How to Secure a Windows Active Directory

Most successful cyberattacks targeting Windows networks don’t start with malware — they start with misconfigured Active Directory environments. Attackers don’t need to break down the door if it’s already unlocked.

Active Directory (AD) is the backbone of most Windows-based enterprise networks. It manages users, computers, permissions, and policies across an organization — which also makes it one of the most targeted systems by attackers. A single misconfigured account or legacy protocol left enabled can hand an attacker the keys to your entire domain.

If you are studying for CompTIA Security+, working toward a cybersecurity diploma, or just getting started in IT, understanding how to secure Active Directory is an essential skill. In this guide, you will learn the key steps to harden a Windows Active Directory environment, with practical commands and Group Policy settings you can apply in a virtual lab or real-world deployment.

1. What is Active Directory and Why Does It Need to Be Secured?

Active Directory Domain Services (AD DS) is a Microsoft directory service that authenticates and authorizes users and computers in a Windows domain network. It stores information about network objects — users, groups, computers, and printers — and provides a centralized way to manage them through Group Policy.

Why attackers target Active Directory

• It controls access to virtually everything on the network
• Compromising a Domain Admin account means full control of the domain
• Legacy misconfigurations are extremely common in real environments
• Specialized attack techniques are built specifically to exploit AD weaknesses

Common real-world attacks that target Active Directory:

Securing AD is not optional — it is a foundational requirement for any organization running Windows infrastructure.

New to Active Directory? Start with the basics first: What is Active Directory — then come back to this hardening guide. Also useful: What is Group Policy and our Beginner PowerShell Guide.

The built-in Administrator account is a well-known target. Because its name is predictable, attackers often target it directly in brute-force and credential-stuffing attacks.

Rename the built-in Administrator account

Open Group Policy Management Console (GPMC) and navigate to:

Disable the built-in Administrator account

Disable-LocalUser -Name "Administrator"

Create a dedicated admin account with a unique name

New-ADUser -Name "corp-admin01" -AccountPassword (Read-Host -AsSecureString "Password") `
-Enabled $true -PasswordNeverExpires $false
Add-ADGroupMember -Identity "Domain Admins" -Members "corp-admin01"

Add privileged accounts to the Protected Users group

Members of this group are automatically protected against Pass-the-Hash, Pass-the-Ticket, and other credential theft techniques:

Add-ADGroupMember -Identity "Protected Users" -Members "corp-admin01"

Every user and service account should only have the permissions they need to do their job — nothing more. Over-privileged accounts are one of the most common ways attackers move laterally after an initial compromise.

• Never assign Domain Admin rights to regular user accounts
• Create separate accounts for administrative tasks vs daily use
• Review group memberships on a scheduled, regular basis

Audit privileged group memberships

# Check Domain Admins
Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, SamAccountName

# Check Enterprise Admins
Get-ADGroupMember -Identity "Enterprise Admins" | Select-Object Name, SamAccountName

# Check Schema Admins
Get-ADGroupMember -Identity "Schema Admins" | Select-Object Name, SamAccountName

Any account that does not need to be in these groups should be removed immediately.

Audit delegated permissions in AD

# Show all objects with non-inherited ACLs
Get-ADObject -Filter * -Properties nTSecurityDescriptor |
Where-Object { $_.nTSecurityDescriptor.AreAccessRulesProtected -eq $true }

Weak passwords are one of the most common entry points for attackers. Group Policy allows you to enforce password complexity requirements across your entire domain from a single location.

Open Group Policy Management

Recommended password policy settings

Apply via PowerShell

Set-ADDefaultDomainPasswordPolicy -Identity "yourdomain.com" `
  -MinPasswordLength 14 `
  -ComplexityEnabled $true `
  -MaxPasswordAge (New-TimeSpan -Days 90) `
  -MinPasswordAge (New-TimeSpan -Days 1) `
  -PasswordHistoryCount 24

Fine-Grained Password Policies for privileged accounts

Fine-Grained Password Policies (FGPP) let you apply stricter rules to specific groups like Domain Admins, without affecting regular users:

New-ADFineGrainedPasswordPolicy -Name "AdminPasswordPolicy" `
  -Precedence 1 `
  -MinPasswordLength 20 `
  -ComplexityEnabled $true `
  -MaxPasswordAge (New-TimeSpan -Days 60) `
  -PasswordHistoryCount 24 `
  -LockoutThreshold 3 `
  -LockoutDuration (New-TimeSpan -Minutes 30) `
  -LockoutObservationWindow (New-TimeSpan -Minutes 30)

Add-ADFineGrainedPasswordPolicySubject -Identity "AdminPasswordPolicy" `
  -Subjects "Domain Admins"

Account lockout prevents brute-force attacks by disabling an account after a set number of failed login attempts. Without this, an attacker can try unlimited password combinations.

