Windows and Active Directory Audit

(Duration: 3 days)

Active Directory Objects

• Forests and Trees, Domains and Sites, OUs Groups and Users
• Risks of inappropriate forest/domain configuration
• Risks of trust relationships in an AD forest

Reviewing the deployment of Active Directory

• Risks of poor deployment decisions
• Replication risks
• Accidental deletion of AD objects

Workstation/server controls in an AD environment

• Risks associated with workstation and server domain membership

AD User and group management

• Risks of poor user account control
• Incorrect and inappropriate group membership,
• Control of dormant accounts
• Risks associated with service accounts

Object permissions in Active Directory and what they mean

• Risks of incorrect object permissions for AD and other objects
• Risks of delegation and how to assess them

Group Policy Objects and how they are used

• Risks of poor Group Policy design, deployment and monitoring
• The Group Policy Management Console and how to use it in a GP audit

Auditing

• Risks of improper audit logging configuration and monitoring

Risks of inappropriate file and directory access permissions

• How to assess permissions cost-effectively

Useful software:

• DumpSec
• MBSA
• Log dumper tools
• The built-in NET commands

Using scripts to control and audit Windows 2003/AD

A look at some of the new features of Windows Server 2008 and how they can mitigate some of the risks identified above

• New Active Directory security features
• Read-only domain controllers
• Granular password policies
• Auditing improvements
• New controls over service accounts
• BitLocker
• Powershell and its audit uses