Home > How-Tos

Active Directory Security How-Tos

Active Directory Security How-Tos

To secure Active Directory, one must implement adequate security measures to sufficiently protect all Active Directory assets that comprise the Active Directory attack surface from risks to Active Directory enactable via Active Directory attack vectors.


The following asset-focused guidance provides step-by-step directions on exactly how to implement the various security measures that organizations need to enact to protect their Active Directory assets -


Note – The implementation of many security measures require the use of tooling (e.g. Active Directory Users and Computers, netdom etc.) to fulfill a specific need. In each case, the only tools known to the author that can fulfill a specific need have been used and specified to perform these security measures.


  1. Security measures to secure and protect Domain Controllers -

    1. Provide and ensure the highest level of physical security for all Domain Controllers (DCs)

      1. How to install DCs in separate, dedicated, physically secure (locked) racks or cages

        This security measure is simple, self-explanatory and straight-forward to understand and does not require specific operational guidance.

        Note - The one cardinal rule that must be adhered to is to ensure that no one other than designated Active Directory administrators (i.e. Domain Admin level equivalent designated admins) either have or are able to obtain unsrestricted physical access to any DC in any Active Directory forest. Ideally, no one should be able to gain restricted physical access as well, as even possessing restricted physical access could be used to try and compromise a DC; for instance, someone with restricted physical access could install a physical keystroke logger or insert a malicious USB drive.

      2. How to configure DCs with Trusted Platform Module (TPM) chips and protect all volumes with BitLocker Drive Encryption

        This security measure is simple, self-explanatory and straight-forward to understand and does not require any operational guidance.


      3. How to ensure that virtualized DCs run on physical hosts that are separate from other virtual machines in the environment

        This security measure is simple, self-explanatory and straight-forward to understand and does not require specific operational guidance.

        Note - As far as possible, one should not co-locate virtualized DCs with other, less-sensitive VMs on the same physical virtualization servers. One should also be aware that when using virtualized DCs, the host machine should be considered as valuable and important as any DC, and that its physical security, system security and network security must be afforded the same level of protection as are DCs. Finally, in such cases, one should also assume that anyone (and everyone) who has local admin access to the host machine is as powerful as an Enterprise Admin in the forest.

    2. Configure and ensure the highest levels of system security for all Domain Controllers (DCs)

      1. How to establish and implement secure Domain Controller (DC) build practices

        Overview – To implement this security measure, one needs to automate the DC build process.

        How-To:

        1. Begin by ensuring the physical environment wherein DCs will be built, is highly secure, both from a physical security and network security perspective
        2. Identify and standardize the server hardware upon which to operate your DCs, considering your organization's unique needs and constraints
        3. Next, manually install Windows Sever on a single such (standardized) server, and appropriately configure all security and other settings on it
          4. Note - Providing detailed guidance on how to configure all the security settings required to secure a Windows Server host is currently outside of the scope of this undertaking.
        4. Create an image of that server, and ideally, configure it to launch the Active Directory setup process (based on an answer file) automatically upon start
        5. Store this 'master' image in a secure location, and ensure that access to it is restricted to only highly-trustworthy Domain Admin equivalent IT personnel
          6. Note - This 'master' image must be afforded the same level of security as an Active Directory backup, because its compromise could be used to compromise the entire Active Directory forest.
        6. To install a new DC, simply re-image a new (pristine) trustworthy server (with standardized hardware) using the 'master' image created in the last step, then restart it
        7. Upon restart, the Active Directory installation process should automatically be launched. Complete the installation process, and restart it. Upon restart, it will be a new DC
          8. Note - The Active Directory installation process will require entering administrative credentials to successfully install Active Directory and complete the installation.



      2. How to operate DCs on the latest version of Windows Server that is supported by your organization to leverage the latest security capabilities

        This security measure is simple, self-explanatory and straight-forward to understand and does not involve or require any operational guidance.


      3. How to configure secure system policy settings for all DCs by securely configuring the Default Domain Controllers Policy group policy (settings)

        Overview – To implement this security measure, one needs to configure the default Domain Controller Policy settings in Active Directory.

        How-To:

        1. Launch the Group Policy Editor (gpmc.msc), navigate to the current domain (under Domains) and locate the "Default Domain Controllers Policy"
        2. Right-click on it, and select Edit to open the Group Policy Management Editor
        3. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies
        4. Next, click on the relevant policy (Audit Policy, User Rights Assignment, Security Options) to view its various settings
        5. For each selected policy category, the list of all policies that belong to the category will be displayed in the right-pane
        6. Select a policy setting, and configure it as recommended in the Securing the Domain Controllers Policy recommendations



      4. How to minimize and lockdown services running on all DCs

        Overview – To implement this security measure, one needs to one needs to configure the service startup mode for various services, in the default Domain Controller Policy settings in Active Directory.

        How-To:

        1. Begin by acquainting yourself with and learning about the 90+ services that run on Domain Controllers by default
        2. Contact your Microsoft representative and ask them to provide official guidance on which of these services can be disabled to reduce the attack surface
        3. Once you have this list, launch the Group Policy Editor (gpmc.msc), navigate to the current domain (under Domains) and locate the "Default Domain Controllers Policy"
        4. Right-click on it, and select Edit to open the Group Policy Management Editor
        5. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > System Services
        6. Next, for each service that can be disabled, check the Define this policy setting checkbox, select the Disabled option (radio button), and click the OK button.
          7. Note - Providing detailed guidance on which of the 200+ services can be disabled on Domain Controllers is currently outside of the scope of this undertaking.



      5. How to employ a separate, secure patch management process for DCs and ensure that all DCs are always completely patched, and up-to-date

        This security measure is simple, self-explanatory and straight-forward to understand and does not involve or require any operational guidance.


      6. How to configure comprehensive security auditing and event monitoring on all DCs to enable the detection of suspicious/nefarious activities

        Overview – To implement this security measure, one needs to enable auditing via the default Domain Controller Policy in Active Directory, and then specify what categories and subcategories of events should be audited.

        How-To:

        1. Launch the Group Policy Editor (gpmc.msc), navigate to the current domain (under Domains) and locate the "Default Domain Controllers Policy"
        2. Right-click on it, and select Edit to open the Group Policy Management Editor
        3. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy
        4. Next, for each policy setting in Audit Policy, configure it as recommended in the Audit Policy section of Securing the Domain Controllers Policy
        5. Then, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
        6. In it, locate and enable the Security Option  Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
        7. Then, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies
        8. In it, configure each audit policy subcategory as recommended in the Configuring Active Directory Auditing recommendations



      7. How to perform all management operations from remote, dedicated SAWs (Secure Admin Workstations) (, aka PAWs (Privileged Access Workstations))

        Overview – To implement this security measure, one needs to create dedicated Secure Admin Workstations (SAWs), configure logon options, install appropriate tooling on them and use them to perform all managements operations.

        How-To:

        1. Create specialized, highly-secure and dedicated SAWs to perform all directory services management operations
          2. Note - Providing detailed guidance on how to create dedicated SAWs and adequately configure their security is currently outside of the scope of this undertaking.
        2. Configure the Allow log on locally and Allow log on through Remote Desktop Services group policy options to ensure that only authorized Active Directory admins can log on to them
          3. Note - Ideally, you should also configure the Deny log on locally and Deny log on through Remote Desktop Services group policy options to ensure that no other security principals can log on to any of these SAWs.
        3. Download and install Remote Server Administrative Tools (RSAT) for Windows Server on these SAWs to be able to perform all required directory services management operations
        4. Obtain and install other additional tooling that may be required to administer and secure directory services and to assess and manage access to Active Directory's vital contents
          5. Note - The trustworthiness of each and every tool used by Active Directory administrative personnel is paramount. Consequently, ensure that any tools you install meet the highest security standards for such tooling.
        5. Use the installed Remote Server Administrative Tools and any other obtained tools on these SAWs to be able to perform all required directory services management operations



    3. Lockdown and ensure the highest levels of network security for all Domain Controllers (DCs)

      1. How to entirely restrict Internet access to and from all DCs (; configure firewalls to allow any and all required intersite communications.)

        This security measure is simple, self-explanatory and straight-forward to understand and does not involve or require any operational guidance.

        Note - The list of network ports required for the normal functioning of Active Directory can be found here.

      2. How to configure perimeter firewalls to block all outbound connections from DCs to the Internet

        This security measure is simple, self-explanatory and straight-forward to understand and does not involve or require any operational guidance.

        Note - The list of network ports required for the normal functioning of Active Directory can be found here.

      3. How to disable and prevent the use of Web browsers on all DCs

        This security measure is simple, self-explanatory and straight-forward to understand and does not involve or require any operational guidance.

        Note - Apart from achieving this technically, as a part of your organization's secure administrative practices, your Active Directory personnel must not engage in the insecure practice of using a browser to browse anything while logged on to a DC.

    4. Secure access provisioned on the domain computer accounts representing Domain Controllers (DCs) in Active Directory

      1. How to assess and ensure that only authorized individuals can change the security permissions on all domain controller computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all domain controller accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain controller account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the DC's computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the DC's computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each Domain Controller's computer account.


          Note - To automatically assess the above on all DC domain computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #37 - Who can change the security permissions protecting computer accounts?, specify DC OU's DN as Scope and click Run.


      2. How to assess and ensure that only authorized individuals can change the ownership of all domain controller computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all domain controller accounts in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain controller account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the DC's computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the DC's computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each Domain Controller's computer account.


          Note - To automatically assess the above on all DC domain computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #38 - Who can change the owner of computer accounts?, specify DC OU's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      3. How to assess and ensure that only authorized individuals can modify various Kerberos related settings on all domain controller computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all domain controller accounts in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain controller account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the DC's computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the DC's computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each Domain Controller's computer account.




    5. Secure access provisioned on the default Domain Controllers organizational unit (OU) in Active Directory

      1. How to assess and ensure that only authorized individuals can change the security permissions on the default Domain Controllers OU in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the default Domain Controllers OU in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the default Domain Controllers OU in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the Domain Controllers OU will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the Domain Controllers OU, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #65 - Who can change the security permissions protecting organizational units?, specify the default Domain Controllers OU's DN as Scope and click Run.


      2. How to assess and ensure that only authorized individuals can change the ownership of the default Domain Controllers OU in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on the default Domain Controllers OU in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the default Domain Controllers OU in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the Domain Controllers OU will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the Domain Controllers OU, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #66 - Who can change the owner of organizational units?, specify the default Domain Controllers OU's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      3. How to assess and ensure that only authorized individuals can change the list of group policies linked to the default Domain Controllers OU in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on the default Domain Controllers OU in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the default Domain Controllers OU in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the default Domain Controllers OU will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the default Domain Controllers OU will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the default Domain Controllers OU, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission
        10. After you have done so for all such unauthorized accounts, to verify that you have correctly locked down access, generate the same report again, and review the list of accounts displayed for the same two effective permissions

          11. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #60 - Who can change the list of group policies linked to organizational units?, specify the default Domain Controllers OU's DN as Scope and click Run.



