Active Directory Hardening
Implement tiered admin model, Protected Users group, credential guard, and audit policies.
Active Directory Hardening is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
AD Hardening Philosophy
Active Directory is the authentication backbone of most enterprise Windows environments. Compromising AD means compromising everything. Hardening focuses on reducing attack surface, protecting privileged accounts, and enabling detection.
Tiered Administration Model
The tiered admin model prevents privilege escalation by requiring different admin accounts for each tier: Tier 0 (domain controllers), Tier 1 (servers), Tier 2 (workstations). Admins never log into lower tiers with higher-tier credentials.
# Tier 0: DC, PKI, ADFS, Azure AD Connect
# Tier 1: Servers, applications
# Tier 2: Workstations, laptops
# Tier 0 admins only log into Tier 0 systems
# Violation: DA logging into workstation
# = hash exposed, domain compromise possibleProtected Users Security Group
Members of the Protected Users group cannot use NTLM, DES, or RC4 encryption. Their TGTs are non-renewable and short-lived. Add all privileged accounts here — it prevents credential caching and limits PtH attacks.
# Add account to Protected Users
Add-ADGroupMember -Identity "Protected Users" \
-Members "DomainAdmin1"
# Effects:
# No NTLM auth
# No credential caching
# No CredSSP delegation
# TGT max 4 hoursCredential Guard
Enable Credential Guard on all Windows 10/11 Enterprise and Server 2016+ systems. It moves LSASS into a virtualized container that SYSTEM-level processes cannot access — blocks Mimikatz credential dumping.
# Enable via Group Policy:
# Computer Config > Admin Templates
# > System > Device Guard
# > Turn On Virtualization Based Security
# Set: Enabled
# Credential Guard: Enabled with UEFI lockLAPS: Local Admin Password Solution
LAPS automatically rotates unique local administrator passwords on each domain-joined machine and stores them securely in AD. Eliminates lateral movement via shared local admin passwords.
# Install LAPS
Install-Module -Name LAPS
Update-LapsADSchema
# View password (requires permission)
Get-LapsADPassword -Identity WORKSTATION01
# Set management policy via GPO
# LAPS password complexity + rotation intervalDisable NTLM
NTLM enables relay attacks. Restrict it progressively: audit usage, block outbound NTLMv1, then NTLMv2, and finally block all NTLM (replacing with Kerberos). SMB signing prevents relay of remaining NTLM.
# GPO: Restrict NTLM
# Computer Config > Windows Settings > Security
# > Local Policies > Security Options
# "Network security: Restrict NTLM: Incoming NTLM traffic"
# Set: Deny all accountsSMB Signing
SMB signing prevents NTLM relay attacks by cryptographically signing SMB sessions. Required on all domain controllers; should be enforced on all clients and servers.
# Enable SMB signing via GPO:
# Microsoft network server: Digitally sign communications (always)
# Set: Enabled
# Verify via PowerShell:
Get-SmbServerConfiguration | Select RequireSecuritySignaturePrivileged Access Workstations (PAW)
PAWs are dedicated, hardened machines used only for administrative tasks. Admins never browse the internet or read email from PAWs — reducing phishing and drive-by compromise risk for privileged sessions.
AD Auditing and Monitoring
Enable audit policies to log: account logon events (4624/4625), privileged use (4672), group membership changes (4728/4732), and GPO modification. Forward to a SIEM for correlation and alerting.
# Key Event IDs to monitor:
# 4624: Successful logon
# 4625: Failed logon
# 4648: Logon with explicit credentials
# 4672: Special privileges assigned
# 4769: Kerberos service ticket request
# 4776: NTLM credential validationGroup Policy Hardening
Apply security baselines via GPO: disable LLMNR/NBT-NS (prevents Responder attacks), restrict PowerShell execution, enable AppLocker/WDAC, and configure Windows Firewall profiles.
BloodHound for Attack Path Analysis
Run BloodHound in your own environment to find attack paths to Domain Admin. Proactively remove unnecessary group memberships, delegation misconfigurations, and SPN assignments revealed by the graph.
# Collect data with SharpHound
SharpHound.exe -c All
# Import to BloodHound
# Find shortest path to DA
# Remediate each node in the attack pathQuick Check
What does LAPS solve in Active Directory environments?
Summary: AD Hardening
AD hardening is layered: implement tiered administration and PAWs to protect credentials, enable Credential Guard and Protected Users to prevent credential theft, deploy LAPS to eliminate lateral movement via shared local passwords, enforce SMB signing to block relay, and use BloodHound proactively to find and eliminate attack paths before adversaries do.
Frequently asked questions
Is the “Active Directory Hardening” lesson free?
Yes — the full text of “Active Directory Hardening” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Active Directory Hardening”?
Implement tiered admin model, Protected Users group, credential guard, and audit policies. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Active Directory Hardening” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.