HackBlue

Tools · Workbench

Active Directory defense

Tutorials on Kerberos, NTLM, delegation, Group Policy, privileged groups, tiering, and auditing, written from the defender’s side of the domain.

  • 23 lessons
  • 4 h of reading
  • 5 topics
Start with lesson 1All workbenches

Active Directory is the identity system behind most corporate Windows networks, which makes it the system attackers most want to understand. These tutorials explain how its pieces work, which misconfigurations show up again and again, and what a domain administrator can check, log, and fix.

Build a small lab domain to follow along. The techniques here are explained conceptually with detection and remediation, not as step-by-step attacks.

Foundations

1 lesson

  1. 01How to build a small Active Directory lab for security practiceStand up a domain controller, a member server, and a workstation on an isolated network, seed realistic users and groups, and snapshot it before every exercise.12 min

Kerberos and NTLM

9 lessons

  1. 01Kerberos authentication explained for Active Directory defendersFollow a logon from AS-REQ to service ticket, learn what the TGT and krbtgt key are, and map each step to the event IDs on your domain controllers.12 min
  2. 02Kerberoasting explained: how to detect it with Event 4769 and prevent itUnderstand why service accounts with SPNs and weak passwords are at risk, find them, detect bursts of RC4 service ticket requests, and fix with gMSAs and AES.12 min
  3. 03AS-REP roasting: find accounts with Kerberos pre-authentication disabledLearn why “Do not require Kerberos preauthentication” exposes an account to offline guessing, find every such account, detect requests, and turn the flag off.9 min
  4. 04Golden tickets and the krbtgt account: why and how to reset krbtgt safelyUnderstand forged TGTs conceptually, what detection can and cannot see, and how to rotate the krbtgt key twice without breaking the domain.11 min
  5. 05Kerberos delegation explained: unconstrained, constrained, and resource-basedLearn what each delegation type allows, find computers and accounts trusted for unconstrained delegation, and protect sensitive accounts from being delegated.12 min
  6. 06How to audit and reduce NTLM authentication in Active DirectoryFind where NTLM is still used with the NTLM Operational log and 4624 events, disable NTLMv1 and LM, and plan a gradual NTLM restriction.10 min
  7. 07Defending against NTLM relay: SMB signing, LDAP signing, channel binding, and EPAUnderstand relay at a conceptual level and turn on the server-side protections that make relayed authentication useless.11 min
  8. 08The Protected Users group: what it does and who belongs in itAdd privileged accounts to Protected Users to block NTLM, RC4, delegation, and credential caching for them, and avoid the accounts that should never be added.9 min
  9. 09LSA protection and Credential Guard: stopping credential theft from LSASSUnderstand why LSASS memory is targeted, enable RunAsPPL and Credential Guard, check that they are running, and read the related events.10 min

Directory hygiene

7 lessons

  1. 01How to review privileged groups in Active Directory, including nested members and adminCountList the real members of Domain Admins and the other protected groups including nesting, understand AdminSDHolder and adminCount, and shrink the list.10 min
  2. 02Find and clean up stale user and computer accounts in Active DirectoryUse lastLogonTimestamp and Search-ADAccount to find inactive accounts, understand the replication lag, and disable before you delete.9 min
  3. 03Audit risky Active Directory account flags: password not required, never expires, reversible encryptionFind accounts with PASSWD_NOTREQD, DONT_EXPIRE_PASSWORD, reversible encryption, DES-only, and SID history, and understand why each matters.9 min
  4. 04Dangerous Active Directory permissions: GenericAll, WriteDACL, and how to find themUnderstand which object permissions let one account take over another, read ACLs with PowerShell, and review delegations on privileged objects.11 min
  5. 05DCSync explained: who has replication rights and how to detect misuse with Event 4662Understand directory replication rights conceptually, list every account that holds them, and detect replication requests from non-DC machines.10 min
  6. 06Group Policy security review: GPO permissions, SYSVOL passwords, and risky settingsFind who can edit GPOs linked to sensitive OUs, search SYSVOL for old Group Policy Preferences passwords, and review scripts and settings that run as SYSTEM.10 min
  7. 07Active Directory Certificate Services security: risky certificate templates explainedUnderstand why AD CS is Tier 0, recognize templates that let requesters choose the subject, audit them with defensive tools, and turn on CA auditing.12 min

Attack path thinking

3 lessons

  1. 01BloodHound for defenders: finding and removing attack paths in Active DirectoryThink of Active Directory as a graph of who can control what, collect data in an authorized way, read the shortest paths to Tier 0, and cut the edges that matter.12 min
  2. 02How to run a PingCastle Active Directory health check and act on the reportRun PingCastle’s health check as a regular user, read the four risk categories, and turn the top findings into a short remediation plan.9 min
  3. 03The Active Directory tiering model explained: Tier 0, Tier 1, and Tier 2Separate control of identity systems, servers, and workstations so a compromised laptop cannot lead to the domain, and see how to start with admin accounts and logon restrictions.11 min

Monitoring

3 lessons

  1. 01Domain controller auditing baseline: the events every AD team should collectEnable directory service change auditing, set SACLs for 5136, and collect the Kerberos, account, group, and replication events that cover most AD attacks.10 min
  2. 02What is ms-DS-MachineAccountQuota and why you should set it to 0Learn why default AD lets any user create ten computer accounts, how that enables several attack chains, and how to delegate computer joins properly.8 min
  3. 03Active Directory backup and recovery: Recycle Bin, system state, and DSRMEnable the AD Recycle Bin, take system state backups of a DC, protect the DSRM password, and know the difference between restoring an object and recovering a forest.10 min