---
title: "Raising the cost of attacks: Hardening AD | Authentication Insights"
description: "Attackers don't need to break your defenses, they just need to find the path of least resistance. The game for defenders is to make every step forward as slow and painful as possible. Read this issue of the Authentication Insights Newsletter to learn more."
locale: "en"
updated_at: "2026-09-18T15:13:02.037Z"
canonical: "https://www.isdecisions.com/en/authentication-insights/raising-the-cost-of-attacks-hardening-ad"
---

# Raising the cost of attacks: Hardening AD

The Authentication Insights Newsletter

Hello,

Welcome back to [Authentication Insights](/authentication-insights/).

In our last issue, we walked through [how attackers move](/authentication-insights/attack-paths-how-today-s-attackers-move-through-active-directory) from a single foothold to Domain Admin. This time, let's look at the defender's side of that story: attackers don't need to break your defenses, they just need to find the path of least resistance. The mandate isn't to make AD impenetrable. It's to make every step forward so slow and painful that it isn't worth taking.

As Evgenij Smirnov puts it in *Building a Modern Active Directory*: "Instead of trying to harden AD and all the systems around it until they become unusable … we will engineer our AD in a way that makes every phase of an attack as expensive as possible while still providing required functionality to legitimate users and applications."

We can't go into AD hardening in detail here, but here are a few ways to make sure any gains cost a greater amount of time, skill, or money.

### **Address the protocol elephant in the room**

NTLM keeps biting modern AD environments. If attackers steal the underlying hash, they don't need the password, and relay attacks are trivial because there's no client preauthentication.

Almost no one disagrees that disabling NTLM is the end goal. But it's hardcoded into third-party integrations and present in many legacy apps.

The practical path isn't a switch-flip. It means auditing where NTLM is actually used, then ratcheting up the restriction level from there.

### **Then close the gap Kerberos leaves open**

Kerberos is the better protocol, but "better" isn't "safe by default." Three gaps stand out:

- **The krbtgt account:** every DC shares its hash. Compromise it, and an attacker forges Golden Tickets at will.
- **Legacy ciphers:** RC4 has been deprecated but remains enabled by default in most environments, and because the RC4-HMAC encryption key equals the account's NT hash, stolen hashes can be used to request Kerberos tickets. Kerberoasted RC4 tickets are crackable offline; AES-encrypted tickets are far more resistant to the same attack.
- **Any account flagged "Do not require Kerberos preauthentication"** is open to AS-REP roasting. There's really no reason to have that setting enabled.

### **Make it visible and defend it**

Since Active Directory doesn't have built-in authentication tracking, it can't, by design, keep a ledger of every ticket it issues. That blind spot is exactly what attackers count on.

The hardening that makes an attack expensive only works if you can see the attempt.

Spencer Alessi, Microsoft MVP and Sr. Pentester at SecurIT360, recommends creating an attack path kill list:

*An Attack Path Kill List is just a fancy saying for identifying where potential attack paths exist in your environment, then mitigating or eliminating them with defensive controls.*

1. *Identify Attack Paths*
2. *Prioritize Remediations*
3. *Fix, Re-test*
4. *Repeat*

*You secure AD by understanding how an attacker would move, then removing the paths that let them succeed.*

In our next issue, we'll look at why you can't defend what you can't see, and practical ways to get better visibility.

### **Insights and practical tips**

Looking to go deeper on AD hardening and attack paths? These reads can help:

- **[Why Active Directory attack paths matter (Spencer Alessi)](https://spenceralessi.com/post/why-active-directory-attack-paths-matter)**
- **[How authentication works in Active Directory](/blog/mfa/how-authentication-works-in-active-directory)**
- **[Containing the threat of privilege abuse and escalation](/blog/mfa/defending-active-directory-containing-the-threat-of-privilege-abuse-and-escalation)**

Until next time,

The Authentication Insights Team