Active Directory Hardening: 10 Best Practices to Secure Your Domain

Learn how to secure Active Directory, reduce excessive privileges, strengthen authentication, and protect domain controllers against common attacks.

 

Active Directory hardening is the process of securing AD accounts, permissions, authentication mechanisms, and domain controllers. It reduces opportunities for unauthorized access, privilege escalation, and lateral movement. For example, could a compromised employee workstation expose your domain administrator credentials? Proper security controls help prevent that path.

Active Directory (AD) manages identity and access across many Windows environments. However, excessive privileges, outdated protocols, and poorly managed accounts can expose the entire domain.

Attackers often target these weaknesses after gaining access to an ordinary workstation or server. Therefore, administrators must review both directory configurations and the systems that manage them.

This guide covers ten Active Directory security best practices. It also explains how to audit your environment, apply hardening measures, and verify the results.

What Is Active Directory Hardening?

Active Directory hardening involves reducing security weaknesses across Active Directory Domain Services (AD DS). It includes restricting privileged access, strengthening authentication, securing domain controllers, and monitoring directory changes.

AD DS provides centralized authentication, authorization, directory services, and Group Policy management. Consequently, a compromised domain can affect users, computers, applications, and other connected systems.

For example, an attacker who steals a privileged account’s credentials may access sensitive servers. They may also change permissions, create accounts, or establish persistent access.

Hardening addresses these risks through preventive, detective, and recovery controls. However, no single setting can protect an entire AD environment. Administrators must apply several controls and review them regularly.

10 Active Directory Hardening Best Practices

These practices address common weaknesses across user accounts, authentication, domain controllers, and directory configurations. Apply them according to your environment’s architecture and operational requirements.

1. Audit Privileged Accounts and Remove Excessive Permissions

Excessive privileges create opportunities for attackers to escalate access. Therefore, begin Active Directory hardening by reviewing accounts with elevated permissions.

Start with these groups:

• Domain Admins: Members have extensive administrative control over their domain.
• Enterprise Admins: Members have forest-wide administrative privileges.
• Schema Admins: Members can modify the Active Directory schema.
• Administrators: This built-in group holds extensive administrative permissions within its scope.

However, reviewing these groups alone will not reveal every privilege escalation path. Also examine nested group memberships, delegated permissions, and access control entries (ACEs).

Follow these steps:

1. Export the membership of privileged security groups.
2. Identify nested groups and accounts with indirect administrative access.
3. Review delegated permissions on organizational units and directory objects.
4. Disable unnecessary or dormant privileged accounts.
5. Remove permissions that users no longer require.
6. Separate everyday user accounts from administrative accounts.

For example, an administrator may use one account for email and another for server management. This separation reduces the chance of exposing privileged credentials during routine work.

Where possible, use temporary privileged access instead of permanent membership. Also, document why each privileged account needs its assigned permissions.

2. Implement Tiered Administration to Isolate Privileged Access

A compromised workstation can expose credentials used to administer more sensitive systems. Tiered administration helps prevent this movement by separating administrative environments.

The traditional three-tier model classifies systems according to their security importance:

• Tier 0: Domain controllers, identity systems, and other components that control the AD environment.
• Tier 1: Member servers, application servers, and other enterprise workloads.
• Tier 2: User workstations and ordinary endpoint systems.

Microsoft’s newer Enterprise Access Model provides broader guidance for privileged access security. Nevertheless, the tier concept remains useful when explaining credential isolation.

Administrators should follow these practices:

1. Use dedicated administrative accounts for privileged tasks.
2. Restrict Tier 0 credentials to approved Tier 0 systems.
3. Prevent privileged accounts from logging into lower-trust workstations.
4. Use Privileged Access Workstations (PAWs) for sensitive administration.
5. Apply separate access policies to each administrative environment.

For example, a domain administrator should not sign into an ordinary workstation to check email. Malware on that workstation could capture credentials or access privileged sessions.

Therefore, restrict where sensitive accounts can authenticate. Also, monitor attempts to cross administrative boundaries.

3. Secure Local Administrator and Service Accounts

Local administrator accounts often create security risks when organizations reuse passwords across computers. If attackers compromise one machine, they may reuse those credentials elsewhere.

Windows Local Administrator Password Solution (Windows LAPS) helps address this problem. It automatically manages and rotates local administrator passwords on supported Windows devices.

Administrators can configure Windows LAPS to:

• Generate unique passwords for managed local administrator accounts.
• Store passwords in Active Directory or Microsoft Entra ID, depending on configuration.
• Rotate passwords according to defined policies.
• Restrict access to stored passwords.
• Audit password access and management activities.

