7 Active Directory Misconfigurations to Find and Fix—Now

Part 1 of the CISA/NSA top ten misconfigurations series for AD: default configurations, improper privilege separation, and lack of internal monitoring, with remediation guidance.

AD security primer: AD holds the keys to most on-prem apps; top risks include unconstrained Kerberos delegation and over-permissioned users. Includes hardening best practices.

Non-default principals with DCSync rights can impersonate a domain controller via the DRS protocol and pull password hashes. Explains why misapplied replication rights are risky and how to find them.

Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.

AD hardening starts with knowing the weaknesses attackers exploit—legacy protocols and admin accounts everywhere, excessive permissions enabling lateral movement; the piece lists commonly missed misconfigurations and a security cheat sheet.