Active Directory Identity and Access Management (IAM)

Identity and access management (IAM)

What is Active Directory (AD) identity and access management (IAM)?

AD has come to define modern on-premise IAM, encompassing the management of user and machine identities, as well as how users authenticate, what they are authorized to access, and which rules are applied in terms of access control and policy enforcement.

Identity management

How users and machine accounts are created (onboarded), maintained, and decommissioned with the centralized ntds.dit AD identity database on a Domain Controller (DC).

Authentication

The process by which users and devices are verified, which in AD happens via the Kerberos protocol, NTLM (now deprecated).  Applications also connect to AD via LDAP/S.

Authorization & Governance Objects

AD's engine room comprises Security Identifiers (SIDs) assigned to users and devices, Organizational Units (OUs), Group Policy Objects GPOs), Security Groups, Access Control Lists (ACLs).

Access management and policy enforcement

The security rules applied to a user account or Group as defined by Group Policy Objects (GPOs), role-based access control (RBAC), and ACLs. For example, GPOs control things like password complexity rules and the thresholds for locking users out if a password is entered incorrectly.

Why Active Directory and not something else?

What did AD become an enterprise IAM standard when 1990's rivals such as Novell's Netware disappeared? The simplest answer is that Microsoft offered enterprises a complete environment integrating with the Windows OS and emerging web technologies such as Exchange Server, IIS, SQL Server, and SharePoint. It was also easier to manage, a critical feature for enterprises rapidly expanding the size of their networks.

Why is Active Directory IAM security so important?

Almost every organization in existence has AD somewhere in their environment, and many depend on it for critical applications.  When attackers target AD – and many do – this puts at risk not only an organization's entire on-premise footprint but potentially their cloud environments too. AD is like a door to everything. Weak identity synchronization between on-premises AD infrastructure and cloud environments creates a bridge also risks putting the latter at risk. 

Limitations of Active Directory (AD) IAM

Designed in the late 1990s, by modern software standards, AD is getting up there. Its biggest limitation is its trust in the traditional perimeter security model. From this point of view, AD exists to organize, authenticate and authorize users, rather than to secure them. No ongoing or internal monitoring is required. Its authentication protocols, NTLM and Kerberos, are also vulnerable to a range of attacks, including credential relaying, brute-forcing, Kerberoasting, and ticket harvesting.

Other Active Directory IAM security challenges

  • Privilege sprawl

Ordinary user accounts can acquire temporary privileges over time that are never revoked. As these accumulate, this can lead to excessive privileges that make these accounts a major security risk in the event of a credential breach.

  • Shadow admins

In extreme cases, privilege sprawl can lead to the creation of shadow admins which have been granted powerful admin privileges without being added to standard admin groups. Incredibly risky because they are often forgotten about and missed by audits.

  • Concurrent sessions

The ability for a user to open additional concurrent sessions using the same credentials represents a major security risk, not helped by AD lacking any native way to control this. Apart from being bad for accountability (two separate users performing actions using one account) this makes it possible for a hacker using stolen credentials to open a parallel session to a legitimate user.

  • Misconfiguration

Easily underestimated, misconfiguration gives attackers a way to abuse perfectly legitimate features to escalate privileges. This, of course, is exactly why they can be difficult to spot. Examples include non-admin accounts holding rights over Groups or Organizational Units (OUs), or service accounts with Domain Admin rights. Some of his derives from the complex hierarchical design of AD itself (higher level permissions flowing to lower level child objects) as well as need to distribute some aspects of AD management across departments.

Active Directory IAM hardening

  • Enforce least privilege

Ensure every user and service account has only the minimum privileges required to perform their role. This counters the problem of privilege sprawl and shadow amins (see above).

  • Group managed service accounts

The gMSA was introduced in Sever 2012, to reform the insecure way service accounts were previously run using standard domain accounts. A gSMA account implements several security upgrades, including automatic password rotation.

  • Protocol/Kerberos hardening

Although not an architectural feature, removing components is another dimension of AD security. This begins with insecure legacy authentication protocols such as NTLMv1/2 and SMBv1.Kerebros also needs close attention by disabling weak RC4 ciphers, and by placing admins into a Protected Users Security Group.

  • Local administrator password solution (LAPS)

Originally released as a separate tool but included natively since 2023, LAPS's primary purpose is to manage and rotate static local admin accounts which attackers target to gain lateral access. Although AD admin accounts are always more valuable that un-rotated workstation accounts, local admin status is often a starting point for a wider compromise.