Active Directory Configuration - M1015 (e3388c78-2a8d-47c2-8422-c1398b324462)
Implement robust Active Directory configurations using group policies to control access and reduce the attack surface. Specific examples include:
- Account Configuration: Use provisioned domain accounts rather than local accounts to leverage centralized control and auditing capabilities.
- Interactive Logon Restrictions: Enforce group policies that prohibit interactive logons for accounts that should not directly access systems.
- Remote Desktop Settings: Limit Remote Desktop logons to authorized accounts to prevent misuse by adversaries.
- Dedicated Administrative Accounts: Create specialized domain-wide accounts that are restricted from interactive logons but can perform specific tasks like installations or repository access.
- Authentication Silos: Configure Authentication Silos in Active Directory to create access zones with restrictions based on membership in the Protected Users global security group. This setup enhances security by applying additional protections to high-risk accounts, limiting their exposure to potential attacks.