Inactive Account check

The purpose is to ensure that there are as few inactive accounts as possible within the domain

Inactive accounts often stay in the network because of weaknesses in the decommissioning process. These stale computer accounts can be used as backdoors and therefore represents a possible security breach.

To mitigate the risk, you should monitor the number of inactive accounts and reduce it as much as possible. A list of all inactive accounts is obtainable through the command: Search-ADaccount -UsersOnly -AccountInactive -Timespan 180.

10 points if the occurence is greater or equals than 15

ANSSI - Recommandations de sécurité relatives à Active Directory - R45 [paragraph.3.6.6.2]

The detail can be found in User information and Computer information

Inactive computer check

The purpose is to ensure that there are as few inactive computers as possible within the domain

Inactive computers often stay in the network because of weaknesses in the decommissioning process. These stale computer accounts can be used as backdoors and therefore represents a possible security breach.

To mitigate the risk, you should monitor the number of inactive accounts and reduce it as much as possible. A list of all inactive accounts is obtainable through the command: Search-ADaccount -ComputersOnly -AccountInactive -Timespan 180.

30 points if the occurence is greater or equals than 30
then 10 points if the occurence is greater or equals than 20
then 5 points if the occurence is greater or equals than 15

ANSSI - Recommandations de sécurité relatives à Active Directory - R45 [paragraph.3.6.6.2]

DC Vulnerability (SMB v1)

The purpose is to verify if Domain Controller(s) are vulnerable to the SMB v1 vulnerability

The SMB downgrade attack is used to obtain credentials or executing commands on behalf of a user by using SMB v1 as protocol. Indeed, because SMB v1 supports old authentication protocol, the integrity can be bypassed

It is highly recommended by Microsoft to disable SMB v1 whenever it is possible on both client and server side. Do note that if you are still not following best practices regarding the usage of deprecated OS (Windows 2000, 2003, XP, CE), regarding Network printer using SMBv1 scan2shares functionalities, or regarding software accessing Windows share with a custom implementation relying on SMB v1, you should consider fixing this issues before disabling SMB v1, as it will generates additional errors.

10 points if present

https://github.com/lgandx/Responder-Windows
https://blogs.technet.microsoft.com/josebda/2015/04/21/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect
ttps://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012
BSI M 2.412 Schutz der Authentisierung beim Einsatz von Active Directory
ANSSI CERTFR-2017-ACT-019
ANSSI CERTFR-2016-ACT-039

The detail can be found in Domain controllers

Domain controller: AD02
Domain controller: AD01

Check for completeness of network declaration

The purpose is to ensure that the minimum set of subnet(s) has been configured in the domain

When multiple sites are created in a domain, networks should be declared in the domain in order to optimize processes such as DC attribution. In addition, PingCastle can collect the information to be able to build a network map. This rule has been triggered because at least one domain controller has an IP address which was not found in subnet declaration. These IP addresses have been collected by querying the DC FQDN IP address in both IPv6 and IPv4 format.

Locate the IP address which was found as not being part of declared subnet then add this subnet to the "Active Directory Sites" tool. If you have found IPv6 addresses and it was not expected, you should disable the IPv6 protocol on the network card.

5 points if present

The detail can be found in Domain controllers

Domain Controller AD02 ip address 172.30.8.15
Domain Controller AD01 ip address 172.30.8.14

At least one Administrator Account can be delegated

The purpose is to ensure that all Administrator Accounts have the configuration flag "this account is sensitive and cannot be delegated"

Without the flag "This account is sensitive and cannot be delegated" any account can be impersonated by some service account. It is a best practice to enforce this flag on administrators accounts.

To correct the situation, you should make sure that all your Administrator Accounts has the check-box "This account is sensitive and cannot be delegated" active. Please not that there is a section bellow in this report named "Admin Groups" which give more information.

20 points if present

STIG V-36435 - Delegation of privileged accounts must be prohibited.

The detail can be found in Admin Groups

Check if Service Accounts are domain administrators

The purpose is to check for "Service Accounts" in the "Domain Administrator" group

"Service Accounts" can imply a high security risk as their password are stored in clear text in the LSA database, which can then be easily exploited using Mimikatz or Cain&Abel for instance. In addition, their passwords don't change and can be used in kerberoast attacks.

