Active Directory Security Tooling

To adequately secure an Active Directory deployment, IT personnel need to configure, assess and lockdown access to Domain Controllers, to Active Directory Contents and to Administrative Account and Groups, and some of these tasks require tooling.

The following is an asset-class protection based list of tools that are necessary to adequately secure Active Directory -

Asset Class .	Capability .	Tooling .
I. Logical Structure	Create, manage and severe trust relationships, and configure SID filtering across trusts	Active Directory Domains and Trusts, netdom
II. Domain Controller Security	Promote and demote Domain Controllers (DCs) Configure, assess and lockdown various security settings and services on DCs Assess and lockdown access on DC computer accounts in Active Directory Configure directory services auditing and view event logs Manage and monitor replication	Windows Server Manger Group Policy Management Console, auditpol Active Directory Effective Permissions Calculator + Active Directory Users and Computers Group Policy Management Console, auditpol, Windows Event Viewer ntdsutil, replmon, repadmin
III. Active Directory Contents	Create and delete objects in Active Directory, and configure various object properties Provision and/or delegate access (i.e. modify security permissions) in Active Directory Assess access (i.e. calculate effective permissions) on Active Directory objects Assess and lockdown access in Active Directory Assess/identify privileged access and/or administrative delegations in Active Directory Identify privilege escalaton paths in Active Directory View, analyze and export ACLs protecting all Active Directory contents Find glaring misconfiguratons in access provisioned in Active Directory Configure auditing on Active Directory contents Configure, manage and link group policies to Active Directory OUs, domains and sites	Active Directory Users and Computers, ADSIEdit Active Directory Users and Computers, ADSIEdit, Delegation of Control Wizard, ldp Active Directory Effective Permissions Calculator Active Directory Effective Permissions Calculator + Active Directory Users and Computers Active Directory Privileged Access Assessor Active Directory Privilege Escalation Path Identifier Active Directory ACL Analyzer and Exporter, dsacls, ldp Active Directory Permissions Analyzer Active Directory Users and Computers, ADSIEdit Group Policy Management Console
IV. Administrative Access	Create, manage and secure Active Directory administrative accounts and groups Assess and lockdown access on adminisrative accounts and groups in Active Directory	Active Directory Users and Computers Active Directory Effective Permissions Calculator + Active Directory Users and Computers
V. Active Directory Backups	Create Active Directory backups and restore Active Directory from backups	Active Directory Backup and Restore

Note -

• Active Directory (AD) Domains and Trusts, AD Users and Computers, ADSIEdit, Windows Server Manger, Group Policy Management Console, Windows Event Viewer, ntdsutil, replmon, auditpol, ldp and AD Backup and Restore are all Microsoft tools that ship with Microsoft Windows Server.

• Active Directory Effective Permissions Calculator, Active Directory Privileged Access Assessor, Active Directory Privilege Escalation Path Identifier, Active Directory Permissions Analyzer and Active Directory ACL Analyzer and Exporter are all part of the Gold Finger ® tooling for Active Directory.
The Microsoft-endorsed Gold Finger tooling is the only non-Microsoft tooling that is actually required to adequately secure Active Directory, because it provides the world's only accurate Active Directory Effective Permissions calculation capabilities which are essential for securing Active Directory.