5 AD hardening wins from a pentester
The Authentication Insights Newsletter
This is a guest post from Spencer Alessi, Sr. Penetration Tester at SecurIT360 and Microsoft MVP.
When you spend as much time inside internal networks and Active Directory environments as I do, you begin to notice some trends. Trends that end up resulting in weaker security and unfortunately make it easier to attack a given organization.
That’s why I’m so passionate about hardening and doing the foundational stuff well. It’s because it matters, a lot.
It’s not getting any easier for defenders. At the same time, it’s getting easier for attackers. Not an equation that we should want to continue.
If I were inside your environment, these are 5 of the most important hardening/configuration areas I would look for to make your network more secure.
LAPS: Local Administrator Password Solution
LAPS can be deployed in hours or days. It protects against the situation where a threat actor is able to compromise one of your endpoints and steal a local admin password (or hash).
I’ve used this during internal pentests to move laterally more times than I can count.
What should you do?
Start with a test group and iron out the details there. Then deploy department by department. After that, focus on servers. Then everything else.
Most importantly: be methodical, test, and document well.
Certificate services & templates
Active Directory Certificate Services (AD CS) tends to be a big black box for most IT teams. Unfortunately, it’s also highly targeted by threat actors because of the numerous ways to abuse misconfigurations to elevate privileges.
The most dangerous of these issues can allow Domain Users to impersonate Domain Admins and essentially take over the entire domain.
And it’s not even difficult.
What should you do?
Run a tool called Locksmith. It’s free and open source and works great. Then fix the results. Keep in mind the most dangerous are ESC1, ESC2, ESC4, and ESC8.
Active Directory permissions
This is one of the more nuanced areas because you have to know what to look for and where to look to find insecure and dangerous permissions. But it can often be the highest-ROI area for hardening your Active Directory environment.
The hard part is that there are quite a few potentially dangerous permissions. Many times you don’t even know they are there until 1) you have a security incident or 2) something in your environment breaks and you go looking at the problem.
What should you do?
Use the tool I wrote, ADeleginator, to find the most severe low-hanging fruit. Look for unsafe groups with dangerous permissions.
Unsafe groups: Domain Users, Domain Computers, Authenticated Users, and Everyone.
Unsafe permissions: FullControl, WriteAllProperties, ResetPassword, Delete (many more than can be listed here).
Service accounts
Another overlooked area of Active Directory security is service accounts. These accounts typically have elevated privileges and group membership, many times even having Domain Admin access.
You can eliminate quite a bit of attack surface by restricting the access these accounts have and ensuring they are properly secured.
What should you do?
First, make sure the passwords for these accounts are long and unique. Make sure any groups they are a member of are needed and have a valid reason.
Ensure that the passwords for these accounts are managed via a password vault or privilege management solution and that the credentials are not stored on any file shares or documents. Especially ones accessible by everyone in the company.
NTLM
The most persnickety (10-point word? 😃️) of all the authentication protocols. Unfortunately, NTLM has several flaws that make it a prime target for attackers.
It can be coerced, relayed, stolen, and even brute-forced in the right situations.
What should you do?
The goal should be to eliminate the use of NetNTLMv1 in your environment. Start by disabling it across the domain on end-user systems, then servers and then finally on your Domain Controllers.
Test small, miss small. Roll this out slowly, test, document, and you will be just fine. Fully eliminating it will take some time, but I promise (from an attacker’s POV) it’s worth it.
This is exactly what we talked about in the webinar. We went deeper on each of these Active Directory hardening wins, talked about why this matters more now than ever, and fielded questions at the end.
Missed it, or want a second look? Watch the replay.
Super appreciate the Authentication Insights team having me on the webinar. If you enjoyed it, hit reply to let them know and maybe we can run it back soon!
All the best,
Spencer