Top 25 Active Directory Security Best Practices

A comprehensive list of the top 25 Active Directory Security Tips and best practices. Securing domain admins, local administrators, audit policies, monitoring AD for compromise, password policies, vulnerability scanning and more.

See https://activedirectorypro.com/active-directory-security-best-practices/

Here are the 25 that he lists:

1. Clean up the Domain Admins Group
2. Use at Least Two Accounts (Regular and Admin Account)
3. Secure The Domain Administrator account
4. Disable the Local Administrator Account (on all computers)
5. Use Local Administrator Password Solution (LAPS)
6. Use a Secure Admin Workstation (SAW)
7. Enable Audit policy Settings with Group Policy
8. Monitor Active Directory Events for Signs of Compromise
9. Password Complexity Sucks (Use Passphrases Instead)
10. Use Descriptive Security Group Names
11. Cleanup Old Active Directory User & Computer Accounts
12. Do NOT Install Additional Software or Roles on Domain Controllers
13. Continues Patch Management & Vulnerability Scanning
14. Use DNS Services to Block Malicious Domains
15. Run Critical Infrastructure on latest Windows Operating System
16. Use Two Factor Authentication for Remote Access
17. Monitor DHCP Logs for Connected Devices
18. Monitor DNS Logs for Security Threats
19. Use Latest ADFS and Azure Security Features
20. Use Office 365 Secure Score
21. Plan for Compromise ( Have a recovery plan)
22. Document Delegation to Active Directory
23. Lock Down Service Accounts
24. Disable SMBv1
25. Use Security Baselines and Benchmarks