    6. Protect all Active Directory domain controller computer accounts from Active Directory Privilege Escalation attacks

      1. How to identify and eliminate Active Directory Privilege Escalation paths leading to domain controller computer accounts in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all domain controller computer accounts in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of the domain controller's domain computer account in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the DC's computer account, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining domain controller computer accounts, and you will have accomplished this objective


          Note - If you select the report "Identify all privilege escalation paths leading to multiple objects in an Active Directory tree, and specify the DN of the default Domain Controllers OU as the Scope, you should be able to accomplish this objective in a single assessment.



    7. Protect all Active Directory domain controller computer accounts from various credential theft attacks

      1. How to protect Active Directory domain controller computer accounts from various credential theft attacks

        Overview – To implement this security measure, one needs to learn about the various credential theft attacks that pose a risk to domain controller domain computer accounts, then mitigate them.

        How-To:

        1. Review the section on credential theft attacks to learn about the various credential theft attacks that pose a risk to domain controller domain computer accounts, then enact the mitigation steps provided for each one of them



  2. Security measures to secure and protect Administrative Access -

    1. Designate Active Directory Administrators and provision access for them

      1. How to designate Active Directory Administrators and provision access for them

        Overview – To implement this security measure, one needs to formulate and execute a plan to designate Active Directory administrators, document their responsibilities, and provision the access needed to fulfill these responsbilitiies.

        How-To:

        1. Establish a business owner for Active Directory management, and have him/her identify all individuals that are to possess administrative access in Active Directory i.e. that are to be designated as Active Directory Admins
        2. Identify all Active Directory administrative/management operations that are to be under their purview, and create a simple operations document that details these operations, including how and when they are to be performed
        3. Identify all Active Directory targeted administrative/access functions that do not require unrestricted administrative access in Active Directory, and create a plan to delegate responsibilities for them amongst lesser privileged IT groups
        4. Establish how the designated Active Directory Admins will be provisioned administrative access in Active Directory (e.g. via membership in default AD admin groups) as well as how access for delegated responsibilities will be provisioned
        5. Create a single domain user alt account for each such individual, that is to be used solely as an administrative account by such designated individual, and provision the required access in Active Directory to grant them unrestricted access


    2. Identify all accounts and groups that currently possess administrative (privileged) access in Active Directory, and revoke all excessive administrative access in Active Directory

      1. How to correctly identify all privileged accounts and groups that currently possess administrative (privileged) access in Active Directory

        Overview – To implement this security measure, one needs to understand what constitutes privileged access in Active Directory, then identify who currently has such access provisioned in Active Directory.

        How-To:

        1. Begin by gaining an understanding of what constitutes unrestricted privileged access in Active Directory
        2. Next, gain an understanding of what constitutes restricted (delegated) privileged access in Active Directory
        3. Subsequently, learn how to identify who has unrestricted privileged access in Active Directory
        4. Similarly, learn how to identify who has restricted privileged access in Active Directory
        5. Based on the knowledge gained above, proceed to correctly identify all privileged accounts and groups that have both unrestricted and restricted privileged access in your Active Directory

          6. Note - To accomplish this measure, you will require the ability to accurately calculate who has what Active Directory Effective Permissions on numerous objects in your Active Directory. Two specific professional Microsoft-endorsed tools (one and two) could be immensely helpful.

          Caution - Beware of amatuer advice. The vast majority of advice online (including by many self-proclaimed experts) will suggest determining "who has what permissions in Active Directory". Unfortunately, engaging in simple permissions analysis is futile and woefully inadequate.


      2. How to make the necessary access changes to revoke all identified excessive administrative access in Active Directory

        Overview – To implement this security measure, one needs to identify the targets and the sources (underlying security permissions) of all excessive access, then tweak the ACLs* of the target objects to revoke the source permissions.

        How-To:

        1. Based on the previous security measure, create a list of all access that has been found to be excessive in nature. (Each entry could be of the form - User A can perform operation B on target C, and identified source permission is D)
        2. Next, for each item in this list, identify the specific object in Active Directory on which this excessive access has been found. (E.g. target C)
        3. Launch Active Directory Users and Computers, locate and navigate to this specified object, right-click to view Properties, then navigate to the Security tab, then click on Advanced to view all the security permissions (ACEs) in its ACL
        4. Then, locate and identify the exact identified source ACE in the ACL of this object that is the source permission of such found excessive access. (E.g. permission D)
        5. Finally, change the security principal specified in this ACE, or the group membership (if it is a group), or change the access specified in this ACE, to effectively revoke the excessive access that the identified user has on this object

          6. Repeat the above steps for each item in the list that documents the identified excessive access and you will have accomplished this security measure.


          An Example - The following simple hypothetical example illustrates how to enact this security measure -

          List Entry #1 - John Smith can change the membership of the Domain Admins security group, and the identified source permissions is – Allow  HelpDesk Team   Write All Properties

          In this example, user A is John Smith, operation B is change the membership of, target C is Domain Admins group and most importantly, source permissions D is Allow  HelpDesk Team   Write All Properties

          In terms of enacting step b above, the identified target Active Directory object is – Domain Admins security group. (CN=Domain Admins,CN=Users,DC=domain)

          In terms of enacting step c above, we launch Active Directory Users and Computers, locate the Domain Admins security group, and proceed to access and view its ACL

          In terms of enacting step d above, we scroll and find the identified source permission in the ACL – Allow  HelpDesk Team   Write All Properties

          In terms of enacting step e above, we can either change the security principal (HelpDesk Team), or remove John Smith's account from the HelpDesk Team security group, or modify the permissions granted in this ACE to say – Allow  HelpDesk Team   Read All Properties

          In this manner, we would have identified and revoked the excessive access that the user John Smith was found to have on the Domain Admins security group in Active Directory

          Technical Note - In a production AD, if we had to change the access on the Domain Admins security group, we would be modifying the ACL of the AdminSDHolder object. This was merely an illustrative example to show how to enact this important security measure.



    3. Secure all accounts and groups that possess administrative (privileged) access in Active Directory

      1. Secure the access provisioned on all administrative (privileged) accounts and groups in Active Directory

        1. How to assess and ensure that only authorized individuals can change security permissions on the AdminSDHolder object (CN=AdminSDHolder,CN=System,DC=...)

          Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the AdminSDHolder object in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
          4. The list of all accounts who can enact this operation on the AdminSDHolder object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #70 - Who can change the security permissions protecting containers?, specify the AdminSDHolder object's DN as Scope and click Run.


        2. How to assess and ensure that only authorized individuals can change the ownership of the AdminSDHolder object (CN=AdminSDHolder,CN=System,DC=...)

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
          4. The list of all accounts who can enact this operation on the AdminSDHolder object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #71 - Who can change the owner of containers?, specify the AdminSDHolder object's DN as Scope and click Run.


          Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

        3. How to assess and ensure that only authorized individuals can change the security permissions on all administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #24 - Who can change the security permissions protecting user accounts?, specify the admin account's OU's DN as Scope and click Run.


        4. How to assess and ensure that only authorized individuals can change the ownership of all administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #25 - Who can change the owner of user accounts?, specify the admin account's OU's DN as Scope and click Run.


          Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

        5. How to assess and ensure that only authorized individuals can change the security permissions on all administrative (privileged) groups in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
          4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative group in Active Directory.


            Note - To automatically assess the above on all administrative groups, launch Active Directory Privileged Access Assessor tooling, select report #50 - Who can change the security permissions protecting security groups?, specify the admin group's OU's DN as Scope and click Run.


        6. How to assess and ensure that only authorized individuals can change the ownership of all administrative (privileged) groups in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
          4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative group in Active Directory.


            Note - To automatically assess the above on all administrative groups, launch Active Directory Privileged Access Assessor tooling, select report #51 - Who can change the owner of security groups?, specify the admin group's OU's DN as Scope and click Run.


          Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

        7. How to assess and ensure that only authorized individuals can reset the passwords of all administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Extended Right - Reset Password Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Extended Right - Reset Password effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #3 - Who can reset user account passwords?, specify the admin account's OU's DN as Scope and click Run.


        8. How to assess and ensure that only authorized individuals can disable the use of smart cards on all administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #7 - Who can disable/enable smartcard requirement for interactive logon by user accounts?, specify the admin account's OU's DN as Scope and click Run.


        9. How to assess and ensure that only authorized individuals can enable disabled administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each user account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #4 - Who can disable/enable user accounts?, specify the admin account's OU's DN as Scope and click Run.


        10. How to assess and ensure that only authorized individuals can unlock locked administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - lockoutTime Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - lockoutTime effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each user account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #5 - Who can unlock locked user accounts?, specify the admin account's OU's DN as Scope and click Run.


        11. How to assess and ensure that only authorized individuals can unexpire expired administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - accountExpires Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - accountExpires effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each user account in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #6 - Who can change the expiration date of user accounts?, specify the admin account's OU's DN as Scope and click Run.


        12. How to assess and ensure that only authorized individuals can modify various Kerberos related settings on all administrative (privileged) accounts in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative accounts in Active Directory.

          How-To:

          1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
          4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative account.



        13. How to assess and ensure that only authorized individuals can change the membership of all administrative (privileged) groups in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Write Property - member Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - member effective permission
          4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative group in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #41 - Who can change security group memberships?, specify the admin group's OU's DN as Scope and click Run.


        14. How to assess and ensure that only authorized individuals can add one's own account to the membership of all administrative (privileged) groups in Active Directory

          Overview – To implement this security measure, one needs to determine who has sufficient Validated write - Add/Remove self as member Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

          How-To:

          1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
          2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
          3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Validated write - Add/Remove self as member effective permission
          4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
          5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

            6. Repeat the above steps for each administrative group in Active Directory.


            Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #42 - Who can add/remove onself to/from the membership of security groups?, specify the admin group's OU's DN as Scope and click Run.



      2. Configure appropriate security settings on all privileged accounts in Active Directory

        1. How to ensure that the Account is sensitive and cannot be delegated flag is set on all administrative accounts in Active Directory

          Overview – To implement this security measure, one needs to modify account options on the domain user accounts of all administrative accounts in Active Directory.

          How-To:

          1. Open Active Directory Users and Computers and navigate to the administrative domain user account
          2. Right-click on the account and select Properties

          3. Next, then click on the Account tab, and locate the Account Options section
          4. Scroll down the list of options and locate the option Account is sensitive and cannot be delegated
          5. Click on the check-box in front of this option to enable it, then click on OK to commit the change

            6. Repeat the above steps for each administrative account in Active Directory.




        2. How to enable the Smart card is required for interactive logon flag is set on all administrative accounts in Active Directory

          Overview – To implement this security measure, one needs to modify account options on the domain user accounts of all administrative accounts in Active Directory.

