After this lesson, you will be able to: Apply AD defenses: the tiered administration model, Protected Users, Credential Guard, disabling NTLM where possible, and monitoring key Windows Event IDs.
The defensive payoff. This lesson covers the controls that break the attacks from earlier: tiered administration, the Protected Users group, Credential Guard, disabling NTLM, and monitoring the Windows Event IDs that reveal AD attacks.
The single most impactful AD defense is the tiered administration model: separate accounts and login boundaries for Tier 0 (domain controllers and identity systems), Tier 1 (servers), and Tier 2 (workstations). A Domain Admin should never log into a workstation, because doing so exposes their credentials in that machine's memory for an attacker to steal. Tiering ensures privileged credentials are only ever used on systems of equal trust, which cuts most lateral-movement-to-domain-dominance paths.
The Protected Users security group hardens its members: their credentials are not cached the same way, NTLM and weaker Kerberos options are disabled for them, reducing exposure to Pass-the-Hash and ticket theft. Credential Guard uses virtualization-based security to isolate credentials (the LSASS secrets) so that even malware with admin rights on a machine cannot extract them with tools like Mimikatz. Together they make stealing privileged credentials from memory much harder.
Disable NTLM where possible (it enables Pass-the-Hash) and monitor where it is still used so you can phase it out. Replace weak service-account passwords with Group Managed Service Accounts (gMSAs), which use long, automatically-rotated passwords that defeat Kerberoasting. Enforce pre-authentication on all accounts to kill AS-REP Roasting. Protect and monitor the krbtgt account, and rotate its key (twice) on any suspected compromise.
Detection matters because prevention is never perfect. Key event IDs: 4624 (successful logon) and 4625 (failed logon) for unusual patterns; 4768 (TGT requested) and 4769 (service ticket requested) for Kerberoasting spikes; 4720/4728/4732 for account and privileged-group changes; and events around krbtgt and DC changes. Feed these into a SIEM with alerting (the Incident Response subtrack covers SIEM) so Kerberoasting bursts, anomalous logons, and privilege escalations are caught.
Pick one.
Letting Domain Admins log into workstations (the classic fatal mistake). Leaving service accounts with weak static passwords instead of gMSAs. Not enforcing pre-authentication. Keeping NTLM enabled everywhere. Collecting event logs but never alerting on 4769 spikes or privileged-group changes. Rotating krbtgt only once. Treating prevention as complete without detection.
Sign in and purchase access to unlock this lesson.