Securing the Domain Policy

The default Domain Policy controls and governs the assignment of vital account policies that apply to domain user accounts and Kerberos authentication, and securing it is amongst the most important of all Active Directory Security Measures.

Note - Policies that control and govern the assignment of various critical local policies, user rights and privileges on Domain Controllers are configured in the default Domain Controllers Policy, which is separate from the default Domain Policy.

There are 3 account policies that need to be adequately configured -

PASSWORD POLICY
1. Enforce password history
  
  Overview - This setting determines the number of unique new passwords that have to be associated with a user account before an old password can be reused.
  
  Default - 24 passwords remembered
  
  Recommendation - No change
2. Maximum password age
  
  Overview - This setting determines the period of time (in days) that a password can be used before the system requires the user to change it.
  
  Default - 42 days
  
  Recommendation - No change
3. Minimum password age
  
  Overview - This setting determines the period of time (in days) that a password must be used before the user can change it.
  
  Default - 1 day
  
  Recommendation - No change
4. Minimum password length
  
  Overview - This setting determines the least number of characters that the password for a user account may contain.
  
  Default - 7 characters
  
  Recommendation - No change
5. Minimum password length audit
  
  Overview - This setting determines the minimum password length for which a password length audit warning event is issued.
  
  Default - Not Defined
  
  Recommendation - Define and enable only when trying to determine potential impact of increasing minimum password length.
6. Password must meet complexity requirements
  
  Overview - The setting determines whether or not passwords must meet complexity requirements.
  
  Default - Enabled
  
  Recommendation - No change
7. Relax minimum password length limits
  
  Overview - This setting controls whether the minimum password length setting can be increased beyond the legacy limit (14 characters).
  
  Default - Not Defined
  
  Recommendation - Define and enable only if you wish to increase the minimum password length to be greater than 14 characters.
8. Store passwords using reversible encryption
  
  Overview - This setting determines whether the operating system stores passwords using reversible encryption.
  
  Default - Disabled
  
  Recommendation - No change

ACCOUNT LOCKOUT POLICY
1. Account lockout duration
  
  Overview - This setting determines the number of minutes that a locked-out account remains locked out before automatically becoming unlocked.
  
  Default - Not Defined
  
  Recommendation - Define and set to 0 minutes. When set to 0 minutes, the account will remain locked until the sooner of when the account lockout reset duration expires or an administrator explicitly unlocks it.
2. Account lockout threshold
  
  Overview - This setting determines the number of failed logon attempts that cause a user account to be locked out.
  
  Default - 0 invalid logon attempts
  
  Recommendation - Set to 20 invalid logon attempts.
3. Allow Administrator account lockout
  
  Overview - This setting determines whether the builtin Administrator account is subject to the account lockout policy.
  
  Default - Not Defined
  
  Recommendation - No change
4. Reset account lockout counter after
  
  Overview - This setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts.
  
  Default - Not Defined
  
  Recommendation - Define and set to 30 minutes.

KERBEROS POLICY
1. Enforce user logon restrictions
  
  Overview - This setting determines whether the Kerberos v5 KDC validates every request for a session ticket against the user rights policy of the user account.
  
  Default - Enabled
  
  Recommendation - No change
2. Maximum lifetime for service ticket
  
  Overview - This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service.
  
  Default - 600 minutes
  
  Recommendation - No change
3. Maximum lifetime for user ticket
  
  Overview - This setting determines the maximum amount of time (in hours) that a user's ticket-granting ticket (TGT) may be used.
  
  Default - 10 hours
  
  Recommendation - No change
4. Maximum lifetime for user ticket renewal
  
  Overview - This setting the period of time (in days) during which a user's ticket-granting ticket (TGT) may be renewed.
  
  Default - 7 days
  
  Recommendation - No change
5. Maximum tolerance for computer clock synchronization
  
  Overview - This setting determines the maximum time difference (in minutes) that Kerberos v5 tolerates between the time on the client clock and the time on the DC.
  
  Default - 5 minutes
  
  Recommendation - No change