Windows LAPS requires appropriate configuration, permissions, and supported operating systems. Check Microsoft’s deployment requirements before implementation.

Service accounts need separate attention. Applications often use these accounts to access databases, servers, and other resources.

Consider these controls:

• Replace traditional service accounts with Group Managed Service Accounts (gMSAs) where supported.
• Assign only the permissions required by each service.
• Remove unused service accounts.
• Review service account passwords and rotation practices.
• Restrict interactive logons where they are unnecessary.

A gMSA allows supported Windows services to use automatically managed passwords. This reduces the need for administrators to maintain service account passwords manually.

4. Strengthen Kerberos Authentication and Encryption

Kerberos provides ticket-based authentication in Active Directory environments. However, attackers can exploit weak account configurations and exposed service credentials.

Administrators should understand three common Kerberos attacks.

Kerberoasting

Attackers request service tickets for accounts with Service Principal Names (SPNs). They can then attempt offline password cracking against the ticket data.

Reduce this risk by using strong service account passwords and gMSAs where supported. Also, review SPN assignments and remove unnecessary ones.

AS-REP roasting

This attack targets accounts that do not require Kerberos pre-authentication. Attackers can request authentication data and attempt offline password cracking.

Review accounts with pre-authentication disabled. Enable Kerberos pre-authentication wherever applications and workflows permit it.

Golden Ticket attacks

A Golden Ticket attack uses a compromised KRBTGT account secret to forge Kerberos Ticket Granting Tickets (TGTs). This can allow an attacker to impersonate domain users and maintain access.

The KRBTGT account has a critical role in Kerberos security. Its password rotation requires careful planning.

Use these additional controls:

1. Review service accounts and their SPN assignments.
2. Identify accounts using weak Kerberos encryption.
3. Move from RC4 or DES to AES where supported.
4. Investigate accounts that do not require pre-authentication.
5. Protect KRBTGT credentials and restrict access to domain controllers.
6. Follow Microsoft’s procedures for KRBTGT password rotation.

Do not change encryption settings without checking compatibility. Legacy applications and services may depend on older configurations.

Also, remember that the KRBTGT account protects TGTs. Service tickets use the long-term keys associated with their respective service accounts.

5. Protect Privileged Accounts With Strong Authentication

Privileged accounts provide access to sensitive systems and directory operations. Therefore, they need stronger authentication controls than ordinary user accounts.

Multi-factor authentication (MFA) adds another verification requirement beyond a password. However, traditional AD DS does not provide universal MFA enforcement for every authentication path by itself.

Organizations can use supported identity, access, VPN, remote desktop, or privileged access solutions. The implementation must cover the actual administrative access paths.

Consider these measures:

• Require MFA for privileged remote access.
• Use separate administrative accounts.
• Restrict privileged logons to approved systems.
• Apply conditional access through supported identity integrations.
• Monitor unusual authentication attempts.
• Review accounts that can delegate authentication.

The Protected Users security group also provides additional restrictions for eligible accounts. These restrictions include limiting NTLM authentication and certain credential delegation methods.

However, membership can affect application compatibility and authentication workflows. Test the restrictions before adding production accounts.

6. Disable Legacy Protocols and Strengthen Authentication Security

Older protocols can expose Windows environments to credential interception and relay attacks. However, disabling them without checking dependencies may interrupt legitimate services.

Review these protocols and configurations:

SMBv1

SMBv1 is an outdated file-sharing protocol with known security weaknesses. Identify applications and devices that still require it, then disable it where unnecessary.

LLMNR and NetBIOS Name Service

These name-resolution protocols can expose systems to name-resolution poisoning attacks. Disable them where network dependencies permit.

NTLM

NTLM remains present in some legacy environments. Identify applications and services that depend on it before restricting its use.

Use Kerberos where supported. However, Kerberos cannot replace NTLM in every authentication scenario.

SMB signing

SMB signing helps protect the integrity of SMB communications. Review signing requirements across clients and servers, then test the policy before enforcing it.

LDAP signing and channel binding

LDAP signing helps protect LDAP traffic against tampering. Channel binding strengthens authentication for supported LDAP connections.

Administrators should review these settings together. A controlled rollout helps identify compatibility problems before they affect production systems.

7. Harden Domain Controllers and Their Supporting Infrastructure

Domain controllers store and process critical identity information. Therefore, they require stricter security controls than ordinary member servers.

A compromised domain controller can expose directory data and allow attackers to change domain configurations. Protecting these systems should remain a priority in Active Directory hardening.

