https://www.activedirectoryhardening.com/en/blog Latest from Blog en Mon, 28 Sep 2026 17:42:59 GMT https://www.activedirectoryhardening.com/en/blog/active-directory-hardening-checklist https://www.activedirectoryhardening.com/en/blog/active-directory-hardening-checklist A prioritised 30/60/90-day Active Directory hardening checklist: measure first, stop the easy domain takeovers, close relay paths, then build structure. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/attack-path-management https://www.activedirectoryhardening.com/en/blog/attack-path-management Use BloodHound defensively: tag Tier Zero correctly, find choke points, fix attack paths in the right order, and track exposure over time with safe collection. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/disable-llmnr-netbios-wpad https://www.activedirectoryhardening.com/en/blog/disable-llmnr-netbios-wpad Remove the name-resolution fallbacks attackers poison: disable LLMNR, NetBIOS and mDNS by GPO and DHCP, and block WPAD with the DNS global query block list. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/enterprise-access-model https://www.activedirectoryhardening.com/en/blog/enterprise-access-model Why Microsoft retired ESAE as the default, what the enterprise access model asks you to build instead, and when a bastion forest or PAM trust still makes sense. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/forest-recovery-plan https://www.activedirectoryhardening.com/en/blog/forest-recovery-plan Build an Active Directory forest recovery runbook from Microsoft's guide: clean room, first DC restore, SYSVOL, FSMO, RID pool, krbtgt resets and yearly drills. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/security-baselines-gpo https://www.activedirectoryhardening.com/en/blog/security-baselines-gpo Deploy Microsoft security baselines with Group Policy: SCT, Policy Analyzer gap analysis, LGPO testing, ring-based rollout, exceptions and drift checks. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/ad-backup-ransomware https://www.activedirectoryhardening.com/en/blog/ad-backup-ransomware Design AD backups that survive ransomware: system state per domain, DSRM passwords, immutable and offline copies, a backup system outside the AD it protects. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/adminsdholder-sdprop https://www.activedirectoryhardening.com/en/blog/adminsdholder-sdprop Baseline the AdminSDHolder ACL, find orphaned adminCount=1 accounts, reset their ACLs safely, trigger SDProp on demand, and alert on AdminSDHolder changes. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/authentication-policies-silos https://www.activedirectoryhardening.com/en/blog/authentication-policies-silos Restrict where Tier 0 admins can authenticate with AD authentication policies and silos: prerequisites, claims, TGT lifetime, audit mode and enforcement. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/gpo-permissions-audit https://www.activedirectoryhardening.com/en/blog/gpo-permissions-audit Find who can edit, create and link GPOs in Active Directory: GPO ACLs, gPLink rights on OUs and sites, Group Policy Creator Owners and WMI filters. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/kerberoasting-defense https://www.activedirectoryhardening.com/en/blog/kerberoasting-defense Shrink Kerberoasting and AS-REP roasting exposure: inventory SPNs, remove stale ones, move to gMSA and AES, deploy a honey SPN and detect RC4 4769 spikes. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/pingcastle-assessment https://www.activedirectoryhardening.com/en/blog/pingcastle-assessment Run a PingCastle health check on Active Directory, read the four risk scores correctly, triage findings into owners and sprints, and track progress over time. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/remove-gpp-passwords https://www.activedirectoryhardening.com/en/blog/remove-gpp-passwords Find every Group Policy Preferences cpassword in SYSVOL, backups and client caches, map it to the exposed account, rotate it and stop it coming back. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/restrict-ntlm https://www.activedirectoryhardening.com/en/blog/restrict-ntlm A step-by-step NTLM reduction plan: audit with events 8001-8004, fix the causes, build an exception list, remove NTLMv1 and set LmCompatibilityLevel 5. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/sid-filtering-selective-authentication https://www.activedirectoryhardening.com/en/blog/sid-filtering-selective-authentication Configure and verify SID filtering, quarantine and selective authentication on AD trusts with netdom and PowerShell, including trustAttributes and events. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/sid-history-cleanup https://www.activedirectoryhardening.com/en/blog/sid-history-cleanup Find, assess and safely remove sIDHistory left over from domain migrations: dangerous SIDs, ACL re-permissioning, staged removal, rollback limits and detection. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/smb-signing-enforcement https://www.activedirectoryhardening.com/en/blog/smb-signing-enforcement Enforce SMB signing on clients and servers, understand Windows 11 24H2 and Server 2025 defaults, audit SMBv1 use, and remove it without breaking file access. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/dcsync-rights-audit https://www.activedirectoryhardening.com/en/blog/dcsync-rights-audit Audit who holds DS-Replication-Get-Changes-All and equivalent rights on the domain root, remove the ones that should not exist, and alert on DCSync. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/domain-controller-firewall https://www.activedirectoryhardening.com/en/blog/domain-controller-firewall Build a domain controller firewall policy: required AD ports, restricted RPC, no internet egress, and RDP/WinRM only from Tier 0 PAWs. Measure first. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT https://www.activedirectoryhardening.com/en/blog/honeytokens-deception https://www.activedirectoryhardening.com/en/blog/honeytokens-deception Deploy honey accounts, honey SPNs, AS-REP decoys, fake GPP passwords and read-audited decoy objects in AD, and alert on them with near-zero false positives. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT