Today, Microsoft has released a document, detailing the Best Practices for Securing Active Directory Domain Services.

The document contains 22 best practice recommendations to assist organizations in enhancing the security of their Active Directory installations. By implementing these recommendations, organizations will be able to identify and prioritize security activities, protect key segments of their organization’s computing infrastructure, and create controls that significantly decrease the likelihood of successful attacks against critical components of their networking environments:

1. Patch applications.
2. Patch operating systems.
3. Deploy and promptly update antivirus and antimalware software across all systems and monitor for attempts to remove or disable it.
4. Monitor sensitive Active Directory objects for modification attempts and Windows for events that may indicate attempted compromise.
5. Protect and monitor accounts for users who have access to sensitive data.
6. Prevent powerful accounts from being used on unauthorized systems.
7. Eliminate permanent membership in highly privileged groups.
8. Implement controls to grant temporary membership in privileged groups when needed.
9. Implement secure administrative hosts.
10. Use application whitelisting on domain controllers, administrative hosts, and other sensitive systems.
11. Identify critical assets, and prioritize their security and monitoring.
12. Implement least-privilege, role-based access controls to administer the directory, its supporting infrastructure, and domain-joined systems.
13. Isolate legacy systems and applications.
14. Decommission legacy systems and applications.
15. Implement secure development lifecycle programs for custom applications.
16. Implement configuration management, review compliance regularly, and evaluate settings with each new hardware or software version.
17. Migrate critical assets to pristine forests with stringent security and monitoring requirements.
18. Simplify security for end users.
19. Use host-based firewalls to control and secure communications.
20. Patch devices.
21. Implement business-centric lifecycle management for IT assets.
22. Create or update incident recovery plans.

The document also discusses the most common attacks against Active Directory and countermeasures to reduce the attack surface, and recommendations for recovery in the event of complete compromise.

The 321-page document (135 pages of main content and 185 pages with appendices A through M) is provided for free in *.docx format. Download it here.

Related blogposts

Auditing directory changes aka "Who deleted this object"
How to create and use confidential attributes
MS013-032 Vulnerability in Active Directory Could Allow Remote Code Execution (Important)Preventing Domain Controller promotions, cloning and demotions in Windows Server 2012
Updated Active Directory Capacity Planning Guidance Available (adsizer.exe Be Gone!)

Acknowledgements

Thanks to Meinolf Weber for the tip.