Additional Security Configuration In addition to the security configuration that can be done in GPOs and security templates, other items should be addressed:Group membership Membership in groups that have administrative privileges should be carefully considered and monitored. Examples of groups to pay particular attention to are Enterprise Admins and Schema Admins. Enterprise Admins can administer every domain in the forest and have additional forest-wide administration privileges not given to Domain Admins. Membership in Enterprise Admins should be restricted. Schema Admins can modify the Active Directory schema, a privilege that should not be given out lightly; in fact, best practices recommend that this group be empty until the need to modify the schema and the approval to do so is obtained.Active Directory object permissions Active Directory objects are also permissioned. Permissions on these objects also provide the holder with possible privileges, such as resetting account passwords for other users, full control including the development of GPOs, and so on. Active Directory object permissions should not be changed without a firm understanding of what the change does. Secure configuration of server services implemented on DCs, such as DNS, Certification Authority, DHCP, WINS, and so on.Direct registry modification The registry can be directly modified.Direct change of file and registry permissions Permissions can be changed directly on files, folders, and registry keys.
|