Apply the following controls:

1. Restrict administrative access: Allow only authorized administrators to manage domain controllers.
2. Remove unnecessary software: Avoid installing email clients, browsers, and unrelated applications.
3. Disable unnecessary services: Review services such as Print Spooler and disable them when they are not required.
4. Apply security baselines: Use appropriate Microsoft security guidance and Group Policy settings.
5. Restrict network access: Allow only required administrative and directory communication.
6. Patch regularly: Apply supported security updates through a tested deployment process.
7. Monitor system activity: Forward relevant security logs to a centralized monitoring platform.

Avoid treating domain controller updates like routine workstation patches. Test updates, check replication health, and validate authentication after deployment.

Also, maintain physical and virtual infrastructure security. Access to the hypervisor, backup platform, and management systems can affect domain controller security.

Domain controllers require regular security assessments to identify vulnerabilities, outdated components, and configuration weaknesses. These checks should cover the supporting server infrastructure as well. A broader review of website and server security can help identify risks that extend beyond Active Directory itself. 

8. Strengthen Password Policies and Account Protection

Weak passwords make credential attacks easier. However, password policies should balance security requirements with usability and operational risks.

Start by reviewing the domain password policy. Check its minimum length, complexity requirements, password history, and account lockout settings.

Apply these practices:

• Require sufficiently long passwords or passphrases.
• Screen new passwords against known compromised passwords where supported.
• Use fine-grained password policies when different account groups need different requirements.
• Apply stronger controls to privileged accounts.
• Avoid unnecessary periodic password changes.
• Require password changes when compromise is suspected or confirmed.

Account lockout policies also need careful planning. Aggressive thresholds can let attackers lock out legitimate users through repeated login attempts.

Understand the difference between common credential attacks:

• Brute-force attacks: Attempt many password combinations against an account.
• Password spraying: Try a small number of common passwords against many accounts.
• Credential stuffing: Reuse credentials exposed through unrelated data breaches.

Monitoring authentication failures can help identify these patterns. However, administrators should combine monitoring with MFA, compromised-password screening, and access restrictions.

9. Reduce the Active Directory Attack Surface

Unused accounts and unnecessary permissions create additional opportunities for attackers. Regular cleanup helps reduce these weaknesses.

Review the following areas.

Dormant user and computer accounts

Identify accounts that no longer serve a business purpose. Disable them after confirming ownership and application dependencies. Remove them according to your organization’s retention policy.

Kerberos delegation

Review unconstrained delegation and other delegation configurations. Unnecessary delegation can expose credentials or create paths to sensitive systems.

Use constrained delegation or resource-based constrained delegation where appropriate. Test application requirements before changing existing settings.

Active Directory permissions

Review sensitive permissions on user objects, computer objects, organizational units, and the domain root. Pay particular attention to permissions that allow account modification, group membership changes, or directory replication.

Group Policy permissions

Restrict who can create, edit, and link Group Policy Objects (GPOs). An attacker who modifies a privileged GPO may affect many domain-joined systems.

Active Directory Certificate Services

Review certificate templates, enrollment permissions, and certificate authority access. Misconfigured AD CS components can create paths to unauthorized authentication.

Domain trusts and identity synchronization

Review external trusts, synchronization services, and systems with directory access. Restrict their permissions to the minimum required.

These reviews should cover more than user accounts. Computer objects, service identities, certificates, and delegated permissions can also introduce security weaknesses.

10. Enable Active Directory Monitoring and Prepare for Recovery

Preventive controls reduce exposure, but they cannot guarantee that attackers will never compromise an environment. Monitoring helps administrators identify suspicious activity before it spreads.

Start with Advanced Audit Policy settings. Enable relevant auditing for account management, directory service changes, authentication, and privileged operations.

Monitor activities such as:

• Changes to Domain Admins and other privileged groups.
• Unexpected modifications to sensitive directory objects.
• Unusual directory replication requests.
• Changes to delegation settings.
• Suspicious modifications to the msDS-KeyCredentialLink attribute.
• Authentication attempts from unexpected systems.

Two techniques deserve particular attention.

DCSync abuses directory replication permissions to retrieve sensitive Active Directory data, including password hashes. Restrict replication rights and monitor replication activity from unauthorized accounts or systems.

Shadow Credentials abuses permissions to modify the msDS-KeyCredentialLink attribute. Attackers can add unauthorized key credentials and authenticate as another account.

Monitor changes to this attribute. However, distinguish legitimate Windows Hello for Business or other approved provisioning activity from unexpected modifications.

The September 2026 joint guidance from CISA, ASD’s ACSC, and partner agencies expands recommendations for detecting DCSync and Shadow Credentials. Administrators should review the updated Active Directory compromise guidance.

Use assessment tools to identify weaknesses

Tools such as BloodHound and PingCastle support different parts of an AD security assessment.

