files containing passwords.
• VBS scripts (with passwords).
• Group Policy Preferences (with credentials).

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Custom Group Policy Object (GPO) Delegation

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Custom Domain/OU Delegation

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

The AdminSDHolder Object

Sean Metcalf [@Pyrotek3 |sean@TrimarcSecurity.com]

SDProp Protected Objects• Account Operators• Administrator• Administrators• Backup Operators• Domain Admins• Domain Controllers• Enterprise Admins• Krbtgt• Print Operators• Read-only Domain
Controllers• Replicator• Schema Admins• Server Operators

Sean Metcalf [@Pyrotek3 |sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

AD Security Enhancements by OS

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Windows 2008 R2 Forest/Domain Mode Features• Kerberos AES support (128 & 256 bit keys)*• Fine Grained Password Policy*• Managed Service Accounts• Authentication Mechanism Assurance• Offline Domain Join
• ECC support for Smartcard logon (X.509 certificates).
• Audit / Restrict NTLM Authentication* - Windows 2008 Mode Feature
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

New AD Features: Windows Server 2012
• UEFI & Secure Boot
• Bitlocker with AD unlock• Constrained Delegation across Domain/Forest• Group Managed Service Accounts• Compound Authentication & Kerberos FAST
(aka Kerberos Armoring)• Dynamic Access Control (attribute-based access)Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Key AD Security Features: 2012 R2• LSA Protection• “Protected Users” Security Group• Protected Users Host/Domain Protection• Authentication Policies & Silos• Forest boundary enforcement for Kerberos Delegation

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

New Security Features(Win 10/2016)

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

New & Updated Auditing• Added a default process SACL to LSASS.exe (Mimikatz)• Advanced Audit Policy Configuration\Object Access\Audit Kernel Object• New Security Account Manager read (enumeration) events• Event ID 4798 & 4799

• New Audit Subcategories• Group Membership query• New fields in the logon event• MachineLogon (Y/N)• ElevatedToken (Y/N)• RestrictedAdminMode (Y/N)• GroupMembership

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Windows Server 2016 New Features• Shielded Virtual Machines (Hyper-V)• Just-In-Time administration (JIT)• Just Enough Administration (JEA)• Nano Server• Azure AD Conditional Access• PowerShell v5 & AMSI
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

AD 2016: Temporal Group Membership• AD Optional Feature:• Privileged Access Management Feature• Kerberos Ticket TTL

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

AD 2016: Bastion Forest• New Privileged Access Management (PAM) trust with
Production forest.
• Leverages shadow security groups.

• Contains attribute referencing Production forest admin group
SID.
• Provides Production forest admin rights without changing
permissions.

• Temporal membership in a shadow group (with Kerberos
TTL).
• Microsoft Identity Manager (MIM) includes new features tosupport temporal group management workflow.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Interesting AD Facts• All Authenticated Users have read access to:• Most (all) objects & their attributes in AD (evenacross trusts!).
• Most (all) contents in the domain share “SYSVOL”
which can contain interesting scripts & files.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Interesting AD Facts:• A standard user account can:• Have elevated rights through the magic of “SIDHistory” without being a member of any groups.
• Have the ability to modify users/groups without
elevated rights through custom OU permissions.
• Compromise an entire AD domain simply by
improperly being granted modify rights to an OU or
domain-linked GPO.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

A Security Pro’s AD Checklist• Identify who has AD admin rights (domain/forest).
• Identify who can logon to Domain Controllers (& admin rights tovirtual environment hosting virtual DCs).
• Scan Active Directory Domains, OUs, AdminSDHolder, & GPOs forinappropriate custom permissions.
• Ensure AD admins (aka Domain Admins) protect their credentials
by not logging into untrusted systems (workstations).
• Limit service account rights that are currently DA (or equivalent).
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Summary• Protect AD Admins or AD compromise is likely!
• Active Directory can be properly secured.
• Keys to AD Security:• Isolate admin credentials.
• Isolate critical resources.

