Member Avatar for Sammy_3

Hi there, I’m doing some research around cybersecurity — specifically access management. Does anyone have a moment to answer the below please?

  1. Since Windows Active Directory is nearly ubiquitous in enterprises, what are IT professionals doing to secure access? What are the biggest challenges to securing user access using native Active Directory? What kind of employees do you think are most likely to open an organisation up to access risks?

  2. How big a security concern do you see access security in your organization. Do you use Windows Active Directory?

  3. What Microsoft tools bundled with Active Directory do you use or rely on? (Active Directory Users and Computers (ADUC), Group Policy Management Console (GPMC))

  4. I have a specific question around change logs (audit) supplied by Active Directory, which are very technical in nature and require manual correlation to track users. How important is it to have visibility of both user access and data/application access events?

  5. How important is real-time visibility with regards to managing access? Would you feel that without real-time visibility into who is accessing your networks and files, you’d be left significantly weakened as a result? Do you ever worry that if you can’t see what’s going on, attackers will take advantage of that?

  6. How important is it to get an alert when certain access events occur? What do you do when you’ve detected suspicious access activity? How quickly are you able to identify and contain a suspicious breach?
  • 3 Contributors
  • 2 Replies
  • 401 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by happygeek

Dani AI

Generated

A short, practical summary that builds on ’s questions and the pointers from (and the follow-up from ): Active Directory itself is the enterprise identity control plane, so when credentials or privileged accounts are compromised the attacker gets broad, long-lived access. Common failure modes are credential theft (Pass‑the‑Hash / Pass‑the‑Ticket), forged Kerberos tickets (Golden/Silver tickets), legacy/NTLM fallbacks, and standing privileged/service accounts that are used for day‑to‑day work rather than just administration. Detection and alerting for these techniques are baked into Microsoft’s threat products because they’re primary AD risks. (learn.microsoft.com)

Native AD audit data is detailed but noisy and low‑level — it must be centralized, normalized and correlated to be useful. Good log management (central collection, consistent timestamps, retention, protected storage, and automated alerting) is not optional: it’s the difference between detecting an intrusion early and missing long, stealthy persistence. NIST’s guidance on log management explains why structured collection and review are essential. (csrc.nist.gov)

Practical mitigations (what teams actually do): adopt Microsoft’s enterprise/tiered privileged‑access model and Privileged Access Workstation guidance; move to just‑in‑time privileged access (PIM/JIT) for directory roles; protect and rotate local admin credentials (LAPS) instead of having shared static passwords; enforce MFA/conditional access for admin and cloud‑management sign‑ins; and centralize AD security events into a SIEM with Kerberos/Account‑change analytic rules. These controls reduce blast radius and make forensic correlation tractable. (learn.microsoft.com)

Quick checklist to apply immediately:

  • Turn on and forward Domain Controller security events to a SIEM (audit policy for account changes, Kerberos events, logons).
  • Enforce MFA and restrict admin sign‑ins to PAWs / hardened devices.
  • Convert permanent admins to eligible/JIT roles (PIM) and remove service accounts from privileged groups.
  • Deploy LAPS for local admin password rotation and protect the recovery RBAC.
  • Build simple SIEM alerts for anomalous Kerberos patterns and group‑membership changes.

This complements ’s reading suggestions and gives a short operational path teams use today.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

Very good questions, and none of them have simple answers. It is after midnight here right now so I will try to respond to some of them tomorrow. Bed is calling. :-)

Member Avatar for happygeek

Apologies, but I don't have the time to provider considered answers to that list of questions right now; my own deadlines are calling.

However, I would suggest that you take a look at the following if you haven't already:

https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

https://www.linkedin.com/pulse/active-directory-security-10-most-common-issues-rahisuddin-shah

https://adsecurity.org/?p=1684

All the best

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.