Guide
Active Directory hardening checklist: a 30/60/90-day plan
A prioritised 30/60/90-day Active Directory hardening checklist: measure first, stop the easy domain takeovers, close relay paths, then build structure.
Foundation
Florian Amette
Security engineer writing practical, baseline-aligned hardening guides for Active Directory: identity, Kerberos, delegation and domain controllers.
Object & ACL Security
Attack path management with BloodHound for defenders
Use BloodHound defensively: tag Tier Zero correctly, find choke points, fix attack paths in the right order, and track exposure over time with safe collection.
Advanced
NTLM & Legacy Protocols
Disable LLMNR, NBT-NS, mDNS and WPAD in AD
Remove the name-resolution fallbacks attackers poison: disable LLMNR, NetBIOS and mDNS by GPO and DHCP, and block WPAD with the DNS global query block list.
Foundation
Trusts & Forest Design
ESAE Red Forest vs the enterprise access model in 2026
Why Microsoft retired ESAE as the default, what the enterprise access model asks you to build instead, and when a bastion forest or PAM trust still makes sense.
Advanced
Assessment, Backup & Recovery
Writing and rehearsing an AD forest recovery plan
Build an Active Directory forest recovery runbook from Microsoft's guide: clean room, first DC restore, SYSVOL, FSMO, RID pool, krbtgt resets and yearly drills.
Advanced
Group Policy & SYSVOL
Deploying Microsoft security baselines with GPO
Deploy Microsoft security baselines with Group Policy: SCT, Policy Analyzer gap analysis, LGPO testing, ring-based rollout, exceptions and drift checks.
Intermediate
Assessment, Backup & Recovery
Protecting Active Directory backups from ransomware
Design AD backups that survive ransomware: system state per domain, DSRM passwords, immutable and offline copies, a backup system outside the AD it protects.
Intermediate
Object & ACL Security
AdminSDHolder and SDProp: cleanup and monitoring
Baseline the AdminSDHolder ACL, find orphaned adminCount=1 accounts, reset their ACLs safely, trigger SDProp on demand, and alert on AdminSDHolder changes.
Intermediate
Tier 0 & Privileged Access
Authentication policies and silos for Tier 0 accounts
Restrict where Tier 0 admins can authenticate with AD authentication policies and silos: prerequisites, claims, TGT lifetime, audit mode and enforcement.
Advanced
Group Policy & SYSVOL
Auditing GPO permissions and gPLink rights
Find who can edit, create and link GPOs in Active Directory: GPO ACLs, gPLink rights on OUs and sites, Group Policy Creator Owners and WMI filters.
Intermediate
Kerberos & Authentication
Defending against Kerberoasting and AS-REP roasting
Shrink Kerberoasting and AS-REP roasting exposure: inventory SPNs, remove stale ones, move to gMSA and AES, deploy a honey SPN and detect RC4 4769 spikes.
Foundation
Assessment, Backup & Recovery
PingCastle assessment: from AD report to action plan
Run a PingCastle health check on Active Directory, read the four risk scores correctly, triage findings into owners and sprints, and track progress over time.
Foundation
Group Policy & SYSVOL
Finding and removing GPP passwords (cpassword)
Find every Group Policy Preferences cpassword in SYSVOL, backups and client caches, map it to the exposed account, rotate it and stop it coming back.
Foundation
NTLM & Legacy Protocols
Audit and restrict NTLM in Active Directory
A step-by-step NTLM reduction plan: audit with events 8001-8004, fix the causes, build an exception list, remove NTLMv1 and set LmCompatibilityLevel 5.
Advanced
Trusts & Forest Design
SID filtering and selective authentication, step by step
Configure and verify SID filtering, quarantine and selective authentication on AD trusts with netdom and PowerShell, including trustAttributes and events.
Intermediate
Trusts & Forest Design
Cleaning up SIDHistory after AD migrations
Find, assess and safely remove sIDHistory left over from domain migrations: dangerous SIDs, ACL re-permissioning, staged removal, rollback limits and detection.
