Active Directory Security

Scope

What this is: Securing Windows Active Directory environments through Group Policy, privilege management, and attack surface reduction.

Competition relevance: Infrastructure hardening from national stage up, and offensive operations from the attacker’s side. AD security is critical for both hardening and exploitation tasks.

Why it matters: AD is the backbone of Windows environments. Misconfigurations lead to domain compromise. High-value target in competitions.

WSOS 2026 alignment: This topic directly supports Section 4: Secure systems operation and maintenance (managing enterprise directory services) and Section 5: Secure systems protection and defence (implementing domain security controls). You demonstrate competence by securing AD infrastructure against common attack vectors while maintaining service functionality.

Competition area: Core to the infrastructure hardening area, focusing on domain-level security controls that protect entire Windows environments from compromise.

Offline competence: Use Get-Help in PowerShell for AD cmdlets, explore Group Policy Management Console (gpmc.msc) settings offline, and reference pre-downloaded Microsoft AD security best practices (available via Zeal). Many AD security tasks are discoverable through GUI exploration of dsa.msc and gpmc.msc.

---

Competency Matrix

Level	Expectation
Regional	Not typically covered. Focus on standalone Windows systems.
National	Group Policy deployment. User/group management. Basic AD security baselines.
Squad/Team Selection	AD trust relationships. Privileged Access Workstations (PAWs). Tiered administration model.
International	Advanced GPO filtering. Just-Enough-Administration (JEA). LAPS deployment.

---

Technical Content

Group Policy Security

Creating security-focused GPOs:

1. Password Policy GPO:

# Create new GPO
New-GPO -Name "Password Policy" -Comment "Enforce strong passwords"

# Link to domain
New-GPLink -Name "Password Policy" -Target "DC=contoso,DC=com"

# Configure settings via GUI or PowerShell
# Group Policy Management Console (gpmc.msc)
# Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies

Key security settings:

• Minimum password length: 14 characters
• Password complexity: Enabled
• Password history: 24 passwords remembered
• Maximum password age: 60 days
• Account lockout threshold: 3 attempts
• Account lockout duration: 30 minutes

Restrict Admin Rights GPO:

• Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups
• Add Domain Admins to Administrators (remove all others)

Disable LLMNR/NetBIOS (prevent relay attacks):

• Computer Configuration > Policies > Administrative Templates > Network > DNS Client
• Turn off multicast name resolution: Enabled

Competition context: GPO tasks typically provide specific requirements. Apply GPO to correct OU. Verify with gpresult /r on target machine.

---

User and Group Management

Creating users/groups:

# Create user
New-ADUser -Name "JohnDoe" -GivenName "John" -Surname "Doe" -SamAccountName "jdoe" -UserPrincipalName "jdoe@contoso.com" -Path "OU=Users,DC=contoso,DC=com" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true

# Create security group
New-ADGroup -Name "IT Support" -GroupScope Global -GroupCategory Security -Path "OU=Groups,DC=contoso,DC=com"

# Add user to group
Add-ADGroupMember -Identity "IT Support" -Members "jdoe"

Privilege separation:

• Separate standard user accounts from admin accounts
• Admin accounts: admin-jdoe (used only for privileged tasks)
• Standard accounts: jdoe (daily use)

---

Domain Hardening

Disable insecure protocols:

# Disable SMBv1 on domain controllers
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Disable LLMNR via GPO
# Computer Configuration > Policies > Administrative Templates > Network > DNS Client
# Turn off multicast name resolution: Enabled

Audit privileged groups:

# List Domain Admins
Get-ADGroupMember -Identity "Domain Admins"

# List Enterprise Admins
Get-ADGroupMember -Identity "Enterprise Admins"

# Remove unnecessary accounts
Remove-ADGroupMember -Identity "Domain Admins" -Members "OldAdmin" -Confirm:$false

Service account security:

• Use Managed Service Accounts (MSA) or Group Managed Service Accounts (gMSA)
• Never use domain admin for service accounts
• Set “Account is sensitive and cannot be delegated” for privileged accounts

---

AD Attack Mitigation

Kerberoasting prevention:

• Set long, complex passwords for service accounts (25+ characters)
• Use gMSA where possible (password managed by AD)
• Monitor Event ID 4769 (Kerberos TGS requests)

LLMNR/NBT-NS relay prevention:

• Disable LLMNR via GPO
• Disable NetBIOS over TCP/IP on all NICs
• Enable SMB signing (required):

  Set-SmbClientConfiguration -RequireSecuritySignature $true -Force
  Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

Pass-the-Hash mitigation:

• Disable NTLM authentication (use Kerberos only):

  # Via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
  # Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all

---

Competition Strategy & Marking

What gets marked:

• GPO created and linked to correct OU
• Policy settings match requirements
• Users/groups created with correct permissions
• Security hardening applied (SMB signing, NTLM disabled)

Evidence and reporting requirements:

• GPMC screenshot showing GPO linked to correct OU with enforcement status
• gpresult /r output from target system proving policy application
• Get-ADUser / Get-ADGroup output showing created objects with correct attributes
• Event logs showing policy application (Event ID 1502 for successful GPO processing)
• Before/after screenshots of AD structure (Active Directory Users and Computers)
• PowerShell command history showing exact commands used
• Written summary explaining security rationale for each GPO setting
• Test evidence showing domain services still function (logon, file access, etc.)
• Clear naming convention for screenshots: domain_gpo_passwordpolicy_linked.png

Time allocation:

• GPO creation and deployment: 15-20 minutes
• User/group management: 10 minutes
• AD security hardening: 15-20 minutes

Time-boxed drill suggestion: 60-minute Active Directory hardening sprint: Given a domain controller, create and link a password policy GPO (14 char minimum, complexity, 3-attempt lockout), disable LLMNR and NetBIOS via GPO, enable SMB signing, audit Domain Admins membership (remove unnecessary accounts), create an “IT Support” security group with appropriate users, disable SMBv1 on the DC, and document all changes with screenshots. Verify policy application on a workstation using gpresult /r.

---

False Flags / Wrong Paths

Common Traps

Applying GPO to wrong OU GPO must be linked to correct Organizational Unit or it won’t apply. Verify link in GPMC.

Breaking domain authentication Disabling NTLM entirely can break legacy applications. Test before full deployment.

Locking out admin accounts Incorrect password policy can lock out privileged accounts. Have break-glass account ready.

---

Practice Checklist

• Can create and link Group Policy Objects
• Can configure password and account lockout policies via GPO
• Can create users and groups in correct OUs
• Can delegate admin rights using Restricted Groups
• Understand AD attack vectors (Kerberoasting, LLMNR poisoning, Pass-the-Hash)
• Can disable insecure protocols (SMBv1, LLMNR, NTLM)
• Can verify GPO application with gpresult
• Can audit privileged group membership

---

References

• National Roadmap: Infrastructure hardening
• Offensive perspective: AD Attacks