Active Directory Security Best Practices

A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.

Part 1 of the CISA/NSA top ten misconfigurations series for AD: default configurations, improper privilege separation, and lack of internal monitoring, with remediation guidance.

User rights assigned via GPOs—debug programs, back up files, take ownership, and more—become risky when misassigned. Explains how to review and lock down dangerous user rights in Active Directory.

Semperis CEO Mickey Bresman on why AD is a keystone: 47% of organizations rely on it as their primary identity store, and cloud identities still sync back to on-prem AD—so compromise cascades. Tested recovery plans and AD monitoring are urged.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

WinRM over HTTP isn't the cleartext disaster people assume — payloads are encrypted at the application layer — and the post explains when HTTPS genuinely adds value and when it doesn't.