          How-To:

          1. Open Active Directory Users and Computers and navigate to the administrative domain user account
          2. Right-click on the account and select Properties

          3. Next, then click on the Account tab, and locate the Account Options section
          4. Scroll down the list of options and locate the option Smart card is required for interactive logon
          5. Click on the check-box in front of this option to enable it, then click on OK to commit the change

            6. Repeat the above steps for each administrative account in Active Directory.




        3. How to ensure that the Do not require Kerberos pre-authentication setting is unchecked on all administrative accounts in Active Directory

          Overview – To implement this security measure, one needs to modify account options on the domain user accounts of all administrative accounts in Active Directory.

          How-To:

          1. Open Active Directory Users and Computers and navigate to the administrative domain user account
          2. Right-click on the account and select Properties

          3. Next, then click on the Account tab, and locate the Account Options section
          4. Scroll down the list of options and locate the option Do not require Kerberos pre-authentication
          5. Ensure that the check-box in front of this option is unchecked, (and if it is checked, uncheck it,) then click on OK to commit the change

            6. Repeat the above steps for each administrative account in Active Directory.




        4. How to restrict the ability of all Active Directory administrative accounts to be able to logon on any domain-joined computers (except on DCs and SAWs)

          Overview – To implement this security measure, one needs to use Group Policy to deny all administrative accounts the ability to logon to all domain-joined machines (except DCs and SAWs).

          How-To:

          1. Launch the Group Policy Editor (gpmc.msc), navigate to an organizational unit (OU) that contains one or more domain-joined machines
          2. Based on your unique environment, either create a new GPO to link to this OU, or select an existing GPO that is already linked to this OU
          3. Right-click on it, and select Edit to open the Group Policy Management Editor
          4. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
          5. Locate the following User Rights - Deny access to this computer from the network, Deny log on as a batch job, Deny log on as a service, Deny log on locally and Deny log on through Remote Desktop Services
          6. Select each one of these user rights, check the Define these policy settings option, then click on Add User or Group to specify the security group(s) that contain your designated Active Directory administrative accounts
          7. Click the Apply button, then click the OK button

            8. Repeat the above steps for each OU in Active Directory that contains domain-joined machines except for i) the default Domain Controllers OU and ii) the OU that contains the domain computer accounts of your SAWs



    4. Protect all Active Directory administrative (privileged) accounts and groups from Active Directory Privilege Escalation attacks

      1. How to identify and eliminate Active Directory Privilege Escalation paths leading to the AdminSDHolder object in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to the AdminSDHolder object in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above, and you will have accomplished this objective




      2. How to identify and eliminate Active Directory Privilege Escalation paths leading to privileged accounts in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all privileged accounts in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a privileged account in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the privileged account, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining privileged accounts, and you will have accomplished this objective


          Note - If you select the report "Identify all privilege escalation paths leading to multiple objects in an Active Directory tree, and specify the DN of the OU containing all the privileged accounts as the Scope, you should be able to accomplish this objective in a single assessment.



      3. How to identify and eliminate Active Directory Privilege Escalation paths leading to privileged groups in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all privileged groups in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a privileged group in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the privileged group, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining privileged groups, and you will have accomplished this objective


          Note - If you select the report "Identify all privilege escalation paths leading to multiple objects in an Active Directory tree, and specify the DN of the OU/container containing all the privileged groups as the Scope, you should be able to accomplish this objective in a single assessment.



    5. Protect all Active Directory privileged accounts from various credential theft attacks

      1. How to protect Active Directory privileged user accounts from various credential theft attacks

        Overview – To implement this security measure, one needs to learn about the various credential theft attacks that pose a risk to Active Directory privileged user accounts, then mitigate them.

        How-To:

        1. Review the section on credential theft attacks to learn about the various credential theft attacks that pose a risk to Active Directory privileged user accounts, then enact the mitigation steps provided for each one of them


    6. How to only allow the use of Active Directory administrative (privileged) accounts on SAWs

      Overview – To implement this security measure, one needs to use Group Policy to deny all administrative accounts the ability to logon to all domain-joined machines (except SAWs).

      How-To:

      1. Launch the Group Policy Editor (gpmc.msc), navigate to an organizational unit (OU) that contains one or more domain-joined machines
      2. Based on your unique environment, either create a new GPO to link to this OU, or select an existing GPO that is already linked to this OU
      3. Right-click on it, and select Edit to open the Group Policy Management Editor
      4. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
      5. Locate the following User Rights - Deny access to this computer from the network, Deny log on as a batch job, Deny log on as a service, Deny log on locally and Deny log on through Remote Desktop Services
      6. Select each one of these user rights, check the Define these policy settings option, then click on Add User or Group to specify the security group(s) that contain your designated Active Directory administrative accounts
      7. Click the Apply button, then click the OK button

        8. Repeat the above steps for each OU in Active Directory that contains domain-joined machines except for the OU that contains the domain computer accounts of your SAWs

      8. Next, locate and navigate to the organizational unit (OU) that contains the domain computer accounts of your SAWs
      9. Based on your unique environment, either create a new GPO to link to this OU, or select an existing GPO that is already linked to this OU
      10. Right-click on it, and select Edit to open the Group Policy Management Editor
      11. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
      12. Locate the following User Rights - Allow log on locally and Allow log on through Remote Desktop Services
      13. Select each one of these user rights, check the Define these policy settings option, then click on Add User or Group to specify the security group(s) that contain your designated Active Directory administrative accounts
      14. Click the Apply button, then click the OK button

    7. Ensure that all tools used by Active Directory administrators are highly trustworthy

      Overview – To implement this security measure, one needs to perform basic due diligence to assess the trustworthiness of all tooling used by Active Directory administrators.

      How-To:

          Prior to the selection and use of a tool, obtain answers to the following questions to assess and evaluate its trustworthiness -

      1. Is this tooling accurate and trustworthy?
      2. Is this tooling developed by a trustworthy vendor?
      3. Is this tooling developed in the United States or in a foreign country?
      4. Are the architects of this tooling demonstrably proficient in the subject matter?
      5. Are the software developers (and testers) on the tool's development team U.S. citizens?
      6. Is the source-code for such tooling only located and stored in the United States, or in a foreign country?
      7. How much physical, system and network security are the development locations of this tooling afforded?
      8. Are there any foreign entities on the management team or that (directly or indirectly) own a stake in the vendor?
      9. Does the use of this tooling require privileged access in Active Directory or deployment of code on DCs? If so, why?
      10. Does the use of this tooling involve or require connectivity to any site on the Internet (including to the vendor's site)?

        11. Note - The importance of this security measure cannot be overstated. An organization can implement every security measure by the book, and yet be instantly (in one second) and completely compromised should even one tool used by its Active Directory administrators be untrustworthy.


    8. How to audit all critical changes made to all Active Directory privileged accounts and groups

      Overview – To implement this security measure, one needs to enable auditing of Audit Directory Services Access, then configure SACLs on all Active Directory objects that represent administrative accounts and groups in Active Directory.

      How-To:

      1. Enable auditing on Domain Controllers by configuring the Audit Policy in the default Domain Controller Policy
      2. Configure auditing to enable auditing of Active Directory Service Access events (both, category and sub-category)
      3. Configure SACLs in Active Directory as recommended in audit changes to Active Directory privileged accounts and groups.


    9. (Optional) How to audit the use of all Active Directory privileged accounts

      Note - Providing detailed guidance on how to audit the use of Active Directory privileged accounts is currently outside of the scope of this undertaking.

      Note 2 - One must keep in mind that any third-party solution being used to monitor the use of privileged accounts will invariably also end up running in System context on hosts onto which an organzation's Active Directory administrative personnel are logged on using their administrative credentials. Consequently, the security and trustworthiness of any such solution, akin to that of any credential vault, must be thoroughly vetted prior to selection and use. The guidance provided in the measure immediately preceding this one apply equally in regards to the consideration of any such solution.


  3. Security measures to secure and protect Active Directory Contents -

    1. Secure the domain root object

      1. How to identify and lockdown who can change security permissions on the domain root object

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the domain root object in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain('s root object) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the domain root object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the domain root object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission
          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #98 - Who can change the security permissions protecting the domain root?, specify the domain root object's DN as Scope and click Run.


      2. How to identify and lockdown who can change the ownership of the domain root object

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the domain root object in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain root object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the domain root object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the domain root object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission
          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #99 - Who can change the owner of the domain root?, specify the domain root object's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      3. How to identify and lockdown who can replicate secrets from the domain

        Overview – To implement this security measure, determine who has both, sufficient Get Replication Changes and Get Replication Changes extended rights Active Directory Effective Permissions on the domain root in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain root object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Extended Right - Get Replication Changes effective permission
        4. The list of all accounts who has this effective permission on the domain root object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Extended Right - Get Replication Changes All effective permission
        6. The list of all accounts who has this effective permission on the domain root object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the domain root object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission
          10. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #100 - Who can replicate secrets (i.e. password hashes) from the domain?, specify the domain root object's DN as Scope and click Run.


      4. How to identify and eliminate Active Directory Privilege Escalation paths leading to the domain root object in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to the domain root object in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of the domain root object in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the domain root object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above, and you will have accomplished this objective





    2. Secure all organizational units (OU) and containers in Active Directory

      1. How to identify and lockdown who can create organizational units in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - Organizational Unit Active Directory Effective Permissions on all instances of all object classes under which the Active Directory Schema permits the creation of organizational units in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to make this determination (e.g. the domain root or a specific OU) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - Organizational Unit effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to this specific Active Directory object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each object in Active Directory under which the Active Directory Schema permits the creation of organizational unit objects.


          Note - You can also automatically accomplish the same domain-wide with the Active Directory Privileged Access Assessor tooling. To do so, select report #57 - Who can create organizational units?, specify the domain root object's DN as Scope and click Run. This tooling can automatically determine all object classes under which the creation of organizational units is permitted, automatically identify all instances of all such classes and automatically determine the above effective permission on all such objects, domain-wide, in less than two minutes.


        Note - To identify and lockdown who can create containers in Active Directory, repeat the above steps, but do so on all objects under which the Schema permits creation of container objects, and on each such object, instead of identifying who has sufficient Create Child - Organizational Unit effective permissions, identify who has sufficient Create Child - Container effective permissions. Similar to the above, you can also automatically accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #67 - Who can create containers?.

      2. How to identify and lockdown who can change security permissions on organizational units in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all organizational units in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the organizational unit will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified organizational unit, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each organizational unit in Active Directory.


          Note - To automatically assess the above on all organizational units, launch Active Directory Privileged Access Assessor tooling, select report #65 - Who can change the security permissions protecting organizational units?, specify the domain's DN as Scope and click Run.


      3. How to identify and lockdown who can change the ownership of organizational units in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all organizational units in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the organizational unit will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified organizational unit, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each organizational unit in Active Directory.


