An Active Directory Domain usually includes multiple domain controllers to ensure that all security
settings apply consistently to all domain controllers.
You should configure a security assistance for Active Directory Domain Controllers centrally to do this.
Use the default domain controller as group policy object or GPO or create a new custom GPO that is linked
to the domain controller or organizational unit.
You create all domain controller computer accounts in this.
Oh you aren't you should not move them out of this oh you because they will fall out of the default
domain controller as policies go.
Some organizations prefer to use a different GPO than the default domain controllers policy when configuring
sir security settings.
It is possible to apply a sentence that might be too secure.
For example you could configure policies that lock out some administrative groups or policies that prevent
anyone from accessing the domain.
While it is simple to unlink or disable a custom GPL you should not disable or unlink the default domain
controller as policy.
For this reason it is recommended that you create a custom GPO and link it to the domain controllers
or you instead of modifying the default domain controllers policy.
Now some words about default domain policy versus default domain controllers policy.
There are two default GP O's the default domain policy and the default domain controller is policy and
it is essential to understand the differences between the two default domain policy GPO links to the
domain and it applies to all users and computers including client computers domain controllers and servers
in the domain you should use this policy and others that link to a domain very carefully default domain
controllers Jabil links to the domain controllers or you and it applies to all domain controllers in
the domain.
This is the GPO in which you configure most securities Saturns that pertain to demand controllers.
Now let's switch to securities servants in the GPO.
The following are some of the most important security assertions that you can configure in a GPO.
You can find the security servants in any GPO under computer configuration policies windows settings.
Let's take a look at each of these settings closer account policies under this note.
You can configure the password policy account lock out policy and Cobra's policy.
This sentence only applied to the local user accounts and the computers to which the policy applies
unless you configure the settings and the default domain policy.
Only the account policies that you can figure in the default domain.
Policy applied to all domain accounts.
Next one is local policies.
This note contains three of the most important nodes for a security configuration namely audit policy
user rights assignment and security options.
As for audit policy these settings configure legacy audit and policies that apply to all Windows operating
systems versions.
However if you have Windows Server 2008 our two and Windows 7 or newer deployed in your network it is
recommended that you use advanced audit policy configuration instead of this audit and policies.
As for user rights assignment these settings configure manage security sets that apply to users rights.
For example you can specify who can access the computer from the network who can sign in locally or
through remote desktop services and who is able to change the time or shut down the computer for domain
controllers.
You also can specify who is able to synchronize directories services data and the sort note of local
all it this is security options.
This sentence contain important security Saddam's gluten options for managing default accounts such
as the guest and administrator accounts and lease options also pertain to manage under Wise's domain
controller.
Domain member security protocols log on security asset and network access and security sadness.
Now some words about Event Log node under this node you can configure settings such as event log size
retention method and retention duration for the default application security and system event logs.
It is important to have all security locks on domain controllers configured identically if you configure
the security lock on one domain controller to keep logs for six days and another retains logs for only
three days you'll receive inconsistent results depending on the domain controller on which you perform
the search.
The next note is restricted groups under this node you can define two properties for security sensitive
groups or restricted groups for each group that you add here.
You can define member of sound member of attributes for groups that you configure as a restricted.
You can not change membership by using other tools such as active directory users or some computers.
Next up is systems services under this node.
You can define start up behave around security permissions for system services by using GP.
This enables you to disable all services that are not required for a specific server role such as a
domain controller.
The next node is Windows firewall with advanced security.
This setting allows you to administer windows firewall with advanced security centrally by using a GPO
to configure windows firewall settings.
You can ensure that all servers that provide the same services such as domain controllers have a consistent
windows firewall configuration.
Next up is public key policies.
Under this node you configure a sentence that rely on a public key infrastructure or TKI such as the
encrypted file system and its recovery key bit local drive and groups an automatic cert request sentence
and trusted route certification authorities.
Next up is advanced audit policy configuration settings under this node enable more X dance of policy
configuration than the audit policy under their local policies no one target in Windows Server 2000
eight are two or newer or Windows 7 computers or newer.
It is recommended that you use the new advanced audit policy configuration settings.
Okay.
That's it.
About modifying the security sets of domain controllers.
Next up we'll be talking about implementing Secure authentication.