To adequately protect an Active Directory deployment, one must first identify all assets that the deployment is comprised of. This is the first step, because to protect any system, one must first be able to put a security perimeter around all of its components.

Every Active Directory deployment is comprised of the following assets -

1. Logical Structure - Every Active Directory deployment is at a minimum, comprised of an Active Directory forest, which contains one or more Active Directory domains that share a common Configuration and Schema partition. There exist automatic two-way trust relationships between all domains in a forest. In addition, trust relationships can also be established between two Active Directory forests, and/or an Active Directory domain and an external Active Directory domain or a Kerberos realm.

2. Domain Controllers - Every domain in an Active Directory deployment is hosted on one or more special-purpose computers known as Domain Controllers (DCs), that operate on the Windows Server operating system and host the Active Directory service. On each DC, a collection of services and processes known as the Directory Service Agent (DSA), a part of the local system authority (LSA) subsystem, provides authenticated access to the physical data store via various access mechanisms.

Note - Secure Administrative Workstations (SAWs) - A SAW is a special-purpose locked-down designated computer that is used by a system's administrator(s) solely for the purpose of administering the system. The administrators that logon to and engage in administrative functions on a SAW usually do so in administrative security contexts. Consequently, every SAW in use by the administrators of Active Directory must be considered as valuable as a Domain Controller and it must be afforded the same level of physical network and systems security that is afforded to Domain Controllers.



3. Active Directory Contents - Beyond the Active Directory service itself, it is the contents of an Active Directory that are arguably its most valuable assets, and are the raison d'etre that Active Directory actually exists and needs to be highly secured. The actual contents of Active Directory are stored in domain partitions. In addition to all the domain partitions in a forest, the Schema partition contains Schema definitions and the Configuration partition contains critical service configuration data.

   Note - The entire contents of Active Directory, i.e. all domain user accounts, computer accounts, security groups, OUs, containers etc., the domain computer accounts of all DCs and SAWs, as well as all Active Directory administrative accounts and groups are secured by Active Directory's security model. Specifically, every object in every partition in Active Directory is secured by an access control list (ACL) in which reside security permissions that specify what access various security principals have to the object, and it is the resulting effective permissions that determine the access that is actually allowed.
   
   

4. Administrative Access - Every Active Directory forest, domain and domain-controller has at least one and usually many accounts and security groups that are the designated administrators of these various components of an Active Directory forest. The collective of all accounts and security groups that have administrative  access in Active Directory, whether by default (e.g. Enterprise Admins, Domain Admins etc.) or by custom access provisioning or delegation, comprise this important category.

5. Active Directory Backups - Active Directory is a mission-critical service and it can be backed-up onto physical media, so as to be able to recover the "System" in the event of an incident, contingency or a diaster scenario. Active Directory backups are an equally high-value asset because the data they contain can be used to offline restore an Active Directory and subsequently obtain access to the entirety of its contents, including the credentials of all domain administrative and other accounts.

+

6. Critical Dependencies -

   DNS Infrastructure - Active Directory relies on DNS (Domain Naming System) for its proper functioning, and thus has a mission-critical dependency on DNS. Consequently, the security of the DNS infrastructure is critical for Active Directory.
   PKI Infrastructure - At organizations that utilize PKI, such as using Active Directory Certificate Services (AD CS) for client or server authentication, the compromise of the PKI infrastructure could result in the compromise of Active Directory.
   Windows Time Service - In Active Directory environments, Kerberos is the default authentication protocol, and it has a critical dependency on the Time Service. Consequently, the security of the Time Service is critical for Active Directory.

Consequently, securing an Active Directory deployment involves ensuring a sound logical structure and protecting all DCs and SAWs, the contents of all partitions, all administrative accounts and groups, all AD backups, and all critical dependencies.