Software and Security on Domain Controllers

This post was inspired by someone who I consider a friend and a mentor in the Active Directory world...11 time AD MVP Joe Richards

Microsoft recently published an excellent Active Directory Security document.   Laura Robinson is the lead author of the document and there are serious heavy hitters in the acknowledgements section including Laura Hunter, Dean Wells, and others.   You can download the document using the link below:

Best Practices for Securing Active Directory

Joe brought up an excellent point on the DS-MVP list stating that we all know that best practice is to not run additional and unnecessary software on domain controllers but was this documented.   The document above addresses this.

From page 27 of the document:

Protecting Domain ControllersDomain controllers should be treated as critical infrastructure components, secured more stringently and configured more rigidly than file, print, and application servers. Domain controllers should not run any software that is not required for the domain controller to function or doesn’t protect the domain controller against attacks. Domain controllers should not be permitted to access the Internet, and security settings should be configured and enforced by Group Policy Objects (GPOs). Detailed recommendations for the secure installation, configuration, and management of domain controllers are provided in the Securing Domain Controllers Against Attack section of this document.

Microsoft also recently released a shorter document that is worth downloading and reading.

Securing Active Directory: An Overview of Best Practices 

I appreciate Microsoft and everyone who took time to write, edit, and review this important document..  Many times we can tell our customers best practices but they often don't believe it unless they see it come from a Microsoft site or document.

If you have worked around Active Directory long enough this is a common problem.  Domain Controllers used as file servers/app servers/etc.  This is simple, reduce your attack vectors don't install unnecessary software on your DCs.  Also look into RODCs and Server Core as other easy ways to help secure DCs.

You may also see similar posts on other MVP blogs. Joe has asked us to get the word out about this.

Security Compliance Manager 2.5 Released

Ned Pyle wrote a blog entry in January on the  Microsoft askds blog  about Security Compliance Manager 2.5 Beta

The tool has been officially released and is no longer in beta.

From the download center

We are pleased to announce that version 2.5 is released and now available for download from the Microsoft Download Center!

          Download SCM 2.5 now


I've been testing 2.5 Beta and really glad that it is now out of beta as it will be much easier to get the tool approved for use where I work.

You can read about the key features & benefits on the Microsoft site so I won't copy and paste them again here.

There will be follow up blog posts with more info and screen shots from the tool.

HSPD-12 and Active Directory Domains -Documents Updated

Microsoft has updated their documentation regarding HSPD-12 Logical Access Authentication and Active Directory Domains

These documents are probably going to be more valuable to those that support federal customers in the US but they are a good read for anyone planning to deploy smart cards in their environment.

For those not familiar with HSPD-12 in a nut shell it is a mandate for federal organizations to issue common ID/Smart cards to their users.  This comes into play in the Active Directory arena as the cards are used for login using two-factor authentication/smart card login.  The two-factors in this case are:

• Something the user has - the smart card
• Something the user knows - PIN

Everyone has seen this referenced in the Account tab of a user in AD Users & Computers.

Those in the military or who have supported US Military customers will hear the term CAC Card used for their smart cards. Those supporting civilian agencies/.gov will hear the term PIV Card for their smart cards.

You can get the updated Microsoft documentation here:

HSPD-12 Logical Access Authentication and 2008 Active Directory Domains 

Kurt Hudson has a good quote about the documents on the Windows PKI Blog

Included within this document are detailed steps to configure Windows Server 2008 R2 Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), Windows® 7, and Microsoft® Office 2010 to perform traditional UPN based smart card logon, explicit smart card logon (client authentication certificate mapped to multiple accounts), explicit cross-forest smart card logon and NIST SP800-78-3 compliant S/MIME email exchanges. 

Smart card/HSPD-12 adoption within agencies varies.  DoD has definitely been the leader in this space.  There are other agencies that I've been at that are also rolling but there are also those that haven't even started issuing smart cards to the majority of their users yet.   I'm not naming names here :)

How do you secure Active Directory and Windows Servers?

Computer security is a big concern these days and securing your Active Directory and Windows Servers is one of the most important things we can do as admins and engineers.

I also see questions come up all the time about people wanting to know how to secure their machines.

Although there is not one answer for every environment there are some good guidelines that have been released by Microsoft and various US Federal agencies that can help out.


In my opinion there are a handful of universal rules that apply to any Active Directory environment.

UNIVERSAL RULE#1:
Limit the number of enterprise and domain administrators. I've seen plenty of organizations lock down their systems and take a lot of good security measures and then you look and there could be 50-100 (or more)domain admins.

Domain admins have control over every aspect of your domain, in fact a domain admin can have control of your entire forest.

It is important to limit these very powerful accounts. Limiting admins also limits the number of inadvertent mistakes that can cause issues

UNIVERSAL RULE#2:
See Rule #1 :)

UNIVERSAL RULE#3:
Don't give your users admin rights to their PCs. This seems like a no brainier but I was involved in a question on one of the boards recently and the admin's boss mandated that he make all the users admins on their machines.

So now you have limited admins and you have a good anti-virus program and are patching your servers with the appropriate patches.

What other guidelines are out there to help an admin secure AD and their servers?

The following is a list of some guides that should get most organizations going in the right direction

1. NSA Security Guides
   Yes the NSA does more than electronic and their security guides are really in depth
   and have a lot of good information.


2. DISA Security Checklists
   Defense Information System Agency (DISA) is another US Federal Agency.  These checklists are similar to the NSA guides.  


3. DISA Active Directory STIG
   STIG's are DISA's Security Technical Implementation Guides and this one is particular to Active Directory.


4. Microsoft Best Practice Guide for Securing Active Directory
   Microsoft's best practices for securing Active Directory


5. Microsoft Server 2003 Security Guide
   Microsoft's guide on how to harden Windows Server 2003


6. Microsoft Windows Server 2008 Security Guide
   Similar to the 2003 guide but for 2008


7. Federal Dektop Core Configuration (FDCC)
   Although not for servers  FDCC is a mandate for US Federal agencies and these lock downs can help all organizations.

UPDATE via comments from Garrett - Thanks Garrett!!

The Active Directory STIG has been deprecated by the all encompasing Directory Services STIG. While it has sections for specific software (like AD), it also contains overarching security guidlines that trancends all implementations of Directory Services.

http://iase.disa.mil/stigs/stig/directory-services-stig-v1r1.pdf

Those guides are a really good place to start if you want to learn more about securing your Windows Servers and AD Infrastructure.

This all leads me to Universal Rule #4...

UNIVERSAL RULE#4:
Don't just blindly install security templates and don't lock down Active Directory or your servers without testing testing testing.  This may seem like common sense but again I've seen many incidents of servers or AD being hardened and then users may lose functionality or other major problems can arise because the lock downs were not tested.   It is important to be secure but at the end of the day it is also important for our users/customers to be able to function and do their jobs.

You say you don't have a test lab? To address that issue I'll defer to a quote by the great Don Hacherl - you can think of him as the godfather of Active Directory.

"You do, in fact, have a lab environment. What you do not have is a production environment."

These are by no means the only guides for securing AD or your Windows Servers. There are also good books and plenty of blogs and other guides. Please feel free to leave comments about your experiences with seucrity and AD