Intermediate
NTLM & Legacy Protocols
Require SMB signing and disable SMBv1 domain-wide
Enforce SMB signing on clients and servers, understand Windows 11 24H2 and Server 2025 defaults, audit SMBv1 use, and remove it without breaking file access.
Foundation
Object & ACL Security
Finding and removing DCSync rights in Active Directory
Audit who holds DS-Replication-Get-Changes-All and equivalent rights on the domain root, remove the ones that should not exist, and alert on DCSync.
Foundation
Domain Controller Hardening
Firewalling domain controllers: ports, egress, admin access
Build a domain controller firewall policy: required AD ports, restricted RPC, no internet egress, and RDP/WinRM only from Tier 0 PAWs. Measure first.
Intermediate
Auditing, Logging & Detection
AD honeytokens: honey accounts, honey SPNs and decoys
Deploy honey accounts, honey SPNs, AS-REP decoys, fake GPP passwords and read-audited decoy objects in AD, and alert on them with near-zero false positives.
Intermediate
Kerberos & Authentication
Rotating the krbtgt password safely in Active Directory
Rotate krbtgt without an outage: New-KrbtgtKeys.ps1, replication checks, RODC krbtgt accounts, a routine schedule and the incident-mode double reset.
Intermediate
NTLM & Legacy Protocols
Enforce LDAP signing and channel binding on DCs
Roll out LDAP signing and channel binding with evidence: collect events 2887, 2889 and 3039, fix clients, then set LdapEnforceChannelBinding safely.
Intermediate
Delegation
Set ms-DS-MachineAccountQuota to 0 and delegate joins
Stop any domain user from creating computer accounts: set ms-DS-MachineAccountQuota to 0, find who relies on it, and delegate domain join to an OU.
Foundation
Passwords & Service Accounts
AD password policy that works: length, FGPP, blocklists
Build an Active Directory password policy on NIST guidance: long passphrases, fine-grained password policies, banned and breached password checks, no rotation.
Foundation
Tier 0 & Privileged Access
Building privileged access workstations (PAWs) for AD
Design and build PAWs for Tier 0 admins: hardware, clean image, App Control allowlisting, no internet or email, and when a jump server is not enough.
Intermediate
AD Certificate Services
Strong certificate mapping (KB5014754) in practice
Get certificate authentication ready for KB5014754 Full Enforcement: SID extension, altSecurityIdentities, KDC events 39/40/41 and the fixes that work.
Advanced
Auditing, Logging & Detection
Windows Event Forwarding for domain controllers
Build a Windows Event Forwarding pipeline for DCs: source-initiated subscriptions, GPO, log access, XPath queries, collector sizing and health checks.
Intermediate
Auditing, Logging & Detection
Active Directory security event IDs: a DC reference
Every AD security event ID worth collecting on domain controllers: logon, Kerberos, NTLM, account, group, directory and AD CS events, with fields to hunt.
Foundation
AD Certificate Services
Auditing AD CS certificate templates for ESC1-ESC4
Audit every AD CS certificate template for ESC1-ESC4: subject flags, EKUs, enrollment rights and template ACLs, with PowerShell and a safe fix order.
Intermediate
AD Certificate Services
Securing AD CS web enrollment against ESC8 and ESC11
Close NTLM relay to AD CS: find HTTP enrollment endpoints, enforce HTTPS and EPA, disable NTLM, remove Web Enrollment and enforce RPC encryption.
Intermediate
Domain Controller Hardening
Blocking authentication coercion on domain controllers
Shut down PrinterBug, PetitPotam, DFSCoerce and ShadowCoerce on DCs with RPC filters, service reduction and relay-proof targets, then verify it holds.
Advanced
Delegation
Constrained delegation and RBCD done safely in AD
Configure KCD and RBCD without new attack paths: protocol transition, SPN scoping, and auditing who can write msDS-AllowedToActOnBehalfOfOtherIdentity.
Advanced
Kerberos & Authentication
Disable RC4 in Kerberos: audit, fix and enforce AES
Remove RC4 from Kerberos safely: audit 4768/4769, fix accounts without AES keys, set msDS-SupportedEncryptionTypes and DefaultDomainSupportedEncTypes, enforce.