To mitigate the security risk, it is strongly advised to lower the privileges of the "Service Accounts", meaning that they should be removed from the "Domain Administrator" group, while ensuring that the password of each and every "Service Account" is higher than 20 characters

15 points if the occurence is greater or equals than 2

STIG V-36432 - Membership to the Domain Admins group must be restricted to accounts used only to manage the Active Directory domain and domain controllers.
ANSSI - Recommandations de sécurité relatives à Active Directory - R11 [subsection.2.5]

The detail can be found in Admin Groups

Ensure that the Recycle Bin feature is enabled

The purpose is to ensure that the Recycle Bin feature is enabled

The Recycle Bin avoids immediate deletion of objects (which can still be partially recovered by its tombstone). This lowers the administration work needed to restore. It also extends the period where traces are available when an investigation is needed.

First, be sure that the forest level is at least Windows 2008 R2.
You can check it with Get-ADForest or in the Domain Information section.
Then you can enable it using the powershell command:
Enable-ADOptionalFeature -identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=test,DC=mysmartlogon,DC=com' -Scope ForestOrConfigurationSet -Target 'test.mysmartlogon.com'

10 points if present

The detail can be found in Domain Information

Avoid unexpected schema modifications which could result in domain rebuild

The purpose is to ensure that no account can make unexpected modifications to the schema

The group "Schema Admins" is used to give permissions to alter the schema. Once a modification is performed on the schema such as new objects, it cannot be undone. This can result in a rebuild of the domain. The best practice is to have this group empty and to add an administrator when a schema update is required then to remove this group membership.

Remove the accounts or groups belonging to the "schema administrators" group.

10 points if present

STIG V-72835 - Membership to the Schema Admins group must be limited
ANSSI - Recommandations de sécurité relatives à Active Directory - R13 [subsection.3.2]

The detail can be found in Admin Groups

Ensure that file deployed by a GPO cannot be modified by everyone.

The purpose is to check that files deployed to computers cannot be changed by everyone.

Application provided in a msi form or general files can be deployed by a GPO. If an attacker can modify one of this file, it can take control of the user account.

Locate the file mentionned by the GPO specified in Details and change its permissions.

5 points per discovery

ANSSI - Recommandations de sécurité relatives à Active Directory - R18 [subsubsection.3.3.2]
STIG V-2370 - The access control permissions for the directory service site group policy must be configured to use the required access permissions.

The detail can be found in GPO Deployed Files

GPO: 志翔桌面管控客户端推送 Type: Application (User section) FileName: \\AD01\Users\vdsadmin\Desktop\test\sensor.msi Account: Everyone Right: FullControl

Mitigate golden ticket attack via a regular change of the krbtgt password

The purpose is to alert when the password for the krbtgt account can be used to compromise the whole domain. This password can be used to sign every kerberos ticket. Monitoring it closely often mitigates the risk of golden ticket attacks greatly.

Kerberos is an authentication protocol. It is using to sign its tickets a secret stored as the password of the krbtgt account. If the hash of the password of the krbtgt account is retrieved, it can be use to generate authentication tickets at will.
To mitigate this attack, it is recommended to change the krbtgt password every 40 days. If it not the case, every backup done until the last password change of the krbtgt account can be used to emit Golden tickets, compromising the entire domain.
Retrieval of this secret is one of the highest priority in an attack, as this password is rarely changed and offer a long term backdoor.
Also this attack can be performed using the former password of the krbtgt account. That's why the krbtgt password should be changed twice to invalidate its leak.

The password of the krbtgt account should be changed twice to invalidate the golden ticket attack.
Beware: two changes of the krbtgt password not replicated to domain controllers can break these domain controllers You should wait at least 8 hours between each krbtgt password change.

There are several possibilities to change the krbtgt password.
First, a Microsoft script can be run in order to guarantee the correct replication of these secrets. Unfortunately this script supports only English operating systems.
Second, a more manual way is to essentially reset the password manually once, then to wait 3 days, then to reset it again. This is the safest way as it ensures the password is no longer usable by the Golden ticket attack.

50 points if the occurence is greater or equals than 732
then 40 points if the occurence is greater or equals than 366
then 30 points if the occurence is greater or equals than 180
then 20 points if the occurence is greater or equals than 70

https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51
ANSSI CERTFR-2014-ACT-032

The detail can be found in Krbtgt

Check if the LAPS tool to handle the native local administrator password is installed

The purpose is to make sure that there is a proper password policy in place for the native local administrator account.

