Photo by Samantha Sophia on Unsplash

Designing a secure Active Directory

Toughen Up!

Article from ADMIN 86/2025

By Evgenij Smirnov

Many experienced administrators find that Active Directory is particularly problematic in terms of security. We reflect on the secure design, rigorous hardening, and security-conscious management of this service.

Active Directory (AD) does not have a good reputation among many IT security specialists, and more than one admin thinks it should be removed as soon as possible. Of course, survivorship bias plays a role in such thoughts – infrastructures that require high-caliber specialists to rescue the day are ultimately those where the greatest discrepancy between lure for attackers and the degree of hardening exists. In this article, I use the term "hardening" to refer both to IT infrastructures themselves and to the people and processes involved in managing them.

Active Directory can be run in a pretty much secure way if the organization involved is at least prepared to drop old habits and invest in a secure, state-of-the-art design instead of just in third-party tools. This way might not sound as sexy in the annual report as the latest extended detection and response (XDR), managed detection and response (MDR), or identity threat detection and response (ITDR) strategies, but it is likely to offer greater benefits.

When AD Is Not AD

To get the ball rolling, the term "insecure AD" typically means Active Directory Domain Services (ADDS) – that is, a directory service tied to Kerberos authentication and group policies. In some cases, the Active Directory Certificate Services (ADCS), Microsoft's implementation of a public key infrastructure (PKI), deals the final death blow to the security of the environment.

However, three other ADs belong to the Windows server family. First is the Active Directory Rights Management Service (ADRMS), a cryptography tool for protecting digital content such as documents, email, etc. The service is very rarely used in local environments but provides the technology basis for Azure Information Protection, which evolved into Microsoft Information Protection and finally Microsoft Purview Information Protection

...

Use Express-Checkout link below to read the full article (PDF).