Intermediate
Passwords & Service Accounts
Migrating service accounts to gMSA and dMSA
Step-by-step migration from static service accounts to gMSA and Windows Server 2025 dMSA: KDS root key, retrieval rights, per-app notes and rollback.
Intermediate
Tier 0 & Privileged Access
Identify Tier 0 assets: a complete AD inventory method
Inventory every Tier 0 asset in Active Directory: DCs, AD CS, Entra Connect, backup, hypervisors, and the groups and ACLs that give indirect control.
Foundation
Domain Controller Hardening
Netlogon secure channel hardening after ZeroLogon
Enforce Netlogon secure RPC and sealing after ZeroLogon and CVE-2022-38023: audit events 5827-5831 and 5838-5839, empty the allowlist, verify.
Intermediate
Delegation
Remove unconstrained delegation from AD servers
Find every non-DC account trusted for unconstrained delegation, map what depends on it, and migrate to constrained delegation or RBCD without outages.
Intermediate
Passwords & Service Accounts
Deploying Windows LAPS: schema, permissions, policy
Deploy Windows LAPS end to end: schema update, OU permissions, encryption, AD vs Entra backup, GPO settings, legacy LAPS migration and verification.
Foundation
Object & ACL Security
Auditing Active Directory ACLs before an attacker does
How to find dangerous AD ACLs like GenericAll and DCSync rights, clean up stale adminCount flags, and use BloodHound defensively.
Foundation
Delegation
Active Directory delegation: finding and fixing risky trusts
Audit unconstrained, constrained, and resource-based constrained delegation in Active Directory, and lock down privileged accounts against abuse.
Foundation
Assessment, Backup & Recovery
AD assessment, backup and forest recovery
Run recurring AD posture assessments against CIS and Microsoft baselines, protect Tier 0 backups, and rehearse forest recovery before you need it for real.
Foundation
Auditing, Logging & Detection
AD auditing and detection: audit policy and event IDs
Configure Advanced Audit Policy, SACLs, and Windows Event Forwarding so you can actually see Kerberoasting, DCSync, and privilege escalation in AD.
Foundation
Trusts & Forest Design
Hardening AD trusts and forest boundaries
Why the forest — not the domain — is the AD security boundary, and how to lock down trusts with SID filtering, quarantine, and selective authentication.
Intermediate
AD Certificate Services
AD CS hardening: closing ESC1-ESC8 misconfigurations
Harden Active Directory Certificate Services against ESC1-ESC8 misconfigurations with template controls, EPA, and enrollment monitoring.
Intermediate
Domain Controller Hardening
Domain controller hardening: the DC baseline
A practical checklist for hardening domain controllers: security baselines, Print Spooler, logon rights, RDP, egress, and patch priorities.
Foundation
Group Policy & SYSVOL
Group Policy and SYSVOL hardening
Lock down GPO delegation, purge Group Policy Preferences cpassword secrets from SYSVOL, and add change control to prevent silent GPO abuse.
Foundation
Kerberos & Authentication
Kerberos hardening: RC4, roasting and golden tickets
Enforce AES-only Kerberos, disable RC4 and DONT_REQ_PREAUTH, rotate krbtgt correctly, and detect Kerberoasting and golden ticket abuse.
Foundation
NTLM & Legacy Protocols
Stop NTLM relay: LDAP, SMB signing and LLMNR
Harden LDAP signing, LDAP channel binding, SMB signing, and disable LLMNR/NBT-NS to shut down NTLM relay paths against domain controllers.
Foundation
Passwords & Service Accounts
Service account hardening: gMSA, SPNs and LAPS
A practical guide to replacing risky service accounts with gMSA/dMSA, cleaning SPN exposure, fine-grained password policies, and Windows LAPS.
Foundation
Tier 0 & Privileged Access
Tier 0 and privileged access: locking down Domain Admins
Build a working Tier 0 boundary in Active Directory with separate admin accounts, logon restrictions, PAWs, and authentication policy silos.
Foundation