          Note - To automatically assess the above on all organizational units, launch Active Directory Privileged Access Assessor tooling, select report #66 - Who can change the owner of organizational units?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      4. How to identify and lockdown who can delete organizational units in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all OUs in Active Directory, as well as who has sufficient Delete Child - Organizational Unit Active Directory Effective Permissions on the parent objects of all OUs in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on all ancestor objects of all OUs in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the organizational unit will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified OU, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the parent of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - Organizational Unit effective permission
        8. The list of all accounts who can enact this operation on the parent object of the OU will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified OU's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the parent of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the parent object of the OU will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified OU's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        14. Repeat steps j – m, on the parent of the parent, and so on, until you reach an object whose parent is the domain root. Once you have enacted all of these steps, you will have identified and locked-down who can delete an OU in Active Directory

          15. Repeat the above steps on each organizational unit in Active Directory.


          Note - To automatically assess the above on all organizational units, launch Active Directory Privileged Access Assessor tooling, select report #58 - Who can delete organizational units?, specify the domain's DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all (thousands of) relevant objects in Active Directory, and thus automates the entire process above to identify who can delete which OUs, and how, domain-wide in Active Directory, in just minutes.


      5. How to identify and eliminate Active Directory Privilege Escalation paths leading to organizational units in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all organizational units in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the organizational unit, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining organizational units, and you will have accomplished this objective





    3. Secure all privileged accounts and groups in Active Directory

      1. How to identify and lockdown who can change security permissions on the AdminSDHolder object (CN=AdminSDHolder,CN=System,DC=...)

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the AdminSDHolder object in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the AdminSDHolder object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #70 - Who can change the security permissions protecting containers?, specify the AdminSDHolder object's DN as Scope and click Run.


      2. How to identify and lockdown who can change the ownership of the AdminSDHolder object (CN=AdminSDHolder,CN=System,DC=...)

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on the AdminSDHolder object in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the AdminSDHolder object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Note - You can also accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #71 - Who can change the owner of containers?, specify the AdminSDHolder object's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      3. How to identify and lockdown who can change the security permissions on all administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #24 - Who can change the security permissions protecting user accounts?, specify the admin account's OU's DN as Scope and click Run.


      4. How to identify and lockdown who can change the ownership of all administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #25 - Who can change the owner of user accounts?, specify the admin account's OU's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      5. How to identify and lockdown who can change the security permissions on all administrative (privileged) groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative group in Active Directory.


          Note - To automatically assess the above on all administrative groups, launch Active Directory Privileged Access Assessor tooling, select report #50 - Who can change the security permissions protecting security groups?, specify the admin group's OU's DN as Scope and click Run.


      6. How to identify and lockdown who can change the ownership of all administrative (privileged) groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative group in Active Directory.


          Note - To automatically assess the above on all administrative groups, launch Active Directory Privileged Access Assessor tooling, select report #51 - Who can change the owner of security groups?, specify the admin group's OU's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      7. How to identify and lockdown who can reset the passwords of all administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Extended Right - Reset Password Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Extended Right - Reset Password effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #3 - Who can reset user account passwords?, specify the admin account's OU's DN as Scope and click Run.


      8. How to identify and lockdown who can disable the use of smart cards on all administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #7 - Who can disable/enable smartcard requirement for interactive logon by user accounts?, specify the admin account's OU's DN as Scope and click Run.


      9. Identify and lockdown who can enable disabled administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #4 - Who can disable/enable user accounts?, specify the admin account's OU's DN as Scope and click Run.


      10. Identify and lockdown who can unlock locked administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - lockoutTime Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - lockoutTime effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #5 - Who can unlock locked user accounts?, specify the admin account's OU's DN as Scope and click Run.


      11. Identify and lockdown who can unexpire expired administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - accountExpires Active Directory Effective Permissions on all administrative (privileged) accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - accountExpires effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #6 - Who can change the expiration date of user accounts?, specify the admin account's OU's DN as Scope and click Run.


      12. How to identify and lockdown who can modify various Kerberos related settings on all administrative (privileged) accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all administrative accounts in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the administrative account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative account.



      13. How to identify and lockdown who can change the membership of all administrative (privileged) groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - member Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - member effective permission
        4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative group in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #41 - Who can change security group memberships?, specify the admin group's OU's DN as Scope and click Run.


      14. How to identify and lockdown who can add one's own account to the membership of all administrative (privileged) groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Validated write - Add/Remove self as member Active Directory Effective Permissions on all administrative (privileged) groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the administrative group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Validated write - Add/Remove self as member effective permission
        4. The list of all accounts who can enact this operation on the administrative group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the administrative group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each administrative group in Active Directory.


          Note - To automatically assess the above on all administrative accounts, launch Active Directory Privileged Access Assessor tooling, select report #42 - Who can add/remove onself to/from the membership of security groups?, specify the admin group's OU's DN as Scope and click Run.


      15. How to identify and eliminate Active Directory Privilege Escalation paths leading to the AdminSDHolder object in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to the AdminSDHolder object in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of the AdminSDHolder object in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the AdminSDHolder object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above, and you will have accomplished this objective




      16. How to identify and eliminate Active Directory Privilege Escalation paths leading to privileged accounts in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all privileged accounts in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a privileged account in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the privileged account, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining privileged accounts, and you will have accomplished this objective




      17. How to identify and eliminate Active Directory Privilege Escalation paths leading to privileged groups in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all privileged groups in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a privileged group in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the privileged group, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining privileged groups, and you will have accomplished this objective





    4. Secure all identities (domain user accounts) in Active Directory

      1. How to configure secure domain user account password, lockout and Kerberos policy settings by securely configuring the Default Domain Policy group policy (settings)

        Overview – To implement this security measure, one needs to configure default Domain Policy settings in Active Directory.

        How-To:

        1. Launch the Group Policy Editor (gpmc.msc), navigate to the current domain (under Domains) and locate the "Default Domain Policy"
        2. Right-click on it, and select Edit to open the Group Policy Management Editor
        3. In it, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies
        4. Next, click on the relevant policy (Password Policy, Account Lockout Policy, Kerberos Policy) to view its various settings
        5. For each selected policy category, the list of all policies that belong to the category will be displayed in the right-pane
        6. Select a policy setting, and configure it as recommended in the Securing the Domain Policy recommendations



      2. How to identify and lockdown who can create domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - User Active Directory Effective Permissions on all instances of all object classes under which the Active Directory Schema permits the creation of user accounts in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to make this determination (e.g. a specific OU) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - User effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to this specific Active Directory object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each object in Active Directory under which the Active Directory Schema permits the creation of computer objects.


          Note - You can also automatically accomplish the same domain-wide with the Active Directory Privileged Access Assessor tooling. To do so, select report #1 - Who can create user accounts?, specify the domain root object's DN as Scope and click Run. This tooling can automatically determine all object classes under which the creation of user accounts is permitted, automatically identify all instances of all such classes and automatically determine the above effective permission on all such objects, domain-wide, in just a few minutes.


      3. How to identify and lockdown who can change security permissions on all domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #24 - Who can change the security permissions protecting user accounts?, specify the domain's DN as Scope and click Run.


      4. How to identify and lockdown who can change the ownership of all domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #25 - Who can change the owner of user accounts?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      5. How to identify and lockdown who can reset the passwords of domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Extended Right - Reset Password Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Extended Right - Reset Password effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #3 - Who can reset user account passwords?, specify the domain's DN as Scope and click Run.


      6. How to identify and lockdown who can disable the use of smart cards on all domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #7 - Who can disable/enable smartcard requirement for interactive logon by user accounts?, specify domain's DN as Scope and click Run.


      7. How to identify and lockdown who can disable or enable (disabled) domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #4 - Who can disable/enable user accounts?, specify domain's DN as Scope and click Run.


      8. How to identify and lockdown who can unlock locked domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - lockoutTime Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - lockoutTime effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #5 - Who can unlock locked user accounts?, specify domain's DN as Scope and click Run.


      9. How to identify and lockdown who can unexpire expired domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - accountExpires Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - accountExpires effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #6 - Who can change the expiration date of user accounts?, specify domain's DN as Scope and click Run.


      10. How to identify and lockdown who can change the user principal name (UPN) of domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userPrincipalName Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userPrincipalName effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.




      11. How to identify and lockdown who can change the logon script of domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - scriptPath Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - scriptPath effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #15 - Who can change the logon script for user accounts?, specify domain's DN as Scope and click Run.


      12. How to identify and lockdown who can change the Account is sensitive and cannot be delegated setting on domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #17 - Who can change whether or not user accounts are sensitive and cannot be delegated?, specify domain's DN as Scope and click Run.


        Note - In addition to the above, the Enable computer and user accounts to be trusted for delegation user right (only granted by default to the Administrators group) assigned in the default Domain Controller policy is required to modify this delegation setting.


      13. How to identify and lockdown who can change the Do not require Kerberos pre-authentication setting on domain user accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the user account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #19 - Who can change whether or not Kerberos pre-authentication is required for user accounts?, specify domain's DN as Scope and click Run.


      14. How to identify and lockdown who can delete domain user accounts in Active Directory

        15. Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all user accounts in Active Directory, as well as who has sufficient Delete Child - User Active Directory Effective Permissions on the parent objects of all user accounts in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on all ancestor objects of all user accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the user account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified user account, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the parent of the user account in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - User effective permission
        8. The list of all accounts who can enact this operation on the parent object of the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified user account's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the parent of the user account in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the parent object of the user account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified user account's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        14. Repeat steps j – m, on the parent of the parent, and so on, until you reach an object whose parent is the domain root. Once you have enacted all of these steps, you will have identified and locked-down who can delete a user account in Active Directory

          15. Repeat the above steps on each user account in Active Directory.


          Note - To automatically assess the above on all user accounts, launch Active Directory Privileged Access Assessor tooling, select report #2 - Who can delete user accounts?, specify the domain's DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all (thousands of) relevant objects in Active Directory, and automates the entire process above to identify who can delete which user accounts, and how, domain-wide in Active Directory, in just minutes.



      15. How to identify and eliminate Active Directory Privilege Escalation paths leading to domain user accounts in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all domain user accounts in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a domain user account in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the domain user account, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining domain user accounts, and you will have accomplished this objective





    5. Secure all hosts (domain computer accounts) in Active Directory

      1. How to identify and lockdown who can create domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - Computer Active Directory Effective Permissions on all instances of all object classes under which the Active Directory Schema permits the creation of computer accounts in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to make this determination (e.g. a specific OU) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - Computer effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to this specific Active Directory object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each object in Active Directory under which the Active Directory Schema permits the creation of computer objects.


          Note - You can also automatically accomplish the same domain-wide with the Active Directory Privileged Access Assessor tooling. To do so, select report #26 - Who can create computer accounts?, specify the domain root object's DN as Scope and click Run. This tooling can automatically determine all object classes under which the creation of computer accounts is permitted, automatically identify all instances of all such classes and automatically determine the above effective permission on all such objects, domain-wide, in just a few minutes.


      2. How to identify and lockdown who can change security permissions on all domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #37 - Who can change the security permissions protecting computer accounts?, specify the domain's DN as Scope and click Run.