• Get AD security right & many common attacks are
mitigated/ less effective
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Questions?
Like my talk?

Please Submit an Evaluation

Sean Metcalf (@Pyrotek3)s e a n [@] TrimarcSecurity.com
www.ADSecurity.org
TrimarcSecurity.com

Slides: Presentations.ADSecurity.org

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Appendix: Active Directory Security Best Practices

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

General Recommendations• Manage local Administrator passwords (LAPS).
• Implement RDP Restricted Admin mode (as needed).
• Remove unsupported OSs from the network.
• Monitor scheduled tasks on sensitive systems (DCs, etc).
• Ensure that OOB management passwords (DSRM) arechanged regularly & securely stored.
• Use SMB v2/v3+
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

General Recommendations• Default domain Administrator & KRBTGT password
should be changed every year & when an AD adminleaves.
• Remove trusts that are no longer necessary & enable
SID filtering as appropriate.
• All domain authentication should be set (whenpossible) to:“Send NTLMv2 response only\refuse LM & NTLM.”• Block internet access for DCs, servers, & alladministration systems.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect Admin Credentials• No “user” or computer accounts in admin groups.
• Ensure all admin accounts are “sensitive & cannot bedelegated”.
• Add admin accounts to “Protected Users” group(requires Windows Server 2012 R2 Domain
Controllers, 2012R2 DFL for domain protection).
• Disable all inactive admin accounts and remove fromprivileged groups.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect AD Admin Credentials• Limit AD admin membership (DA, EA, Schema Admins,etc.) & only use custom delegation groups.
• ‘Tiered’ Administration mitigating credential theft impact.
• Ensure admins only logon to approved admin
workstations & servers.
• Leverage time-based, temporary group membership for
all admin accounts.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect Service Account Credentials• Limit to systems of the same security level.
• Leverage “(Group) Managed Service Accounts” (or pw>20 characters) to mitigate credential theft (kerberoast).
• Implement FGPP (DFL =>2008) to increase PW
requirements for SAs and administrators.
• Logon restrictions - prevent interactive logon & limit
logon capability to specific computers.
• Disable inactive SAs & remove from privileged groups.
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect Resources• Segment network to protect admin & critical systems.
• Deploy IDS to monitor the internal corporate network.
• Network device & OOB management on separate
network.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect Domain Controllers• Only run software & services to support AD.
• Minimal groups (& users) with DC admin/logon rights.
• Ensure patches are applied before running DCPromo(especially MS14-068 and other critical patches).
• Validate scheduled tasks & scripts.

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Protect Workstations (& Servers)• Patch quickly, especially privilege escalation vulnerabilities.
• Deploy security back-port patch (KB2871997).
• Set Wdigest reg key to 0 (KB2871997/Windows 8.1/2012R2+):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest• Deploy workstation whitelisting (Microsoft AppLocker) toblock code exec in user folders - home dir & profile path.
• Deploy workstation app sandboxing technology (EMET) to
mitigate application memory exploits (0-days).
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

Logging• Enable enhanced auditing:• “Audit: Force audit policy subcategory settings (Windows Vista or later) tooverride audit policy category settings”• Enable PowerShell module logging (“*”) & forward logs tocentral log server (WEF or other method).
• Enable CMD Process logging & enhancement (KB3004375) andforward logs to central log server.
• SIEM or equivalent to centralize as much log data as possible.
• User Behavioral Analysis system for enhanced knowledge ofuser activity (such as Microsoft ATA).
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

References• Active Directory Domains and Trusts
https://technet.microsoft.com/en-us/library/cc770299.aspx• Understanding Trusts
https://technet.microsoft.com/en-us/library/cc736874(v=ws.10).aspx• Trust Types
https://technet.microsoft.com/en-us/library/cc775736(v=ws.10).aspx• Active Directory Replication Overview
https://technet.microsoft.com/en-us/library/cc961788.aspx• How Active Directory Replication Topology Works
https://technet.microsoft.com/en-us/library/cc755994(v=ws.10).aspx• How the Active Directory Replication Model Works
https://technet.microsoft.com/en-us/library/cc772726(v=ws.10).aspx
Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

