Active Directory Hardening: A Practical Step-by-Step Guide

Active Directory is the identity backbone of most enterprises — and the single most targeted component in a ransomware or intrusion campaign. Once an attacker reaches Domain Admin or any Tier 0 asset, they effectively own the environment. AD's default configuration favours backwards compatibility over security, so hardening is not optional; it is the work of closing the gaps the defaults leave open. This guide is a practical, step-by-step walkthrough of the controls that matter most, ordered roughly by impact. You will not need every item on day one, but you should know where each one sits.

The mindset: protect Tier 0 above all

Every hardening decision traces back to one goal — keep attackers away from the credentials and systems that control the directory. Think in terms of an attacker's path: phish a user, harvest a credential, escalate privilege, move laterally, and reach a Domain Controller. Hardening breaks that chain at every link, but the highest priority is protecting the assets that grant control of AD itself.

1. Adopt the tiered administration model

The tiered model is the foundation of AD security. It prevents high-value credentials from ever being exposed on lower-trust systems where they can be stolen.

The golden rule: never use a higher-tier account on a lower-tier asset. Enforce it technically with logon-restriction Group Policy (Deny log on locally / through Remote Desktop / as a batch or service) so a Tier 0 credential cannot be used — and therefore cannot be harvested — on a Tier 1 or Tier 2 machine. Administer Tier 0 from dedicated Privileged Access Workstations (PAWs) that are hardened, internet-restricted, and used for nothing else.

2. Privileged access hygiene

Separate duties from privilege. Every administrator should have a normal day-to-day account and one or more separate administrative accounts that are never used for email or browsing.

• Add privileged accounts to the Protected Users group. Membership disables NTLM, blocks credential caching, forces Kerberos (no DES/RC4), and prevents delegation — sharply limiting credential-theft techniques. Test first: Protected Users members cannot use NTLM, so legacy apps may break.
• Minimise Domain Admins and Enterprise Admins. These groups should be nearly empty in steady state. Use just-in-time elevation rather than permanent membership.
• Mark sensitive accounts "Account is sensitive and cannot be delegated" so they cannot be impersonated through Kerberos delegation.
• Use a clean-source / red-forest or PIM approach for just-in-time, time-bound privileged access where possible.

3. Manage local admin passwords with Windows LAPS

A shared or reused local administrator password lets one compromised machine unlock every other. Windows LAPS randomises and rotates the local administrator password on every machine and stores it securely. It is now built into Windows (Windows 11, Windows Server 2022 and later) — no MSI to install — and the legacy Microsoft LAPS product is deprecated as of Windows 11 23H2. Windows LAPS improves on the old tool: it encrypts stored passwords, keeps password history, can back up to Microsoft Entra ID as well as on-prem AD, and can manage the Domain Controller DSRM password. Migrate any legacy LAPS deployments; an emulation mode eases the transition.

4. Kill legacy authentication and weak protocols

Many AD attacks rely on outdated protocols that should be switched off.

• Disable NTLM where possible, and at minimum disable NTLMv1 and LM hashes (LmCompatibilityLevel). Audit NTLM use before blocking to avoid breaking dependencies.
• Disable SMBv1 everywhere — it is unauthenticated, unencrypted, and the vector for WannaCry/EternalBlue.
• Enforce SMB signing to defeat relay attacks.
• Require LDAP signing and LDAP channel binding on Domain Controllers to block LDAP relay and man-in-the-middle.
• Remove or restrict the Print Spooler service on Domain Controllers (PrintNightmare / spooler-based coercion).
• Disable legacy ciphers (DES, RC4) for Kerberos and require AES.

5. Defend Kerberos

Kerberos is central to AD and a rich target. Close the well-known abuse paths:

6. Service-account and password hygiene

• Replace standing service accounts with gMSA wherever the application supports it — no human ever knows the password, and it rotates automatically.
• Use Fine-Grained Password Policies to apply stronger requirements to privileged and service accounts than to general users.
• Ban common and breached passwords (Entra Password Protection can extend banned-password lists to on-prem AD).
• Disable or remove stale accounts and dormant computer objects on a schedule; every unused enabled account is attack surface.
• Remove SPNs from privileged user accounts so they cannot be Kerberoasted.

7. Turn on advanced audit policy and monitor it

You cannot detect what you do not log. Enable the advanced audit policy subcategories and forward Domain Controller logs to a SIEM.

