Stop Active Directory Attacks: Priority Fixes That Actually Work
Most breaches succeed because attackers move laterally through weak trust relationships, not because they cracked a password hash on the first try.
Disable legacy authentication protocols to block credential theft. Enforce strict least privilege to limit lateral movement. Monitor for anomalous token usage rather than relying on perimeter defenses. These steps close the gaps attackers exploit most frequently.
Kill the Legacy Protocols
You must disable outdated authentication methods immediately. Attackers use tools that automatically harvest credentials from these legacy protocols because they lack modern encryption or mutual authentication. NTLM (NT LAN Manager) is the most common target. It transmits hashes that can be captured and relayed or cracked offline.
LDAP (Lightweight Directory Access Protocol) over unencrypted connections allows attackers to read directory data and inject malicious attributes. You should enforce LDAPS (LDAP over SSL/TLS) everywhere. This ensures that directory queries happen over an encrypted channel.
Disabling these protocols removes the easiest path for attackers to steal credentials. It does not stop an attacker who already has a valid token, but it raises the bar significantly. You lose compatibility with very old devices, but those devices are usually the weakest link in your security posture anyway.
| Measure | Effort | What it stops |
|---|---|---|
| Disable NTLM v1 | Low | Offline hash cracking and relay attacks |
| Enforce LDAPS | Medium | Directory enumeration and attribute injection |
| Disable LDAP signing | Low | Man-in-the-middle directory tampering |
Enforce Least Privilege on Admin Accounts
Administrative accounts are the keys to the kingdom. If an attacker compromises a standard user account, they are stuck in that user’s sandbox. If they compromise an admin account, they can move anywhere. You must separate daily work accounts from administrative accounts.
Never use a privileged account for email, web browsing, or document editing. These activities expose the account to phishing and malware. Create dedicated admin accounts that are only used for management tasks. Log into these accounts only through a secure, isolated management station.
This practice limits the blast radius of a compromise. If a user clicks a malicious link, the attacker gets a standard user token. They cannot elevate privileges without additional effort. You trade convenience for security. The administrative burden increases, but the risk of total domain takeover drops drastically.
Harden Kerberos Ticket Handling
Kerberos is the default authentication protocol in modern environments. It relies on tickets rather than passwords for most interactions. Attackers target these tickets because they are harder to detect than password spraying.
One common attack is the Golden Ticket attack. An attacker steals the key used to sign tickets. They can then create valid tickets for any user, including administrators. To prevent this, you must protect the KRBTGT account. This account holds the master key for the entire domain.
Change the KRBTGT password regularly. This invalidates all existing tickets and forces users to re-authenticate. It also rotates the signing key. You must do this twice. The first change invalidates current tickets. The second change ensures that tickets signed with the old key cannot be replayed. This is a high-effort task that disrupts operations briefly but stops persistent attackers from maintaining access.
Segment Management Traffic
Network segmentation is often misunderstood. Putting servers on a separate VLAN is not enough. Attackers use authenticated connections to jump between segments. You must control which hosts can talk to which services.
Implement application-layer filtering. Allow only specific management tools to communicate with domain controllers. Block direct SMB (Server Message Block) traffic from workstations to servers. SMB is a frequent vector for lateral movement and file sharing.
This approach stops attackers from using stolen credentials to access resources they should not see. It also reduces the noise in your logs. You only see legitimate management traffic, making anomalies easier to spot. You must map your traffic flows carefully. Misconfigured rules can lock you out of your own systems.
Monitor for Anomalous Behavior
Prevention fails. You must assume an attacker is already inside. Detection relies on understanding normal behavior. Most organizations monitor for known bad indicators. This is insufficient. Attackers use legitimate tools to move laterally.
Focus on behavioral anomalies. Look for logins at unusual times. Watch for multiple failed logins followed by a success. Detect new service principal names being registered. These actions often precede privilege escalation.
Use detection engineering principles to create rules that catch these patterns. You must tune these rules to avoid false positives. A high false positive rate leads to alert fatigue. Analysts will ignore warnings, and attackers will slip through. Regularly review and update your detection logic to match current threats.
See also: Dark web threat intelligence implementation steps for early warnings · OSINT tools for investigators checklist to harden your footprint
What Does Not Work
Many organizations rely on perimeter firewalls to protect Active Directory. This is a false sense of security. Once an attacker is inside the network, the perimeter is irrelevant. They can move laterally without ever touching the outside world.
Another common failure is relying solely on antivirus software. Modern attacks use fileless techniques and living-off-the-land binaries. These tools are already present on the system and signed by Microsoft. Antivirus engines rarely flag them.
You must look beyond the perimeter and beyond file signatures. Focus on identity and behavior. This requires a shift in mindset. You are no longer defending a castle wall. You are monitoring the activity of every person and machine inside the walls.
Three Actions for Today
You do not need a multi-year project to improve your security. Start with these three steps.
- Disable NTLM authentication on all domain controllers. This stops the easiest credential theft methods.
- Audit administrative group memberships. Remove any accounts that do not strictly need elevated privileges.
- Enable advanced audit logging for directory services. You cannot detect what you do not record.
These actions provide immediate risk reduction. They are low effort and high impact. Build on this foundation by implementing stricter segmentation and behavioral monitoring.
Key takeaways
- Legacy protocols like NTLM and LDAP are the primary entry points for credential theft.
- Administrative accounts with excessive privileges turn any compromised workstation into a domain controller.
- Network segmentation without application-level controls fails to stop authenticated lateral movement.
Active Directory security depends on identity hygiene, not network boundaries. Start by disabling legacy protocols and enforcing strict least privilege today.
Frequently asked questions
How do I know if NTLM is still in use?
Check the security log for NTLM authentication events. Most operating systems provide built-in tools to monitor this.
Can I disable LDAP completely?
No. LDAP is required for directory queries. You must enforce LDAPS to encrypt the traffic instead.
What is the risk of changing the KRBTGT password?
It invalidates all current tickets. Users may need to re-authenticate. Plan this change during a maintenance window.
Does network segmentation stop insider threats?
It limits their ability to move laterally. It does not stop them from accessing resources within their allowed segment.
How this guide was produced: written by the RedTeam Tribune editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
