How to Harden Active Directory Group Policy: Security Configuration Guide

Disable LM hash storage:

LAN Manager hashes are extremely weak (split into two 7-character DES-encrypted halves) and can be cracked in seconds. They are stored by default when a password is set.

GPO path:
Computer Configuration > Windows Settings > Security Settings >
Local Policies > Security Options >
"Network security: Do not store LAN Manager hash value on next password change"
Setting: Enabled

Block NTLMv1 authentication:

NTLMv1 session keys are vulnerable to relay and downgrade attacks. Modern Windows supports NTLMv2; blocking v1 forces all NTLM authentication to use the stronger protocol.

GPO path:
Computer Configuration > Windows Settings > Security Settings >
Local Policies > Security Options >
"Network security: LAN Manager authentication level"
Setting: Send NTLMv2 response only. Refuse LM & NTLM

# This is the most aggressive setting (value 5)
# If you have legacy systems that cannot use NTLMv2:
# Start with "Send NTLMv2 response only, refuse LM" (value 4)
# Then investigate what fails and remediate before moving to value 5

Disable WDigest credential caching (prevent plaintext passwords in LSASS):

WDigest stores cleartext credentials in LSASS for HTTP Digest Authentication. Mimikatz's sekurlsa::wdigest recovers these plaintext passwords.

GPO path:
Computer Configuration > Administrative Templates > MS Security Guide >
"WDigest Authentication (disabling may require KB2871997)"
Setting: Disabled

# Or via registry (if the MS Security Guide ADMX is not installed):
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
# UseLogonCredential: DWORD = 0

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
  -Name "UseLogonCredential" -Value 0 -Type DWORD
# Takes effect on next logon (does not kick existing sessions)

Enable Credential Guard (requires UEFI + Virtualization-Based Security):

GPO path:
Computer Configuration > Administrative Templates >
System > Device Guard >
"Turn On Virtualization Based Security"
Setting: Enabled

Virtualization Based Protection of Code Integrity:
  Enabled with UEFI lock (prevents disabling without clearing UEFI variables)

Credential Guard Configuration:
  Enabled with UEFI lock

# Credential Guard moves NTLM hashes and Kerberos TGTs out of LSASS
# into a separate VSM (Virtual Secure Mode) process that malware cannot access

The most common lateral movement path in ransomware attacks: local administrator account with the same password on every workstation. Compromise one machine, use the local admin credential to authenticate to all others via PsExec or WMI. LAPS breaks this by randomizing each machine's local admin password.

Deploy Windows LAPS (built into Windows 11 22H2 and Server 2025):

# Step 1: Update AD schema (run on DC as Domain Admin)
Update-LapsADSchema

# Step 2: Configure LAPS via GPO
# Computer Configuration > Administrative Templates >
# System > Local Administrator Password Solution
#   Enable LAPS: Enabled
#   Password Settings: 14+ chars, complexity enabled, 30-day rotation
#   Password Encryption: Enabled (encrypts stored password in AD attribute)
#   Post-authentication actions: Reset password (after password retrieved)

# Step 3: Grant specific AD groups read access to LAPS passwords
# Only help desk accounts that legitimately need local admin access
Set-LapsADComputerSelfPermission -Identity "OU=Workstations,DC=corp,DC=local"
Set-LapsADReadPasswordPermission -Identity "OU=Workstations,DC=corp,DC=local" `
  -AllowedPrincipals "CORP\Helpdesk-L2"

# Step 4: Verify LAPS is setting passwords
Get-LapsADPassword -Identity "WORKSTATION01" -AsPlainText
# Output shows: ComputerName, DistinguishedName, Account, Password, PasswordUpdateTime

Default Windows audit policy does not log enough detail to detect credential attacks. The recommended audit policy logs security events in seven key categories.

Configure Advanced Audit Policy via GPO:

GPO path:
Computer Configuration > Windows Settings > Security Settings >
Advanced Audit Policy Configuration > Audit Policies

Account Logon:
  Audit Credential Validation: Success, Failure
  (logs Event 4776: NTLM auth attempts; detect NTLMv1 usage)

Account Management:
  Audit User Account Management: Success, Failure
  Audit Security Group Management: Success
  (logs user/group creation, modification, deletion)

Logon/Logoff:
  Audit Logon: Success, Failure
  (logs Event 4624/4625: all logon attempts)
  Audit Special Logon: Success
  (logs Event 4672: privilege assignments at logon)

Object Access:
  Audit File System: Failure (too noisy for success)
  Audit Registry: Failure

Policy Change:
  Audit Audit Policy Change: Success, Failure
  Audit Authentication Policy Change: Success
  (detect GPO changes, policy modifications)

Privilege Use:
  Audit Sensitive Privilege Use: Success, Failure
  (logs Event 4673/4674: use of dangerous privileges like SeDebugPrivilege)

System:
  Audit System Events: Success, Failure
  (logs system startup/shutdown, audit log cleared)

Verify audit policy is applying:

# Run on any domain machine after GPO applies:
auditpol /get /category:*
# Check that each subcategory shows "Success" or "Failure" as configured

# Or from PowerShell:
Get-WinEvent -LogName Security -MaxEvents 100 | \
  Where-Object { $_.Id -in (4625, 4672, 4776) } | \
  Select-Object Id, TimeCreated, Message | Format-List

User Rights Assignments control which accounts can perform sensitive operations: logon locally to DCs, load drivers, act as part of the OS. Default settings are often too permissive.

GPO path:
Computer Configuration > Windows Settings > Security Settings >
Local Policies > User Rights Assignment

High-priority restrictions:

"Access this computer from the network":
  Remove: Everyone, Users
  Keep: Administrators, Authenticated Users (for workstations)
  On DCs: Administrators, Domain Controllers only

"Allow log on locally" (on Domain Controllers):
  Restrict to: Domain Admins, Account Operators, Backup Operators
  Remove: Everyone, Users, Guests

"Debug programs" (SeDebugPrivilege):
  Remove from Administrators (or restrict to specific named accounts)
  SeDebugPrivilege allows opening any process: used by Mimikatz
  Risk: Removing from Administrators may break some software; test first

"Load and unload device drivers":
  Restrict to: Administrators only
  Prevent attackers from loading malicious drivers (BYOVD attacks)

"Deny log on through Remote Desktop Services" (on all non-bastion hosts):
  Add: Guests, Local account (prevents local user RDP from spreading laterally)

Microsoft Security Baseline GPO: import and apply:

# Download Microsoft Security Compliance Toolkit from Microsoft.com
# Includes pre-built GPOs for Windows 11, Server 2022, etc.

# Import baseline GPO:
Import-GPO -BackupId "{GUID}" `
  -Path "C:\SecurityBaselines\Windows11\GPOs" `
  -TargetName "WIN11-Security-Baseline" `
  -MigrationTable "migration.migtable"

# Link to appropriate OU:
New-GPLink -Name "WIN11-Security-Baseline" `
  -Target "OU=Workstations,DC=corp,DC=local" `
  -Enforced Yes