• Enable, at minimum: Account Logon, Account Management, DS Access (directory service changes), Logon/Logoff, and Privilege Use.
• Watch high-signal events: 4768/4769 (Kerberos TGT/service tickets — Kerberoasting indicators), 4624/4625 (logon success/failure), 4672 (special privileges assigned), 4728/4732/4756 (additions to privileged groups), and 4738 (account changed).
• Forward to a SIEM/XDR and alert on anomalies — group changes, off-hours admin logons, and ticket-request spikes.

8. Reduce attack surface and patch relentlessly

• Patch Domain Controllers promptly — privilege-escalation bugs like Zerologon and the sAMAccountName/PAC issues are routinely exploited.
• Restrict RDP to DCs and require MFA / jump hosts for administrative access.
• Limit who can join machines to the domain (set ms-DS-MachineAccountQuota to 0) to block machine-account abuse.
• Harden DNS and remove unnecessary roles from Domain Controllers — a DC should do as little as possible beyond being a DC.

9. Protect backups and plan for recovery

Ransomware crews target AD backups specifically. Keep offline, immutable backups of system state for Domain Controllers, store them out of reach of Tier 0 credentials, and rehearse a full AD forest recovery. A hardened directory you cannot restore is still a single point of failure.

10. Find attack paths before attackers do

Assess continuously with free tooling. PingCastle and Purple Knight score your AD against known weaknesses and produce prioritised reports; BloodHound maps the privilege-escalation graph the way an attacker sees it, exposing unexpected paths to Domain Admin. Run them regularly and treat the findings as a backlog.

Where AD hardening meets Zero Trust

On-prem AD hardening is one half of a modern identity strategy; the other is your cloud identity in Microsoft Entra. The tiered model, least privilege, and credential hygiene here are the same principles behind Zero Trust Architecture. To extend protection to the cloud side, pair this with our Conditional Access gaps guide, and baseline your Microsoft 365 and Entra posture with the free, browser-based x365 audit tool, which surfaces MFA coverage, legacy-auth exposure, and risky identity configuration without sending tenant data off your device.

Frequently asked questions

What is the most important step to harden Active Directory?

Adopting the tiered administration model and protecting Tier 0 assets. The single most damaging outcome in AD is an attacker reaching Domain Admin, so the priority is ensuring high-privilege credentials are never exposed on lower-trust workstations or servers where they can be stolen. Enforce this with logon-restriction Group Policy and dedicated Privileged Access Workstations.

What is the tiered admin model in Active Directory?

It splits administrative accounts into three tiers: Tier 0 (Domain Controllers, AD and anything controlling identity), Tier 1 (member servers and applications), and Tier 2 (workstations and end-user devices). Accounts from one tier may never log on to a lower tier, which prevents a compromised workstation from exposing a Domain Admin credential.

Is Microsoft LAPS still used?

The legacy Microsoft LAPS product is deprecated. It has been replaced by Windows LAPS, which is built into Windows 11 and Windows Server 2022 and later with no separate installation. Windows LAPS randomises and rotates local administrator passwords, encrypts them at rest, keeps password history, can back up to Microsoft Entra ID or on-prem AD, and can manage the Domain Controller DSRM password. Existing legacy deployments should migrate to Windows LAPS.

What is Kerberoasting and how do I prevent it?

Kerberoasting is an attack where an adversary requests Kerberos service tickets for accounts with a Service Principal Name and cracks them offline to recover the service-account password. Prevent it by using group Managed Service Accounts (gMSA) with long auto-rotating passwords, enforcing AES encryption, removing unnecessary SPNs from privileged accounts, and monitoring event IDs 4769 for unusual ticket requests.

Which audit events should I monitor on Domain Controllers?

Enable the advanced audit subcategories for Account Logon, Account Management, DS Access, Logon/Logoff and Privilege Use, then watch high-signal events: 4768/4769 (Kerberos tickets), 4624/4625 (logon success/failure), 4672 (special privileges assigned), 4728/4732/4756 (privileged group membership changes) and 4738 (account changed). Forward these to a SIEM and alert on anomalies.

How does Active Directory hardening relate to Zero Trust?

They share the same principles — least privilege, no implicit trust, and assume breach. AD hardening applies them on-premises (tiered admin, credential hygiene, segmentation of privilege), while Zero Trust extends them across identity, devices, networks, applications and data, including your cloud identity in Microsoft Entra. Hardened AD is a prerequisite for a credible Zero Trust programme in a hybrid environment.