Challenges
- Weak RSA Certificates in Use
- Lack of LAPS Enforcement
- Admin Accounts Not in Protected Users Group
- Unknown Delegated Accounts in Active Directory
- Print Spooler Service Running on Domain Controllers
- Acceptance of NTLMv1 Authentication Protocol
- SID History from Unknown Domains
- LDAP Signing Not Enforced
Solution
- Identify certificates with an RSA exponent less than 2048 bits or using SHA1, and replace them with modern equivalents (e.g., RSA 2048+/SHA256+).
- Implement LAPS to automatically manage and rotate local admin passwords.
- Move eligible privileged accounts into the Protected Users group.
- Perform a delegation audit to identify and validate all accounts with delegated permissions. Remove or restrict access for accounts that are no longer required or whose roles cannot be justified.
- Disable the Print Spooler service on all Domain Controllers unless explicitly required (e.g., by legacy applications or printer dependencies).
- Disable NTLMv1 support and enforce NTLMv2 or Kerberos-only authentication across the domain.
- Audit and remove SID History entries that are no longer valid or understood.
- Enforce LDAP Signing on all servers and clients to prevent unprotected LDAP communication.
Weak RSA Certificates in Use
Lack of LAPS Enforcement
Admin Accounts Not in Protected Users Group
Unknown Delegated Accounts in Active Directory
Print Spooler Service Running on Domain Controllers
Acceptance of NTLMv1 Authentication Protocol
SID History from Unknown Domains
LDAP Signing Not Enforced
Results
- Successfully remediated 13 of 16 key issues, with 3 marked as “No Action Required”
- Enhanced authentication and delegation security
- Hardened system access and certificate configuration and closed all flagged items for project acceptance
Impact
- Zero admin accounts left outside the “Protected Users” group
- 100% disabling of vulnerable services like NTLMv1 and spoolers
- 27 unknown domains in SID history identified for further action
- 2+ certificates with critical vulnerabilities (SHA1, weak RSA) replaced
Linkedin
