This is the most comprehensive list of Active Directory Security Best Practices online.
AD Security topics covered in this guide:
- Limit the use of Domain Admins and other Privileged Groups
- Use at least two accounts
- Secure the domain administrator account
- Disable the local administrator account (on all computers)
- Use Laps
- Use a secure admin workstation (SAW)
- Enable audit policy settings with group policy
- Monitor for signs of compromise
- Password complexity sucks (use passphrases)
- Use descriptive security group names
- Find and remove unused user and computer accounts
- Remove Users from the Local Administrator Group
- Do not install additional software or server roles on DCs
- Patch management and vulnerability scanning
- Use secure DNS services to block malicious domains
- Run supported operating systems
- Use two factor for office 365 and remote access
- Monitor DHCP logs for connected devices
- Monitor DNS logs for malicious network activity
- Use latest ADFS and azure security features
- Use office 365 secure score
- Have a recovery plan
- Document delegation to Active Directory
- Lock down service accounts
- Use security baselines and benchmarks
- Active Directory Security Checklist