References• Group Policy Basics
http://blogs.technet.com/b/musings_of_a_technical_tam/archive/2012/02/13/understanding-thestructure-of-a-group-policy-object.aspx• Optimizing Group Policy Performancehttps://technet.microsoft.com/en-us/magazine/2008.01.gpperf.aspx• Organizational Units
https://technet.microsoft.com/en-us/library/cc758565(v=ws.10).aspx• Organizational Unit Design
http://www.windowsnetworking.com/articles-tutorials/windows-server-2008/Crash-Course-ActiveDirectory-Organizational-Unit-Design.html• How DNS Support for Active Directory Works
https://technet.microsoft.com/en-us/library/cc759550(v=ws.10).aspx• Active Directory-Integrated DNS
https://technet.microsoft.com/en-us/library/cc978010.aspx• Understanding DNS Zone Replication in Active Directory Domain Services
https://technet.microsoft.com/en-us/library/cc772101.aspx

Sean Metcalf [@Pyrotek3 | sean@TrimarcSecurity.com]

References• What is an RODC?
https://technet.microsoft.com/en-us/library/cc771030(v=ws.10).aspx• AD DS: Read-Only Domain Controllers
https://technet.microsoft.com/en-us/library/cc732801(v=ws.10).aspx• Read-Only Domain Controllers Step-by-Step Guide
https://technet.microsoft.com/en-us/library/cc772234(v=ws.10).aspx• Service Principal Names (SPNs) Overview
https://msdn.microsoft.com/en-us/library/ms677949(v=vs.85).aspx
https://technet.microsoft.com/en-us/library/cc961723.aspx
http://blogs.technet.com/b/qzaidi/archive/2010/10/12/quickly-explainedservice-principal-name-registration-duplication.aspx• Register a Service Principal Name for Kerberos Connections
https://msdn.microsoft.com/en-us/library/ms191153.aspx
Sean Metcalf [@Pyrotek3 |sean@TrimarcSecurity.com]

References• Active Directory Reading Libraryhttps://adsecurity.org/?page_id=41• Read-Only Domain Controller (RODC) Information
https://adsecurity.org/?p=274• Active Directory Recon Without Admin Rights
https://adsecurity.org/?p=2535• Mining Active Directory Service Principal Names
http://adsecurity.org/?p=230• SPN Directory:
http://adsecurity.org/?page_id=183• MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation ofPrivilege
Sean Metcalf [@Pyrotek3 |http://adsecurity.org/?tag=ms14068
sean@TrimarcSecurity.com]

References• Securing Active Directory – An Overview of Best Practices
https://technet.microsoft.com/en-us/library/dn205220.aspx• Microsoft Enhanced security patch KB2871997
http://adsecurity.org/?p=559• Tim Medin’s DerbyCon 2014 presentation: “Attacking Microsoft Kerberos: Kicking
the Guard Dog of Hades”
https://www.youtube.com/watch?v=PUyhlN-E5MU• Microsoft: Securing Privileged Access Reference Material
https://technet.microsoft.com/en-us/library/mt631193.aspx• Mimikatz
https://adsecurity.org/?page_id=1821• Attack Methods for Gaining Domain Admin Rights in Active Directory
Sean Metcalf [@Pyrotek3 |https://adsecurity.org/?p=2362
sean@TrimarcSecurity.com]

References• Microsoft Local Administrator Password Solution (LAPS)
https://adsecurity.org/?p=1790• The Most Common Active Directory Security Issues and What You Can Do to Fix
Them
https://adsecurity.org/?p=1684• How Attackers Dump Active Directory Database Credentials
https://adsecurity.org/?p=2398• Sneaky Active Directory Persistence Tricks
https://adsecurity.org/?p=1929

Sean Metcalf [@Pyrotek3 |sean@TrimarcSecurity.com]