      3. How to identify and lockdown who can change the ownership of all domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #38 - Who can change the owner of computer accounts?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      4. How to identify and lockdown who can reset the passwords of domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Extended Right - Reset Password Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Extended Right - Reset Password effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #28 - Who can reset computer accounts?, specify the domain's DN as Scope and click Run.


      5. How to identify and lockdown who can disable or enable (disabled) domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - userAccountControl Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - userAccountControl effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #29 - Who can disable/enable computer accounts?, specify domain's DN as Scope and click Run.


      6. How to identify and lockdown who can change the service principal names (SPNs) of domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Validated write to service principal name Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Validated write to service principal name effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #35 - Who can change the Service Principal Names (SPNs) of computer accounts?, specify domain's DN as Scope and click Run.


      7. How to identify and lockdown who can change the msDS-AllowedToDelegateTo attribute on domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - msDS-AllowedToDelegateTo Active Directory Effective Permissions on all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - msDS-AllowedToDelegateTo effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the computer account, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each computer account in Active Directory.




      8. How to identify and lockdown who can delete domain computer accounts in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all computer accounts in Active Directory, as well as who has sufficient Delete Child - Computer Active Directory Effective Permissions on the parent objects of all computer accounts in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on all ancestor objects of all computer accounts in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the computer account in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified computer account, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the parent of the computer account in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - Computer effective permission
        8. The list of all accounts who can enact this operation on the parent object of the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified computer account's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the parent of the computer account in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the parent object of the computer account will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified computer account's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        14. Repeat steps j – m, on the parent of the parent, and so on, until you reach an object whose parent is the domain root. Once you have enacted all of these steps, you will have identified and locked-down who can delete a computer account in Active Directory

          15. Repeat the above steps on each computer account in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #27 - Who can delete computer accounts?, specify the domain's DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all (thousands of) relevant objects in Active Directory, and automates the entire process above to identify who can delete which computer accounts, and how, domain-wide in Active Directory, in just minutes.


      9. How to identify and eliminate Active Directory Privilege Escalation paths leading to domain computer accounts in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all domain user accounts in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a domain computer account in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the domain computer account, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining domain computer accounts, and you will have accomplished this objective





    6. Secure all security groups in Active Directory

      1. How to identify and lockdown who can create domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - Group Active Directory Effective Permissions on all instances of all object classes under which the Active Directory Schema permits the creation of groups in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to make this determination (e.g. a specific OU) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - Group effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to this specific Active Directory object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each object in Active Directory under which the Active Directory Schema permits the creation of group objects.


          Note - You can also automatically accomplish the same domain-wide with the Active Directory Privileged Access Assessor tooling. To do so, select report #39 - Who can create security groups?, specify the domain root object's DN as Scope and click Run. This tooling can automatically determine all object classes under which the creation of groups is permitted, automatically identify all instances of all such classes and automatically determine the above effective permission on all such objects, domain-wide, in just a few minutes.


      2. How to identify and lockdown who can change security permissions on all domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #50 - Who can change the security permissions protecting security groups?, specify the domain's DN as Scope and click Run.


      3. How to identify and lockdown who can change the ownership of all domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #51 - Who can change the owner of security groups?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      4. How to identify and lockdown who can change the membership of domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - member Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security groups in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - member effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #41 - Who can change security group memberships?, specify domain's DN as Scope and click Run.


      5. How to identify and lockdown who can change the type of domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - groupType Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security groups in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - groupType effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #44 - Who can change security group types?, specify domain's DN as Scope and click Run.


      6. How to identify and lockdown who can change the scope of domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - sAMAccountType Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security groups in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - sAMAccountType effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #43 - Who can change security group scopes?, specify domain's DN as Scope and click Run.


      7. How to identify and lockdown who can change the designated manager of domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - managedBy Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security groups in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - managedBy effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #49 - Who can change the designated manager of security groups?, specify domain's DN as Scope and click Run.


      8. How to identify and lockdown who can add or remove themselves from domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Validated write - Add/Remove self as member Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Validated write - Add/Remove self as member effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all computer accounts, launch Active Directory Privileged Access Assessor tooling, select report #42 - Who can add/remove onself to/from the membership of security groups?, specify domain's DN as Scope and click Run.


      9. How to identify and lockdown who can change the description of domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - description Active Directory Effective Permissions on all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security groups in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - description effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the security group, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #46 - Who can change the description of security groups?, specify domain's DN as Scope and click Run.


      10. How to identify and lockdown who can delete domain security groups in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all security groups in Active Directory, as well as who has sufficient Delete Child - Group Active Directory Effective Permissions on the parent objects of all security groups in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on all ancestor objects of all security groups in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the security group in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified security group, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the parent of the security group in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - Group effective permission
        8. The list of all accounts who can enact this operation on the parent object of the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified security group's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the parent of the security group in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the parent object of the security group will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified security group's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        14. Repeat steps j – m, on the parent of the parent, and so on, until you reach an object whose parent is the domain root. Once you have enacted all of these steps, you will have identified and locked-down who can delete a security group in Active Directory

          15. Repeat the above steps on each security group in Active Directory.


          Note - To automatically assess the above on all security groups, launch Active Directory Privileged Access Assessor tooling, select report #27 - Who can delete security groups?, specify the domain's DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all (thousands of) relevant objects in Active Directory, and automates the entire process above to identify who can delete which security groups, and how, domain-wide in Active Directory, in just minutes.


      11. How to identify and eliminate Active Directory Privilege Escalation paths leading to domain security groups in Active Directory

        Overview – To implement this security measure, accurately* identify all privilege escalation paths leading to all domain security groups in Active Directory.

                    * The only way to accurately identify privilege escalation paths is by accurately determining Active Directory Effective Permissions on all relevant objects in Active Directory.

        How-To:

        1. Launch Active Directory Privilege Escalation Path Identifier and select the report "Identify all security principals that have a privilege escalation path to an Active Directory object"
        2. Enter the distinguished name (DN) of a domain security group in the Scope field, then click the Run button
        3. Once identification is complete, the list of all security principals that have a privilege escalation path to the target object will be displayed in the Security Principals pane
        4. Review this list and identify all security principals that currently have a privilege escalation path to the target object but should not be having a path to the target object
          5. Note - It is certainly possible for authorized accounts to have a path as they do possess sufficient access in Active Directory.
        5. If there are no such principals, you don't need to do anything else
        6. If there are such principals, note down (in a list) their identities, then do the following
        7. In the same tooling, activate Single-User Mode, and this time, select the report "Identify all privilege escalation paths from a specific user to an Active Directory object"
        8. Use the Select a User button to locate and specify the identify of the first (or next) security principal from the list above, then click the Run button
        9. Once identification is complete, all privilege escalation leading to the target object from the specified security principal will be displayed in the Escalation Paths pane
          10. Note - To expand a node, simply click on it. Also, when you click on a specific security principal, the list of all operations that he/she can enact to escalate privilege will be displayed in the Escalation Path dropdown.
        10. Identify the operation(s) that the specified security principal can enact to escalate privilege. For each such operation, identify the exact security permission that is enabling this operation. To do so, simply click the How button
        11. To lockdown access, launch Active Directory Users and Computers, navigate to the domain security group, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          12. Repeat steps g through k for each security principal in the list created in step f above. Then repeat steps a through k for all the remaining domain security groups, and you will have accomplished this objective





    7. Secure group policy objects (GPOs) and the ability to link them to the domain, OUs and sites in Active Directory

      1. How to identify and lockdown who can create GPOs in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - groupPolicyContainer Active Directory Effective Permissions on the Policies container in the System container in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the Policies container in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - groupPolicyContainer effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the Policies container, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Note - You can also automatically accomplish the same with the Active Directory Privileged Access Assessor tooling. To do so, select report #84 - Who can create group policy containers?, specify the domain root object's DN as Scope and click Run.


      2. How to identify and lockdown who can change security permissions on all GPOs in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all GPOs in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the GPO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the GPO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified GPO, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each GPO in Active Directory.


          Note - To automatically assess the above on all GPOs, launch Active Directory Privileged Access Assessor tooling, select report #87 - Who can change the owner of group policy containers?, specify the domain's DN as Scope and click Run.


      3. How to identify and lockdown who can change the ownership of all GPOs in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all GPOs in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the GPO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the GPO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified GPO, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each GPO in Active Directory.


          Note - To automatically assess the above on all GPOs, launch Active Directory Privileged Access Assessor tooling, select report #86 - Who can change the security permissions protecting group policy containers?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      4. How to identify and lockdown who can link a GPO to a site in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on the site object in the Configuration partition.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the site object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the site object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the site object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Sites and Services, navigate to the site object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission



      5. How to identify and lockdown who can link a GPO to the domain root object in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on the domain root object in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain root in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the domain root will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the domain root will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the domain root, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission



      6. How to identify and lockdown who can link a GPO to organizational units in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on all organizational units in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the organizational unit will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the organizational unit will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the organizational unit, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          10. Repeat the above steps on each organizational unit in Active Directory.


          Note - To automatically assess the above on all organizational units, launch Active Directory Privileged Access Assessor tooling, select report #60 - Who can change the list of group policies linked to organizational units?, specify the domain's DN as Scope and click Run.


      7. How to identify and lockdown who can change the precedence order of GPOs linked to a site in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on the site object in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the site object in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the site object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the site object will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Sites and Services, navigate to the site object, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission



      8. How to identify and lockdown who can change the precedence order of GPOs linked to the domain root object in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on the domain root in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the domain root in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the domain root will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the domain root will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the domain root, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission



      9. How to identify and lockdown who can change the precedence order of GPOs linked to organizational units in Active Directory

        Overview – To implement this security measure, determine who has both, sufficient Write Property - gPLink and Write Property - gPOptions Active Directory Effective Permissions on all organizational units in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the organizational unit in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - gPLink effective permission
        4. The list of all accounts who has this effective permission on the organizational unit will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        5. Next, use the What dropdown to locate and select the Write Property - gPOptions effective permission
        6. The list of all accounts who has this effective permission on the organizational unit will be displayed in the Who pane. Copy this list of accounts by right-clicking anywhere in the Who pane, and paste it in Notepad
        7. Compare the two lists, and identify all accounts that have both these effective permissions. Review this list of such identified accounts to identify those accounts that should not be able to enact this operation but can currently do so
        8. For each such account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane
        9. To lockdown access, launch Active Directory Users and Computers, navigate to the organizational unit, access the Advanced Security Settings tab to view the object's ACL, and modify the identified security permission

          10. Repeat the above steps on each organizational unit in Active Directory.


          Note - To automatically assess the above on all organizational units, launch Active Directory Privileged Access Assessor tooling, select report #60 - Who can change the list of group policies linked to organizational units?, specify the domain's DN as Scope and click Run.


