AD Hardening: 10 Critical Settings to Check Now (2026)

A penetration test on an 800-user Active Directory domain quickly turned into a nightmare: Kerberoasting in 4 minutes, the SQL service account hash cracked in 90 seconds. The password was ‘Sql2019!’. This scenario, unfortunately not isolated, highlights the fragility of default Active Directory configurations and the necessity of rigorous hardening. Active Directory (AD) is the backbone of almost every enterprise environment, managing authentication, authorization, and resources. It is also, by its nature, a primary target for attackers. According to the Verizon DBIR 2025, 74% of SMB breaches originate from stolen credentials or privilege escalation within AD. Implementing robust hardening is not an option, but an imperative to protect your infrastructure. This guide provides a checklist of 10 critical settings to immediately verify and apply in your environment to significantly improve your Active Directory security posture in 2026.

Prerequisites / Test Environment

To apply and verify these settings, you will need a Domain Admin account. All changes should be tested in a staging or test environment first to avoid service disruptions. The reference environment is Windows Server 2016 or higher for Domain Controllers and Windows 10/11 clients.

1-2: Privileged Accounts — Tier Model and Protected Users

Managing privileged accounts is your first line of defense. A successful attack on a Domain Admin can compromise the entire domain. The Tier Model is a security framework that categorizes accounts and systems based on their privilege level, limiting interactions between different tiers to prevent privilege escalation and lateral movement.

1. Implement the Tier Model:

Divide accounts and workstations into Tier 0 (Domain Controllers, Domain Admins), Tier 1 (Servers, Server Admins), and Tier 2 (Workstations, Workstation Admins). Accounts from a higher Tier should never access resources from a lower Tier. This drastically reduces the attack surface.

2. Utilize the Protected Users Group:

This security group, introduced with Windows Server 2012 R2, offers additional protections against attacks like pass-the-hash or pass-the-ticket. Accounts in Protected Users do not store weak credentials (like NTLM hashes) and have Kerberos tickets with reduced lifetimes. Move all highly privileged service and administrative accounts into this group.

3-4: Password Policy and Fine-Grained Password Policy

A weak password policy is an open invitation for attackers. Active Directory’s default policy is often insufficient for modern environments.

3. Strengthen the Domain Password Policy:

Ensure your default domain GPO enforces complex passwords, at least 14 characters long, and requires frequent rotation (every 60-90 days). Avoid ‘historical’ passwords that can be reused. The Microsoft Digital Defense Report 2024 states that 60% of compromised accounts use weak or reused passwords.

4. Implement Fine-Grained Password Policy (FGPP):

FGPP allows you to apply different password policies to specific users and groups, overcoming the limitation of a single policy per domain. This is critical for service accounts or administrative accounts that require more stringent password requirements than standard users. For example, you can require service accounts to have 20+ character passwords that never expire, but are manually monitored and rotated.

To find accounts with passwords that never expire, a potential risk:

Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name, SamAccountName

5-6: Kerberos — Disable RC4, Enable AES256

Kerberos is the primary authentication protocol in Active Directory. Its configuration directly impacts security.

5. Disable RC4 Encryption for Kerberos:

RC4 is an obsolete and vulnerable cryptographic algorithm. Ensure Kerberos only uses modern, robust algorithms like AES256. You can configure this setting via GPO (Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Configure encryption types allowed for Kerberos). Enable only AES128_HMAC_SHA1 and AES256_HMAC_SHA1.

To verify the Kerberos encryption types supported by the domain:

Get-ADDefaultDomainPasswordPolicy

6. Monitor and Mitigate Kerberoasting Attacks:

Kerberoasting attacks exploit Service Principal Names (SPNs) registered for service accounts. If a service account has a weak password, an attacker can request a service ticket for that SPN and attempt to crack the password hash offline. Ensure service accounts have complex and long passwords. Monitor Kerberos events for suspicious activity. An admin account with an SPN is a high risk:

Get-ADUser -Filter {ServicePrincipalName -ne '$null' -and adminCount -eq 1} | Select Name, SamAccountName, ServicePrincipalName

7-8: Security GPOs — SMB Signing, NTLM Restrictions

Group Policy Objects (GPOs) are your primary tool for applying security configurations at scale.

7. Enable Mandatory SMB Signing:

SMB Signing ensures that the client and server verify the integrity of SMB packets, preventing man-in-the-middle and relay attacks. Enable it via GPO for all servers and clients (Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Microsoft network server: Digitally sign communications (always)).

