Improving the Security of Authentication in an AD DS Domain
- 6/15/2011
When a user logs on to an Active Directory Domain Services (AD DS) domain, she enters her user name and password, and the client uses those credentials to authenticate the user—to validate the user’s identity against her Active Directory account. In Chapter 3, “Administering User Accounts,” you learned how to create and manage user accounts and their properties, including their passwords. In this chapter, you will explore the domain-side components of authentication, including the policies that specify password requirements and the auditing of authentication-related activities. You will also discover three new options to improve the security of accounts and authentication: managed service accounts’ password settings objects (PSOs, better known as fine-grained password policy); and read-only domain controllers (RODCs).
Exam objectives in this chapter:
Maintain Active Directory accounts.
Configure account policies.
Configure audit policy by using GPOs.
Configure Active Directory replication.
Configure the read-only domain controller (RODC).
Lessons in this chapter:
Lesson 1: Configuring Password and Lockout Policies
Lesson 2: Auditing Authentication
Lesson 3: Configuring Read-Only Domain Controllers
Lesson 4: Managing Service Accounts
Before You Begin
To complete the lessons in this chapter, you must have installed a domain controller named SERVER01 in the contoso.com domain.
Real World
Dan Holme
As I work with clients to implement AD DS, I must constantly balance the need to maintain high levels of security with the need to continue conducting the client’s business. With versions of Microsoft Windows prior to Windows Server 2008, I constantly encountered three scenarios in which this balance was particularly difficult to reach.
The first relates to the security of user accounts with high levels of privilege within the enterprise. Such accounts are especially attractive to hackers, so they should be locked down with particularly lengthy and complex passwords. In earlier versions of Windows, only one password policy could be applied to all accounts in the domain. Therefore, I either had to apply the highly restrictive password policy to all users in the domain, which was never a palatable solution, or ask administrators to follow the more restrictive policy but with no way to require compliance. Windows Server 2008 introduced fine-grained password policies that can be used to apply more or less restrictive password policies beyond the requirements for groups or users in a domain.
Branch offices were also problematic because I had to balance the need for quick and reliable user authentication at the branch office against the desire to centralize control over the physical security of domain controllers. Placing a domain controller in a branch office would clearly improve performance for users in the office but would also typically expose the domain controller to lower levels of security than those maintained at the data center. Coming to the rescue once again, Windows Server 2008 and Windows Server 2008 R2 can act as a read-only domain controller, authenticating users and the branch office without storing all domain user credentials, thus reducing the risk to the enterprise in the event of a stolen branch office domain controller.
Another significant challenge is the management of service accounts. Services such as backup, antivirus, Microsoft SQL Server, and IIS application pools run in the context of a user account. When you change the password of a service account, you must configure the service with the new password as well. Managing service accounts was so problematic that many organizations simply configured service accounts with non-expiring passwords, which is a very poor practice from a security perspective. Windows Server 2008 R2 addresses this scenario with a new feature: managed service accounts.
If you have worked with Active Directory for any period of time, you already appreciate the value of fine-grained password policies, read-only domain controllers, and managed service accounts. If you are new to Active Directory, you are lucky to be able to work with these much-anticipated features.