      10. How to identify and lockdown who can delete GPOs in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all group policy objects (GPOs) in Active Directory, as well as who has sufficient Delete Child - Group Policy Container Active Directory Effective Permissions on the default Policies container in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on the default Policies container in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the GPO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the GPO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified GPO, access Advanced Security Settings to view its ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the default Policies container in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - Group Policy Container effective permission
        8. The list of all accounts who can enact this operation on the default Policies container will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the default Policies container, access Advanced Security Settings to view its ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the default Policies container in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the the default Policies container will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the the default Policies container, access Advanced Security Settings to view its ACL, and modify the identified permission

          14. Repeat the above steps for each GPO in the the default Policies container in Active Directory.


          Note - To automatically assess the above on all GPOs, launch Active Directory Privileged Access Assessor tooling, select report #85 - Who can delete group policy containers?, specify the default Policies container DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all relevant objects in Active Directory, and automates the entire process of identifying who can delete which GPOs, and how, domain-wide in Active Directory, in just a few minutes.



    8. Secure service connection points in Active Directory

      1. How to identify and lockdown who can create service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - serviceConnectionPoint Active Directory Effective Permissions on all instances of all object classes under which the Active Directory Schema permits the creation of service connection points in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to make this determination (e.g. a domain computer account's object) in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - serviceConnectionPoint effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to this specific Active Directory object, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each object in Active Directory under which the Active Directory Schema permits the creation of service connection points.


          Note - You can also automatically accomplish the same domain-wide with the Active Directory Privileged Access Assessor tooling. To do so, select report #72 - Who can create service connection points?, specify the domain root object's DN as Scope and click Run. This tooling can automatically determine all object classes under which the creation of service connection points is permitted, automatically identify all instances of all such classes and automatically determine the above effective permission on all such objects, domain-wide, in less than two minutes.


      2. How to identify and lockdown who can change security permissions on all service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all service connection points in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified service connection point, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each service connection point in Active Directory.


          Note - To automatically assess the above on all service connection points, launch Active Directory Privileged Access Assessor tooling, select report #82 - Who can change the security permissions protecting service connection points?, specify the domain's DN as Scope and click Run.


      3. How to identify and lockdown who can change the ownership of all service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all service connection points in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified service connection point, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps on each service connection point in Active Directory.


          Note - To automatically assess the above on all service connection points, launch Active Directory Privileged Access Assessor tooling, select report #83 - Who can change the owner of service connection points?, specify the domain's DN as Scope and click Run.


        Note - In addition to the above, any security principal who has the Take ownership of files or other objects user right (granted by default to the Administrators group) assigned in the default Domain Controller policy can also take ownership of these (and all) objects in Active Directory.

      4. How to identify and lockdown who can modify keywords on all service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - keywords Active Directory Effective Permissions on service connection points in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - member effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the service connection point, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each service connection point in Active Directory.


          Note - To automatically assess the above on all service connection points, launch Active Directory Privileged Access Assessor tooling, select report #74 - Who can change the keywords of service connection points?, specify the domain's DN as Scope and click Run.


      5. How to identify and lockdown who can modify binding information on all service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - bindingInformation Active Directory Effective Permissions on service connection points in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - bindingInformation effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the service connection point, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each service connection point in Active Directory.


          Note - To automatically assess the above on all service connection points, launch Active Directory Privileged Access Assessor tooling, select report #76 - Who can change the binding information of service connection points?, specify the domain's DN as Scope and click Run.


      6. How to identify and lockdown who can modify the Service DNS Name on all service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - serviceDNSName Active Directory Effective Permissions on service connection points in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - serviceDNSName effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the service connection point, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each service connection point in Active Directory.


          Note - To automatically assess the above on all service connection points, launch Active Directory Privileged Access Assessor tooling, select report #77 - Who can change the service DNS name of service connection points?, specify the domain's DN as Scope and click Run.


      7. How to identify and lockdown who can delete service connection points in Active Directory

        Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on all service connection points (SCPs) in Active Directory, as well as who has sufficient Delete Child - Service Connection Points Active Directory Effective Permissions on the parent objects of all SCPs in Active Directory, as well as who has sufficient Delete Tree Active Directory Effective Permissions on all ancestor objects of all SCPs in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
        4. The list of all accounts who can enact this operation on the service connection point will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access based on Standard Delete, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified SCP, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        6. Next, enter the distinguished name (DN) of the parent of the service connection point in the Scope field, then click the Run button to calculate effective permissions
        7. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Child - Service Connection Points effective permission
        8. The list of all accounts who can enact this operation on the parent object of the SCP will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        9. To lockdown access based on Delete Child, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified OU's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        10. Next, enter the distinguished name (DN) of the parent of the SCP in the Scope field, then click the Run button to calculate effective permissions
        11. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Delete Tree effective permission
        12. The list of all accounts who can enact this operation on the parent object of the SCP will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        13. To lockdown access based on Delete Tree, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the specified OU's parent, access Advanced Security Settings to view the object's ACL, and modify the identified permission
        14. Repeat steps j – m, on the parent of the parent, and so on, until you reach an object whose parent is the domain root. Once you have enacted all of these steps, you will have identified and locked-down who can delete an SCP in Active Directory

          15. Repeat the above steps on each service connection point in Active Directory.


          Note - To automatically assess the above on all SCPs, launch Active Directory Privileged Access Assessor tooling, select report #73 - Who can delete service connection points?, specify the domain's DN as Scope and click Run. This tooling can automatically determine who has sufficient Standard Delete, Delete Child and Delete Tree effective permissions on all (hundreds of) relevant objects in Active Directory, and automates the entire process of identifying who can delete which SCPs, and how, domain-wide in Active Directory, in just a few minutes.



    9. Secure all administrative delegations and all custom provisioned access in Active Directory

      1. How to identify and lockdown who can enact delegated administrative tasks in Active Directory

        Prerequisite – Begin by reviewing the list of the Top-50 Administrative Delegations in Active Directory and identify which of these administrative delegations you wish to assess and lockdown.

        Overview – To implement this security measure, one needs to determine who has sufficient Active Directory Effective Permissions that uniquely govern the delegation of a specific admin task, on all relevant objects in the delegation scope.

        Example - To assess who can enact the delegated task of resetting passwords of user accounts in a specific OU (say containing a 1000 accounts), one needs to determine who has sufficient Extended Right - Reset Password Active Directory Effective Permissions on all 1000 user accounts in that OU.

        Options – There are two options:  Option 1: Automatically determine Active Directory Effective Permissions one object at a time.  Option 2: Automatically determine Active Directory Effective Permissions on all (1000s of) objects at once.

        How-To:

        Option 1 –

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to assess the delegation in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the specific effective permission that uniquely governs this specific delegation (e.g. Extended Right - Reset Password for password resets)
        4. The list of all accounts who can enact this delegated task on the object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this task but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the target object's parent object (i.e. the source of inherited ACE), access Advanced Security Settings to view its ACL, and modify the identified security permission

          6. Repeat the above steps for each object in the administrative delegation scope in Active Directory. (E.g. To assess who is delegated the ability to reset passwords in an OU, repeat the above on every domain user account in that OU.)


        Option 2 –

        1. Open Active Directory Privileged Access Assessor, activate Multiple Reports mode, then select all the administrative delegations you wish to assess, from amongst a choice of 100 administrative delegations
          2. Note - You can also select a single delegation of choice, such as Who can create user accounts, or Who can reset user account passwords or Who can change group memberships etc., and focus your secure and lockdown efforts on it. (i.e. you need not only select multiple delegations.)
        2. Enter the distinguished name (DN) of the scope of your administrative delegation (e.g. a top-level OU, or the domain root), in the Scope field, then click the Run button to generate the selected administrative delegation/access reports. When you do so, the tooling will automatically calculate Active Directory Effective Permissions on all the objects in the scope (, even 1000s of objects,) saving you the effort of determining effective permissions on thousands of objects, one object at a time.
        3. Once report generation is complete and results are displayed, use the What dropdown to locate and select the specific delegation you are interested in (e.g. Who can reset passwords?, Who can change group memberships? etc.)
        4. The list of all accounts who can enact the selected delegation anywhere in the scope will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this task but can currently do so. You can also identify and view all the objects in the delegation scope on which an account is delegated the selected administrative task. To do so, click on the account in the Who pane, and the list of all such objects will be displayed in the Where pane.
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, then click on a target in the Where pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the object (typically an OU) that is the source of these identified inherited permissions, access Advanced Security Settings to view its ACL, and modify the identified security permission. Repeat this step for all such accounts that should not be able to enact the delegated task but can currently do so, and you will have accomplished this objective.


      2. How to identify and lockdown who has custom-provisioned access in Active Directory

        Prerequisite – Begin by reviewing the list of the Common Access Provisioning Needs in Active Directory and identify which of these custom access provisioning needs you wish to assess and lockdown.

        Overview – To implement this security measure, one needs to determine who has sufficient Active Directory Effective Permissions that uniquely govern the provisioning of access in order to be able to enact a specific operation, on all relevant objects.

        Example - To assess who is effectively provisioned sufficient access so as to be able to change the SPNs of computer accounts in a specific OU (say containing a 1000 computer accounts), one needs to determine who has sufficient Vaidated Write - Service Principal Name Active Directory Effective Permissions on all 1000 computer accounts in that OU.

        Options – There are two options:  Option 1: Automatically determine Active Directory Effective Permissions one object at a time.  Option 2: Automatically determine Active Directory Effective Permissions on all (1000s of) objects at once.

        How-To:

        Option 1 –

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the object on which you wish to assess the custom provisioned access in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the specific effective permission that uniquely governs this specific delegation (e.g. Validated Write - Service Principal Name for SPN changes)
        4. The list of all accounts who can effectively have this access provisioned on the object will be displayed in the Who pane. Review this list to identify all accounts that should not have such provisioned access on the object but currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the target object (i.e. assuming an explicit ACE), access Advanced Security Settings to view its ACL, and modify the identified security permission

          6. Repeat the above steps for each object in the scope of custom access provisioning in Active Directory. (E.g. To assess who can change SPNs on all computer accounts in an OU, repeat the above on every domain computer account in that OU.)


        Option 2 –

        1. Open Active Directory Privileged Access Assessor, activate Multiple Reports mode, then select all the custom provisioned access you wish to assess, from amongst a choice of 100 access reports
          2. Note - You can also select a single report of choice, such as Who can modify the SPNs of computer accounts, or Who can reset user account passwords or Who can change group memberships etc., and focus your secure and lockdown efforts on it. (i.e. you need not only select multiple reports.)
        2. Enter the distinguished name (DN) of the scope of your custom access provisioning (e.g. a top-level OU, or the domain root), in the Scope field, then click the Run button to generate the selected access reports. When you do so, the tooling will automatically calculate Active Directory Effective Permissions on all the objects in the scope (, even 1000s of objects,) saving you the effort of determining effective permissions on thousands of objects, one object at a time.
        3. Once report generation is complete and results are displayed, use the What dropdown to locate and select the specific operation you are interested in (e.g. Who can change the SPNs of computer accounts?, Who can reset passwords? etc.)
        4. The list of all accounts who can effectively have sufficient access to enact the operation anywhere in the scope will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so. You can also identify and view all the objects in the access provisioning scope on which an account has sufficient access. To do so, click on the account in the Who pane, and the list of all such objects will be displayed in the Where pane.
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, then click on a target in the Where pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, if using explicit ACEss, navigate to the object, or if using inheritance, navigate to the object (typically an OU) that is the source of these identified inherited permissions, access Advanced Security Settings to view its ACL, and modify the identified security permission. Repeat this step for all such accounts that should not have such access but currently do so, and you will have accomplished this objective.