To verify if SMB Signing is enabled on a server:

Get-SmbServerConfiguration | Select RequireSecuritySignature

8. NTLM Restrictions:

NTLM is an older, less secure authentication protocol than Kerberos. Limit its use as much as possible. It is advisable to disable inbound NTLM on Domain Controllers and, if possible, on all servers. This can be done via GPO (Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Restrict NTLM: Incoming NTLM traffic).

9-10: Audit and Monitoring — Critical Event IDs to Log

Without effective auditing, you will never know when an attack is in progress or has already occurred. Monitoring is crucial for threat detection.

9. Configure Advanced Auditing:

Enable advanced auditing via GPO to log critical events, such as failed logons, changes to privileged groups, new user creations, and GPO modifications. In particular, focus on:

• Account Logon: IDs 4624 (successful logon), 4625 (failed logon)
• Account Management: IDs 4720 (user creation), 4728 (added to security group), 4732 (added to local group), 4740 (account locked out)
• Directory Service Access: ID 4662 (access to AD objects)

10. Monitor Critical Event IDs with a SIEM/EDR:

Integrate Active Directory logs with a SIEM (Security Information and Event Management) or EDR (Endpoint Detection and Response) to correlate events and detect anomalies. A Kerberoasting attack, for example, generates specific events that a SIEM can detect. Monitor events related to service account password changes. For instance, the last password change for a service account:

Get-ADUser -Identity svc-account -Properties PasswordLastSet | Select Name, PasswordLastSet

PowerShell Script: Automated 10-Setting Check

Many of these settings can be automatically verified with a PowerShell script. This script is a starting point for a quick audit.

# Active Directory Hardening Verification Script
Write-Host "Verifying critical Active Directory settings"

# 1. Accounts with Password Never Expires
Write-Host "\n--- Verifying Accounts with Password Never Expires ---"
Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name, SamAccountName | Format-Table

# 2. Kerberos Encryption Types
Write-Host "\n--- Verifying Kerberos Encryption Types ---"
(Get-ADDefaultDomainPasswordPolicy).KerberosEncryptionType

# 3. SMB Signing
Write-Host "\n--- Verifying SMB Signing ---"
Get-SmbServerConfiguration | Select RequireSecuritySignature, EnableSecuritySignature | Format-Table

# 4. Admin Accounts with SPN (Kerberoasting risk)
Write-Host "\n--- Verifying Admin Accounts with SPN ---"
Get-ADUser -Filter {ServicePrincipalName -ne '$null' -and adminCount -eq 1} | Select Name, SamAccountName, ServicePrincipalName | Format-Table

# 5. Last password change for a service account (e.g., 'svc-sql')
#   NOTE: Replace 'svc-sql' with the name of a real service account
Write-Host "\n--- Verifying Last Password Change for Service Account (e.g., svc-sql) ---"
Try {
    Get-ADUser -Identity "svc-sql" -Properties PasswordLastSet | Select Name, PasswordLastSet | Format-Table
}
Catch {
    Write-Warning "Account 'svc-sql' not found or access error."
}

Write-Host "\nVerification complete. A thorough audit is recommended."

Common Errors and Troubleshooting

• Lack of Testing: Applying GPOs without testing in a controlled environment can cause service disruptions. Always implement a rollback plan.
• Over-auditing: Enabling too many auditing categories can generate an excessive volume of logs, making analysis difficult. Focus on critical events.
• Ignoring Service Accounts: Service accounts are often the weakest and least monitored. They are a primary target for attackers.
• Dependency on a Single Technology: Do not rely solely on GPOs. Also implement EDR and SIEM solutions for a layered defense.
• Hardcoded Passwords: Avoid embedding passwords directly in scripts or configurations. Use solutions like LAPS (Local Administrator Password Solution) for local accounts, or managed credentials for service accounts.

Conclusions with Operational Takeaways

Active Directory hardening is a continuous process, not a one-time activity. The 10 critical settings discussed here represent a solid foundation for improving your domain’s security. By implementing the Tier Model, strengthening password policies with FGPP, modernizing Kerberos encryption, and enabling SMB Signing, you can significantly reduce your attack surface. Do not underestimate the importance of auditing and monitoring: they are your eyes and ears when an attack is underway. Remember, 74% of breaches start with compromised credentials: protecting Active Directory means protecting the entire organization.

Read also: SSH Hardening Linux: Complete Guide 2026 (10 Critical Settings)

Read also: NIS2 Compliance: Essential Obligations for SMEs in 2026

Read also: Ransomware Recovery: 48 Hours, 7 Operational Lessons (2026)

Updated: June 2026

External Reference: Microsoft Docs – Active Directory Security Best Practices