• BloodHound: Maps relationships and permissions to identify potential attack paths.
• PingCastle: Assesses AD security posture and highlights configuration weaknesses.

These tools do not replace a complete security review. Their findings require technical interpretation and validation.

Prepare for Active Directory recovery

Monitoring helps detect compromise, but recovery planning determines how quickly an organization can restore identity services.

Maintain protected system-state backups of domain controllers. Restrict backup access and protect backup copies from unauthorized modification.

Document a forest recovery procedure that covers:

1. Identifying the scope of the compromise.
2. Selecting clean recovery points.
3. Restoring domain controllers in the correct sequence.
4. Validating directory replication and authentication.
5. Resetting compromised credentials where required.
6. Reconnecting dependent systems after validation.

Test the recovery procedure regularly in a controlled environment. An untested backup does not prove that your organization can recover its AD forest.

How to Audit Active Directory Security Before and After Hardening

Active Directory hardening should begin with an assessment of the existing environment. Otherwise, administrators may overlook inherited permissions, application dependencies, or hidden administrative access paths.

Use this workflow to organize the assessment.

Step 1: Inventory the Active Directory environment

Record domain controllers, domains, forests, trusts, privileged accounts, service accounts, and identity integrations. Include systems that can administer or recover AD.

Step 2: Establish a security baseline

Review Group Policy settings, authentication configurations, domain controller security, and privileged group membership. Document the current state before making changes.

Step 3: Identify weaknesses and attack paths

Use tools such as BloodHound and PingCastle to identify excessive permissions and risky relationships. Confirm findings against actual directory configurations.

Step 4: Prioritize the findings

Rank weaknesses according to exposure, privilege level, business impact, and exploitability. Address critical identity infrastructure and privileged access paths first.

Step 5: Apply changes in a controlled sequence

Test changes in a suitable environment before production deployment. Document each modification and maintain a rollback plan.

Step 6: Validate the results

Check authentication, directory replication, Group Policy processing, and application connectivity. Review security logs for unexpected behavior.

Step 7: Repeat the assessment

Schedule regular reviews and monitor configuration drift. Reassess the environment after major infrastructure changes, security incidents, and new application deployments.

This process makes security improvements measurable. It also helps administrators distinguish completed configuration changes from controls that still need validation.

Active Directory Hardening Checklist

Use this checklist during routine security reviews and after significant AD configuration changes.

• Review privileged group membership and delegated permissions.
• Remove unnecessary administrative accounts and access rights.
• Separate privileged accounts from everyday user accounts.
• Implement tiered administration and secure administrative hosts.
• Deploy Windows LAPS on supported systems.
• Review service accounts and migrate suitable workloads to gMSAs.
• Check Kerberos pre-authentication and encryption settings.
• Protect KRBTGT credentials and follow approved rotation procedures.
• Apply MFA to supported privileged access paths.
• Review and disable unnecessary legacy protocols.
• Harden and patch domain controllers.
• Review password policies and account lockout settings.
• Audit delegation, sensitive permissions, GPOs, and AD CS.
• Monitor DCSync activity and Shadow Credentials.
• Protect backups and test forest recovery procedures.

Frequently Asked Questions About Active Directory Hardening

What are the most common Active Directory security risks?

Common risks include excessive privileges, weak service account passwords, insecure delegation, outdated authentication protocols, and unpatched domain controllers. Poor monitoring and untested recovery procedures can also increase the impact of a compromise.

How often should administrators audit Active Directory?

Review privileged access and security logs regularly. Conduct broader configuration assessments at planned intervals and after major infrastructure changes. Also, reassess the environment after security incidents or significant changes to identity systems.

Which tools can identify Active Directory vulnerabilities?

BloodHound helps identify relationships and potential privilege escalation paths. PingCastle assesses AD configurations and reports security weaknesses. Microsoft security tools and centralized logging platforms also support configuration reviews and threat detection.

Does Active Directory hardening prevent privilege escalation?

Hardening reduces the opportunities attackers can exploit to escalate privileges. Least-privilege access, credential isolation, secure authentication, and permission reviews make attacks harder. However, no single control eliminates every privilege escalation path.

Can administrators harden Active Directory without downtime?

Many security reviews and permission changes can happen without planned downtime. However, protocol restrictions, authentication changes, and domain controller updates may affect dependent systems. Test changes first and schedule disruptive work carefully.

Conclusion

Active Directory hardening requires regular reviews of accounts, permissions, authentication, and domain controller configurations. Administrators must also monitor directory activity and maintain tested recovery procedures. Start with privileged access and identity infrastructure, then address legacy configurations and hidden attack paths. Finally, repeat the assessment as your environment changes. Consistent reviews help reduce exposure and limit the impact of an AD compromise.