    10. Secure critical Active Directory contents

      1. How to identify and lockdown who can change security permissions on of any and all TrustedDomain objects (TDOs) in Active Directory domains

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on all trusted domain objects (TDOs) in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the TDO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the TDO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Domains and Trusts, navigate to the TDO, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each TDO. (TDOs reside in the default System container (CN=System,DC=...) in Active Directory.)




      2. How to identify and lockdown who can change the owner of any and all TrustedDomain objects (TDOs) in Active Directory domains

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on all trusted domain objects (TDOs) in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the TDO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the TDO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Domains and Trusts, navigate to the TDO, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each TDO. (TDOs reside in the default System container (CN=System,DC=...) in Active Directory.)




      3. How to identify and lockdown who can modify various attributes of any and all TrustedDomain objects (TDOs) in Active Directory domains

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - Property X Active Directory Effective Permissions on all trusted domain objects (TDOs) in Active Directory.

        Note - Replace Property X above (and below) with the following properties - trustAttributes (80a67e5a-9f22-11d0-afdd-00c04fd930c9), trustDirection (bf967a5c-0de6-11d0-a285-00aa003049e2) and trustType (bf967a60-0de6-11d0-a285-00aa003049e2)

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the TDO in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - Property X effective permission
        4. The list of all accounts who can enact this operation on the TDO will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Domains and Trusts, navigate to the TDO, access Advanced Security Settings to view the object's ACL, and modify the identified security permission

          6. Repeat the above steps for each TDO. (TDOs reside in the default System container (CN=System,DC=...) in Active Directory.)




      4. How to identify and lockdown who can change security permissions on the root object of the Schema partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the root of the Schema partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Schema partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the root of the Schema partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Schema, navigate to the root of the Schema partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      5. How to identify and lockdown who can change the owner of the root object of the Schema partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on the root of the Schema partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Schema partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the root of the Schema partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Schema, navigate to the root of the Schema partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      6. How to identify and lockdown who can create new Schema classes in the Schema partition

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - Class-Schema Active Directory Effective Permissions on the root of the Schema partition in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Schema partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - Class-Schema effective permission
        4. The list of all accounts who can enact this operation on the root of the Schema partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Schema, navigate to root of the Schema partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      7. How to identify and lockdown who can create new Schema attributes in the Schema partition

        Overview – To implement this security measure, one needs to determine who has sufficient Create Child - Attribute-Schema Active Directory Effective Permissions on the root of the Schema partition in Active Directory.

        How-To:

        1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Schema partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - Attribute-Schema effective permission
        4. The list of all accounts who can enact this operation on the root of the Schema partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Schema, navigate to root of the Schema partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      8. How to identify and lockdown who can change security permissions on the root object of the Configuration partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on the root of the Configuration partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Configuration partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the root of the Configuration partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch ADSIEdit, navigate to the root of the Configuration partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      9. How to identify and lockdown who can change the owner of the root object of the Configuration partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on the root of the Configuration partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of the root of the Configuration partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the root of the Configuration partition will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Sites and Services (or ADSIEdit), navigate to the root of the Configuration partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      10. How to identify and lockdown who can change security permissions on various critical/sensitive objects in the Configuration partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Permissions Active Directory Effective Permissions on various critical/sensitive objects in the Configuration partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"

        2. Enter the distinguished name (DN) of a specific critical/sensitive object in the Configuration partition in the Scope field, then click the Run button to calculate effective permissions

               Note - The following is a list of critical/sensitive object in the Configuration partition based on this list

           •  CN=Partitions,CN=Configuration,DC=<Domain>

           •  CN=Sites,CN=Configuration,DC=<Domain>

           •  CN=Directory Service,CN=Windows NT,CN=Services,,CN=Configuration,DC=<Domain>

           •  CN=Default-Query-Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<Domain>
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Permissions effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Sites and Services (or ADSIEdit), navigate to the specified object in the Configuration partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      11. How to identify and lockdown who can change the owner of various critical/sensitive objects in the Configuration partition

        Overview – To implement this security measure, one needs to determine who has sufficient Modify Owner Active Directory Effective Permissions on various critical/sensitive objects in the Configuration partition in Active Directory.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"

        2. Enter the distinguished name (DN) of a specific critical/sensitive object in the Configuration partition in the Scope field, then click the Run button to calculate effective permissions

               Note - The following is a list of critical/sensitive object in the Configuration partition based on this list

           •  CN=Partitions,CN=Configuration,DC=<Domain>

           •  CN=Sites,CN=Configuration,DC=<Domain>

           •  CN=Directory Service,CN=Windows NT,CN=Services,,CN=Configuration,DC=<Domain>

           •  CN=Default-Query-Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<Domain>
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Modify Owner effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Sites and Services (or ADSIEdit), navigate to the specified object in the Configuration partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      12. How to identify and lockdown who can modify the attributes of various critical/sensitive objects in the Configuration partition

        Overview – To implement this security measure, one needs to determine who has sufficient Write Property - Property X Active Directory Effective Permissions on of a specific critical/sensitive object in the Configuration partition in Active Directory.

        Note - Replace Property X above (and below) with properties of interest e.g. - queryPolicyObject (e1aea403-cd5b-11d0-afff-0000f80367c1) on NTDS-DSA objects, dsHeuristics (f0f8ff86-1191-11d0-a060-00aa006c33ed) on NTDS-Service objects, pKIExtendedKeyUsage (18976af6-3b9e-11d2-90cc-00c04fd91ab1) on PKI-Certificate-Template objects, msPKI-Certificate-Name-Flag (ea1dddc4-60ff-416e-8cc0-17cee534bce7) on PKI-Certificate-Template objects etc.

        How-To:

        1. Open Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
        2. Enter the distinguished name (DN) of a specific critical/sensitive object in the Configuration partition in the Scope field, then click the Run button to calculate effective permissions
        3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - Property X effective permission
        4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
        5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Sites and Services (or ADSIEdit), navigate to the specified object in the Configuration partition, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



      13. How to audit changes to critical Active Directory contents

        Overview – To implement this security measure, one needs to enable auditing of Audit Directory Services Access, then configure SACLs on various Active Directory objects in Active Directory.

        How-To:

        1. Enable auditing on Domain Controllers by configuring the Audit Policy in the default Domain Controller Policy
        2. Configure auditing to enable auditing of Active Directory Service Access events (both, category and sub-category)
        3. Configure SACLs in Active Directory as recommended in audit changes to critical Active Directory contents.



    11. Optionally, perform an Active Directory inventory, review important group memberships, review important ACLs, create a domain-wide permissions snapshot, and find and eliminate any glaring ACL misconfigurations in Active Directory

      1. How to perform an Active Directory inventory

        Overview – To implement this optional security measure, one needs to enumerate the contents of Active Directory, such as the list of all domain user accounts, computer accounts, security groups and OUs in Active Directory.

        How-To:

        1. Launch Active Directory Security Auditor and select a report of choice

               Note - The tool can generate 100 Active Directory audit/inventory reports, such as -

           •  List of all { domain user account, domain computer accounts, domain security groups, OUs, containers, service connection points } etc.

           •  List of all { user accounts, computer accounts, security groups, etc. } that were { created, changed or deleted } in the last [ X ] days

           •  List of all domain computer accounts that are trusted for unconstrained delegation

           •  List of all domain controllers as well as all administrative* accounts and groups (*based on AdminSDHolder)

           •  List of all { enabled, disabled, locked, unlocked, expired } domain user accounts and/or domain computer accounts


               Note 2- You can use any tooling of your choice, including PowerShell. The tooling specified above merely trustworthily automates the generation of such reports, and the ability to export results to CSV and PDF

        2. Enter the distinguished name (DN) of your Active Directory domain (or any OU of your choice) in the Scope field, then click the Run button to generate your inventory report

        3. Upon completion, results will be displayed in the Results pane. Review results and identify any fix any glaring insecure findings.


      2. How to review important Active Directory group memberships

        Overview – To implement this optional security measure, one needs to enumerate the complete nested group membership of domain security groups in Active Directory.

        Note - Examples of important Active Directory security groups include Administrators, Enterprise Admins, Domain Admins etc., as well as all security groups created and deemed important by your organization. A list of default administrative groups in Active Directory can be found here.

        How-To:

        1. Launch Active Directory Membership Auditor and select the report View the complete nested membership of an Active Directory security group

          Option - Alternatively, to identify all groups to which a specific user belongs, select the report View the complete list of all Active Directory security groups to which a user belongs

          Note - You can use any tooling of your choice, including PowerShell. The tooling specified above merely trustworthily fully automates the generation (and exporting) of group membership reports

        2. Enter the distinguished name (DN) of the domain security group whose membership you wish to enumerate, in the Scope field, then click the Run button to generate your report

        3. Upon completion, the complete nested group membership of the specified group will be displayed in the Results pane. Review results and ensure there are no unexpected members


      3. How to review ACLs of important Active Directory objects

        Overview – To implement this optional security measure, one needs to retrieve the security descriptor of a specified Active Directory object, extract the ACL, translate SIDs, and review security permissions specified in the ACEs of the ACL.

        Note - Examples of important Active Directory objects include the domain root object, AdminSDHolder, the Configuration and Schema root objects, as well as all objects deemed important by your organization. A list of some default important objects in Active Directory can be found here.

        How-To:

        1. Launch Active Directory ACL Analyzer and Exporter and select the report View the ACL of an Active Directory object

          Option - Alternatively, to view the SACL of the object, select the report View the ACL of an Active Directory object

          Note - You can use any tooling of your choice, including PowerShell. The tooling specified above merely trustworthily fully automates SD retreival, ACL extraction, SID transation and individual permission analysis

        2. Enter the distinguished name (DN) of the Active Directory object you wish to analyze the ACL of, in the Scope field, then click the Run button to generate your ACL analysis report

        3. Upon completion, the complete ACL of the specified Active Directory object will be displayed in the Results pane. Review results and ensure there are no unexpected permission grants

          Note - To sort the ACL by individual permissions for quick, detailed effortless permissions analysis, click the Analyze button, and the Permissions field will be displayed in individually sortable columns for effortless analysis.



      4. How to create a domain-wide permissions snapshot

        Overview – To implement this optional security measure, one needs to retrieve the security descriptors of all objects in a specified Active Directory scope (e.g. domain, OU etc.), extract the ACLs, and create an exportable snapshot.

