The do's and don'ts of using active directory in your organization
Active Directory (AD) is so ubiquitous on Windows networks that many organizations have not invested time optimizing the tool. However, this consideration is critical. Your AD configuration has significant process and network security implications, so it’s important that you prioritize a review of how you’re currently managing the service. Here are a few guidelines to follow as you assess your current set up:
DO
Plan the structure of your Active Directory before implementing or migrating. This process can be complex. Knowing your end goal before you begin will help cut down on the amount of management and reconfiguration required.
DON'T
Make your Active Directory design too convoluted. You should resist the urge to use hundreds of organizational units (OUs) for every possible need as this will be costly and difficult to maintain. For example, while it might seem obvious to create an organizational units structure based on the physical locations of your organization, this can lead to difficulties if a department is eventually spread over more than one location. Instead, use a basic structure like domain, OU, and site.
DO
Make sure that your Active Directory administrators have two separate accounts: one standard account for their everyday activities like email and web browsing, and one administrative account for managing AD. This separation is a good security practice to minimize the risk of your privileged Active Directory account being compromised.
DON’T
Neglect secure password policies. Individuals are at the heart of a secure network. Bad habits will cause vulnerabilities, but an organization’s policies are what really put networks at risk. Create policies that avoid common mistakes like, setting user passwords to never expire - or using the same password for multiple accounts.
DO
Use credential partitioning to create separate tiers of administrative access to Active Directory. This ensures that no person has more access to the system than they need to perform their role. Least privileged access should be adopted to limit the threat of a security breach.
DON’T
Let dormant accounts retain access. In a complex Active Directory environment, unused accounts can cause serious vulnerabilities. Be sure to deactivate idle accounts so former employees or bad actors can’t take advantage.
DO
Set up monitoring and audit capabilities. You should understand who has access and what activity has occurred within the system. When you’re able to track changes, you optimize the service and reduce time investigating issues. Take your Active Directory configuration seriously. With any technology, the security of the tool comes down to how it’s managed. A number of different cyber attacks can be leveled against AD structures, like Pass-the-Hash or credential theft. Do your research, understand your organizations' needs, and make sure your installation is secure.