How to Secure Active Directory (AD) Best Practice To Follow!

To ensure that an organization's Active Directory (AD) environment is as secure as possible, we recommend all organizations have, at a minimum, the following seven defenses in place:

1. Use LAPS: Microsoft's local administrator password solution enables local administrator account passwords to be randomized.
2. Block default admin: "Deny access from a built-in local administrator account," we advise, noting that these will be present by default on all Windows systems.
3. Use strong passwords: All service accounts should have at least 25-character passwords to make them more resilient to kerberoasting attacks. Plus, these accounts should be part of an AD group that remains actively managed, including passwords being regularly changed, we say.
4. Deny communications: Deny workstation-to-workstation communications "because it gives an attacker a very easy way to perform lateral movement."
5. Avoid built-in groups: "Try to avoid built-in AD groups, because those have way too many permissions in AD," we say. Instead, delegate rights.
6. Check permissions: "For OUs - organizational units - check their permissions, because there might be wrong delegated permissions," we say, such as a sales user having been placed in a financial group. Organizational units are AD subdivisions into which administrators can place users, groups, computers, and other organizational units.
7. Monitor & Audit: Monitor events in Active Directory to help spot signs of attack.

Keep Auditing

We advise for securing Active Directory can largely be summarized as "assume nothing, verify everything."

We recommend security teams audit their organization's AD implementations as often as possible - preferably at least weekly. "Why? Because in a company, every day, people are making changes - you have sysadmins or help-desk employees providing access to a group - and you need to keep track of that," in part to help spot attempted attacks, we say. "What if someone today goes to reset the password of the CFO, but he was on vacation?"

Source: https://www.bankinfosecurity.com/