        How-To:

        1. Launch Active Directory ACL Analyzer and Exporter and select the report Export ACLs of all objects in an Active Directory tree

          Option - Alternatively, to export the SACLs of all objects in the specified scope, select the report Export SACLs (System ACLs) of all objects in an Active Directory tree

          Note - You can use any tooling of your choice, including PowerShell. The tooling specified above merely trustworthily fully automates SD retreival, ACL extraction, SID transation and individual permission analysis

        2. Enter the distinguished name (DN) of the Active Directory domain or OU that contains the objects whose ACLs you wish to export, in the Scope field, then click the Run button to generate the output

        3. Upon completion, the list of all objects whose ACLs have been retrieved will be displayed in the Results pane. To export the ACLs of all the displayed objects, click the Export button

          Note - You can optionally specify an LDAP filter to customize the scope of objects whose ACLs should be exported. For e.g., you can use the LDAP filter (objectclass=organizationalUnit) to have only the ACLs protecting OUs to be exported



      5. How to find and eliminate any glaring ACL misconfigurations in Active Directory

        Overview – To implement this optional security measure, one needs to retrieve the security descriptors of all objects in an Active Directory domain (or OU,) and review all security permissions for any glaring misconfigurations.

        Note - Examples of glaring misconfigurations include any modify permissions (e.g. Modify Permissions, Modify Owner, All Extended Rights etc.) granted to security principals like Domain Users, Authenticated Users, Everyone, All Employees, Contractors, an unknown SID etc.

        How-To:

        1. Launch Active Directory Permissions Analyzer and select the report Who has what permissions in an Active Directory tree

          Note - You can use any tooling of your choice, including PowerShell. The tooling specified above merely trustworthily fully automates comprehensive domain-wide analysis and pinpointed identification of security permissions

        2. Enter the distinguished name (DN) of the Active Directory domain or OU you wish to find glaring ACL misconfigurations in, in the Scope field

        3. Select the following combination of security permissions to search for - Find  Both (Explicit and Inherited)   Allow   Any Modify Permissions  granted to  All security principals

          4. Note - You can also use this tooling to identify any combination of permissions, or any permissions granted to a(ny) specific security principal of choice. (To do so, select the granted to A specific security principal option, then specify a principal by clicking on the Principal button.)

        4. Click the Run button to generate the report. Upon completion, the list of all security principals that have any modify permission in the specified Active Directory scope will be displayed in the Who pane

        5. To identify the precise Active Directory objects in whose ACLs any one of these security principals has the specified permissions, locate the security principal's name in the Who pane and click on it

        6. When you do so, the list of all Active Directory objects in whose ACL this security principal has the identified modify permissions will be displayed in the Where pane

        7. To view the exact permissions identified in the ACL of a specific identified Active Directory object, click on it in the Where pane, and the permissions will be displayed in the What pane. Review identified permissions carefully

        8. To eliminate any found glaring misconfigurations, identify the objects in whose ACL they reside, launch Active Directory Users and Computers, navigate to these objects, and remove the identified permissions from their ACLs




  4. Security measures to secure and protect Active Directory Backups -

    1. How to establish and implement secure Active Directory backup and restore practices

      Overview – To implement this security measure, one needs to establish and implement a trustworthy process for operational and physical security involving Active Directory backups.

      How-To:

      1. Establish a trustworthy process to ensure operational security for Active Directory backup and restore operations
      2. Perform Active Directory backups at regular intervals, consistent with schedule requirements imposed by your organization's disaster recovery plans
      3. Ensure that only designated, highly trustworthy, Domain Admin equivalent IT personnel are authorized to perform Active Directory backups
      4. Ensure that Active Directory backups are stored in a highly secure location, access to which is secured, access-controlled, monitored and audited
      5. Store archival backup media off-site in equally secure locations, access to which too must be secured, access-controlled and audited
      6. Establish a process to ensure that signatory approval of authorized approvers is required whenever a restore operation is to be performed
        7. Note - It is imperative to understand that unauthorized access to an Active Directory backup can result in the compromise of the entire Active Directory forest.



    2. How to provide the highest level of physical security for all Active Directory Backups

      Overview – To implement this security measure, one needs to establish and implement procedures and processes for safeguarding physical Active Directory backups.

      How-To:

      1. Establish a trustworthy process and operational procedures and requirements for ensuring the physical safety of all Active Directory backups
      2. Ensure that only designated, highly trustworthy, Domain Admin equivalent IT personnel, and no on else, has physical access to Active Directory backups
      3. Ensure that Active Directory backups are stored in a highly secure location, access to which is secured, access-controlled, monitored and audited
      4. Store archival backup media off-site in equally secure locations, access to which too must be secured, access-controlled and audited
      5. Ensure that signatory approval of authorized approvers is required whenever a physical Active Directory backup is to be accessed or retrieved
        6. Note - It is imperative to understand that unauthorized access to an Active Directory backup can result in the compromise of the entire Active Directory forest.


  5. Security measures to secure and protect Active Directory's Logical Structure -

    1. How to ensure that only authorized personnel can create new (external, cross-forest or Kerberos realm) trust relationships

      Overview – To implement this security measure, one needs to determine who has sufficient Create Child - trustedDomain Active Directory Effective Permissions on the System container in Active Directory.

      Note - For external and cross-forest trust relationships, the above effective permission is required in both the trusting and the trusted domains. Additionally, to create an inbound forest trust, one also requires Extended Right - Create Inbound Forest Trust (e2a36dc9-ae17-47c3-b58b-be34c55ba633) Active Directory Effective Permissions on the domain root object of the forest root domain.

      How-To:

      1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
      2. Enter the distinguished name (DN) of the System container in the Scope field, then click the Run button to calculate effective permissions
      3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Create Child - trustedDomain effective permission
      4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
      5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch ADSIEdit, navigate to the System container, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



    2. How to ensure that only authorized personnel can severe (delete) existing trust relationships

      Overview – To implement this security measure, one needs to determine who has sufficient Standard Delete Active Directory Effective Permissions on the Trusted-Domain object representing the trust relationship in the System container in Active Directory.

      Note - For external and cross-forest trust relationships, the above effective permission is required in both the trusting and the trusted domains.

      How-To:

      1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
      2. Enter the distinguished name (DN) of the on the Trusted-Domain object (TDO) representing the trust relationship in the Scope field, then click the Run button to calculate effective permissions
      3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Standard Delete effective permission
      4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
      5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch ADSIEdit, navigate to the TDO representing the trust relationship, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



    3. How to ensure that only authorized personnel can change the direction of existing trust relationships

      Overview – To implement this security measure, one needs to determine who has sufficient Write Property - trustAttributes Active Directory Effective Permissions on the Trusted-Domain object representing the trust relationship in the System container in Active Directory.

      Note - For external and cross-forest trust relationships, the above effective permission is required in both the trusting and the trusted domains.

      How-To:

      1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
      2. Enter the distinguished name (DN) of the on the Trusted-Domain object (TDO) representing the trust relationship in the Scope field, then click the Run button to calculate effective permissions
      3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - trustAttributes effective permission
      4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
      5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch ADSIEdit, navigate to the TDO representing the trust relationship, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



    4. How to use SID Filtering to prevent escalation of privilege across external and cross-forest trust boundaries

      Overview – On domain controllers running Windows Server 2003 and beyond, SID Filtering is enabled by default on all outgoing, external trusts. That said, this security measure can be implemented using the netdom tool.

      How-To:

      1. Logon to a domain controller in the trusting domain using an account with Domain Administrator credentials.

      2. Open the command-prompt and type the following command –

        netdom trust name-of-trusting-domain /domain:name-of-trusted-domain /userO:username [/passwordO:* /Quarantine:yes




    5. How to ensure that only authorized personnel can disable SID filtering across a trust relationship

      Overview – To implement this security measure, one needs to determine who has sufficient Write Property - trustAttributes Active Directory Effective Permissions on the Trusted-Domain object representing the trust relationship in the System container in Active Directory.

      How-To:

      1. Launch Active Directory Effective Permissions Calculator and select the report "Who has what effective permissions on an Active Directory object"
      2. Enter the distinguished name (DN) of the on the Trusted-Domain object (TDO) representing the trust relationship in the Scope field, then click the Run button to calculate effective permissions
      3. Once calculation is complete and results are displayed, use the What dropdown to locate and select the Write Property - trustAttributes effective permission
      4. The list of all accounts who can enact this operation on the specified object will be displayed in the Who pane. Review this list to identify all accounts that should not be able to enact this operation but can currently do so
      5. To lockdown access, for each such identified account, identify the exact security permission that is enabling this access for the account. To do so, click on the account in the Who pane, and the enabling security permission will be shown in the How pane. Then launch Active Directory Users and Computers, navigate to the TDO representing the trust relationship, access Advanced Security Settings to view the object's ACL, and modify the identified security permission



  6. A few additional general security measures -

    1. How to disable NTLM v1, remove SMBv1, enforce SMB signing and disable RC4 in your Active Directory environment

      Overview – To implement this security measure, one needs to first gain an understanding of these concepts, if needed use auditing to identify sources, and subsequently configure various policy settings in an Active Directory environment.

      How-To:

      1. Use guidance from Microsoft on how to disable NTLM v1, remove SMBv1, enforce SMB signing and disable RC4 in your Active Directory environment
        2. Note - Providing detailed guidance on how to disable NTLM v1, remove SMBv1, enforce SMB signing and disable RC4 in your Active Directory environment is currently outside of the scope of this undertaking, since these areas technically fall under Network Authentication.



    2. How to use LAPS to securely manage local administrator passwords on domain joined machines in an Active Directory environment

      Overview – To implement this security measure, one needs to first gain an understanding of how LAPS works and integrates with Active Directory, and subsequently implement LAPS in an Active Directory environment.

      How-To:

      1. Use guidance from Microsoft on how to implement LAPS in an Active Directory environment
        2. Note - Providing detailed guidance on how to implement LAPS in Active Directory is currently outside of the scope of this undertaking.



    3. How to use Managed Service Accounts (MSAs) to securely manage the lifecycle of service accounts in an Active Directory environment

      Overview – To implement this security measure, one needs to first gain an understanding of how MSAs work an an Active Directory environment, and subsequently create and use MSAs for enhanced service account security.

      How-To:

      1. Use guidance from Microsoft on how to deploy MSAs (sMSAs and gMSAs) in an Active Directory environment
        2. Note - Providing detailed guidance on how to deploy MSAs in Active Directory is currently outside of the scope of this undertaking.



    4. How to use quotas to limit the number of objects that non-privileged users can create in Active Directory

      Overview – To implement this security measure, one needs to first gain an understanding of how quotas work in Active Directory, and subsequently implement the use of quotas in Active Directory.

      How-To:

      1. Use guidance from Microsoft on how to implement quotas in Active Directory
        2. Note - Providing detailed guidance on how to implement quotas in Active Directory is currently outside of the scope of this undertaking.



    7. +

  7. Security measures to secure and protect Critical Dependencies -

    The security of critical dependencies is currently out of the scope of this undertaking. Please refer to official guidance from Microsoft on how to adequately secure and protect critical dependencies.