Top 10 easiest way to Harden your Windows Domain

by | Apr 3, 2023 | Security | 0 comments

Reading Time: < 1 minute

The following 10 quick wins, will not prevent you to be full 100% hack proof, but I promiss you, if you are able to implement those 10 things, then a hacker will have much more trouble to become a Domain Admin user from a simple User, to deploy it’s Ransomware or other malicous intent activity.

  1. Remove the count of 10 account machines than any user can create
  2. Disable LLMNR , NBT-NS and WPAD on all the devices
  3. LAPS deployed on all end-user devices and each server should have an unique local Administrator account
  4. RunAsPPL on all machines except the Domain Controller
  5. SMB Signing enforced on all devices
  6. LDAP signing and Channel Binding on the windows LDAD servers
  7. Weak Windows passwords, worst will be if the account has a SPN
  8. Patching, patching patch your servers, and not just once a year, but every month.
  9. Add all priviledged account (including Domain Admin accounts) add the users to Protected User group (be carefull it has impacts as it disables SSO and forces Kerberos authentication instead of NTLM)
  10. If ADCS, make sure to be secure on all the attacks (ESC1-8) and to have enabled all logging necessary.

How to check ?

Easiest way, use the open source PingCastle

Best is to run it frequently on a regular basis to check if something is getting better or worse.

2