LAPS (Local Administrator Password Solution) is the advised solution to handle passwords for the native local administrator account on all workstations, as it is a simple way to handle most of the subject.

If you don't have any provisioning process or password solution to manage local administrators, you should install the LAPS solution. If you mitigate the risk differently, you should add this rule as an exception, as the risk is covered.

15 points if present

https://www.microsoft.com/en-us/download/details.aspx?id=46899
STIG V-36438 - Local administrator accounts on domain systems must not share the same password.
ANSSI CERTFR-2015-ACT-046

The detail can be found in LAPS

Ensure that the printer spooler cannot be abused to get the DC Credentials

The purpose is to ensure that credentials cannot be extracted from the DC via its printer spooler

When there’s an account with unconstrained delegation configured (which is fairly common) and the Print Spooler service running on a computer, you can get that computers credentials sent to the system with unconstrained delegation as a user. With a domain controller, the TGT of the DC can be extracted allowing an attacker to reuse it with a DCSync attack and obtain all user hashes and impersonate them.

The spooler service should be deactivated on domain controllers. Please note as a consequence that the Printer Pruning functionality (rarely used) will be unavailable.

10 points if present

https://adsecurity.org/?p=4056
https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory

The detail can be found in Domain controllers

Domain Controller AD02
Domain Controller AD01

Check if LLMNR can be used to steal credentials

The purpose is to ensure that local name resolution protocol (LLMNR) cannot be used to collect credentials by performing a network attack

LLMNR is a protocol which translates names such as foo.bar.com into an ip address. LLMNR has been designed to translate name locally in case the default protocol DNS is not available.
Regarding Active Directory, DNS is mandatory which makes LLMNR useless.
LLMNR exploits typo mistakes or faster response time to redirect users to a specially designed share, server or website.
Being trusted, this service will trigger the single sign on procedure which can be abused to retrieve the user credentials.

LLMNR is enabled by default on all OS except starting from Windows 10 v1903 and Windows Server v1903 where it is disabled.

Enable the GPO Turn off multicast name resolution and check that no GPO override this setting.
(if it is the case, the policy involved will be displayed below)

Informative rule (0 point)

https://youtu.be/Fg2gvk0qgjM

The detail can be found in Security settings

Check for Root Certificates using unsafe hashing algorithm (SHA1)

The purpose is to ensure that there is no use of the SHA1 hashing algorithm in Root Certificate

The SHA1 hashing algorithm is not considered as safe. There are design flaws inherent to the algorithm that allow an attacker to generate a hash collision in less than a brute-force time

To solve the matter, the certificate should be removed from the GPO and if needed, certificates depending on it should be reissued.

Informative rule (0 point)

https://tools.ietf.org/html/rfc6194
STIG V-14820 - PKI certificates (server and clients) must be issued by the DoD PKI or an approved External Certificate Authority (ECA).

The detail can be found in Certificates

Found in GPO NTLMStore Subject is CN=New-vdesktop-AD02-CA, DC=vdesktop, DC=demo, DC=com
Found in GPO NTLMStore Subject is CN=vdesktop-AD02COPY-CA, DC=vdesktop, DC=demo, DC=com
Found in GPO NTLMStore Subject is CN=vdesktop-AD02-CA-vdstool, DC=vdesktop, DC=demo, DC=com
Found in GPO NTLMStore Subject is CN=vdesktop-AD02-CA, DC=vdesktop, DC=demo, DC=com

Check the Password Policy for Service Accounts (Information)

The purpose is to give information regarding a best practice for the Service Account password policy. Indeed, having a 20+ characters password for this account greatly helps reducing the risk behind Kerberoast attack (offline crack of the TGS tickets)

The rule is purely informative, as it gives insights regarding a best practice. It verifies if there is a GPO or PSO enforcing a 20+ characters password for the Service Account.

The recommended way to handle service accounts is to use "Managed service accounts" introduced since Windows 2008 R2 (search for "msDS-ManagedServiceAccount").
To solve the anomaly, you should implement a PSO or GPO password guarantying a 20+ length password.

Informative rule (0 point)

https://www.microsoft.com/en-us/research/publication/password-guidance/

The detail can be found in Password Policies