Configure via Group Policy

Recommended lockout settings

Apply via PowerShell

Set-ADDefaultDomainPasswordPolicy -Identity "yourdomain.com" `
  -LockoutThreshold 5 `
  -LockoutDuration (New-TimeSpan -Minutes 30) `
  -LockoutObservationWindow (New-TimeSpan -Minutes 30)

If you are not logging what happens in your AD environment, you will not know when an attack occurs. Windows Event Log is your first line of visibility into what is happening on your domain.

Enable Advanced Audit Policy

Critical audit categories to enable

Enable via command line

auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Account Management" /success:enable /failure:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Directory Service Access" /success:enable /failure:enable

Key Windows Event IDs to monitor

Query failed logon events with PowerShell

# Find all failed logon attempts in the last 24 hours
Get-WinEvent -FilterHashtable @{
  LogName = 'Security'
  Id = 4625
  StartTime = (Get-Date).AddHours(-24)
} | Select-Object TimeCreated, Message

Microsoft recommends a Tiered Administration Model to limit how far privileged credentials can spread across your environment. The model has three tiers:

Restrict admin logon rights via GPO

Use Privileged Access Workstations (PAWs): Dedicated, hardened machines used only for administrative tasks. Never browse the internet or check email from a PAW.

Legacy protocols were designed before modern security requirements existed. They remain enabled by default in many environments and are frequently exploited.

Disable NTLMv1

Disable SMBv1

SMBv1 was exploited in the WannaCry and NotPetya ransomware attacks. There is no reason to have it enabled:

# Check current status
Get-SmbServerConfiguration | Select EnableSMB1Protocol

# Disable SMBv1 on the server
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Disable via Windows Features on workstations
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Disable LLMNR

LLMNR (Link-Local Multicast Name Resolution) is used by tools like Responder to capture credentials on the network:

Disable NetBIOS over TCP/IP

# Disable NetBIOS on all network adapters
$adapters = Get-WmiObject Win32_NetworkAdapterConfiguration
foreach ($adapter in $adapters) {
    $adapter.SetTcpipNetbios(2)  # 2 = Disable NetBIOS
}

Domain Controllers are the most critical servers in your environment. Unpatched DCs are a top target for attackers looking to exploit known vulnerabilities.

• Apply Windows security updates monthly on Patch Tuesday
• Do not install unnecessary software or roles on DCs
• Restrict physical and remote access — only Tier 0 admins should have DC access
• Do not allow DCs to browse the internet
• Enable Windows Firewall on all Domain Controllers

Check recent patches via PowerShell

# View the 10 most recently installed hotfixes
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Using PSWindowsUpdate module for full update management
Install-Module PSWindowsUpdate
Get-WindowsUpdate

Restrict RDP access to Domain Controllers

Microsoft provides free hardening baselines for Windows Server and Active Directory through the Security Compliance Toolkit (SCT). These baselines are aligned with CIS and NIST standards and give you a tested starting point rather than building policy from scratch.

Download: microsoft.com — Security Compliance Toolkit

The toolkit includes:

• Pre-built GPO baselines aligned to CIS and NIST standards
• Policy Analyzer tool to compare your current settings against the baseline
• LGPO.exe for importing and exporting local policy settings

Basic workflow

1. Download the baseline for your Windows Server version
2. Import the GPO into your domain using GPMC
3. Use Policy Analyzer to identify gaps between your current policy and the baseline
4. Remediate differences incrementally — do not apply everything at once in production

11. Quick Reference Checklist

Use this checklist when hardening a Windows Active Directory environment:

12. Conclusion