Defense & Hardening

Learn the strategies, configurations, and monitoring techniques that protect Active Directory from compromise.

10 Topics0/10 complete

Tiered Administration Model

The tiered administration model splits your AD environment into three trust zones so a compromised workstation can never cascade into full domain compromise.

Beginner

Privileged Access Workstations (PAWs)

A Privileged Access Workstation is a hardened, dedicated machine that exists for one purpose: administering critical infrastructure without exposing credentials to everyday threats.

Intermediate

Least Privilege & Just Enough Admin

Least privilege means giving every account exactly the permissions it needs to do its job — no more, no less — and Just Enough Administration (JEA) enforces this at the PowerShell level.

Intermediate

LAPS & Credential Guard

LAPS randomizes every machine's local admin password and stores it in AD, while Credential Guard uses hardware virtualization to make credential theft from memory nearly impossible.

Beginner

Protected Users & Authentication Policies

The Protected Users group and Authentication Policies are built-in AD features that harden Kerberos and block the most common credential attack techniques for sensitive accounts.

Intermediate

KRBTGT Account Management

The KRBTGT account is the master key to your entire Kerberos infrastructure — its password hash encrypts every TGT, and rotating it is the only way to invalidate Golden Tickets.

Intermediate

AD Security Event Monitoring

Windows Security Event Logs are the primary detection mechanism for AD attacks — knowing which Event IDs to monitor and what patterns to look for is the difference between catching an attack in progress and discovering it months later.

Intermediate

Honeypots & Deception in AD

Honeypot accounts and deception objects in AD provide high-confidence attack detection — any interaction with them is guaranteed to be malicious because no legitimate user or application ever touches them.

Intermediate

Microsoft Defender for Identity

Microsoft Defender for Identity (MDI) is a cloud-powered sensor that sits on your Domain Controllers, analyzing every authentication and directory operation to detect AD attacks in real time.

Intermediate

Securing Domain Controllers

Domain Controllers are the crown jewels of your network — every security recommendation in this module converges on one goal: making DCs as hardened, monitored, and isolated as possible.

Beginner

Defense & Hardening

Tiered Administration Model

Privileged Access Workstations (PAWs)

Least Privilege & Just Enough Admin

LAPS & Credential Guard

Protected Users & Authentication Policies

KRBTGT Account Management

AD Security Event Monitoring

Honeypots & Deception in AD

Microsoft Defender for Identity

Securing Domain Controllers

Test Your Knowledge