Secure accounts achieve a secure HDD forest and domain infrastructure by default every account that
science into domain joint client or server is cached locally on that computer.
The computer maintains by default the last 10 user profiles and their associated credentials.
This is the risk for example in the following situations consider an administrative account that is
used for troubleshooting or supporting users by assigning local it to regular users do wise the user
account profile and its credentials are stored in the system.
If the owner of the system has higher local rights he or she can use tools to retrieve the administrative
credentials and then use them to access other information on the network.
Another situation is that certain user accounts and computers contain highly critical information.
Therefore ensure that only authorized users can sign into their workstations and make sure that other
users can not access the same computers.
You should configure a highly trusted service account for authorization only on a certain set of computers
to provide administrators with the ability to address these risks and requirements.
Windows Server 2016 and later versions include new functionalities for credential potential and management
the functionalities are protected to users authentication policies and authentication policies silence.
Let's review each of this these functionalities in more detail.
The protected users security group prevents highly sensitive accounts from being locally cached on demand
member computers.
It requires domain controller authentication for those accounts for every sign in that a cure is protected
to users is a new group that you can use to configure highly sensitive accounts and you can find it
in the user's container in Active Directory to enable protected to users and administrators simply adds
the highly trusted accounts to the protected user security group.
This protected users feature does not require Windows Server 2012 our two domain controllers.
However this group is created only when a Windows Server 2000 twelve hour two or newer domain controller
receives the PDC emulator operations master role for future use of this feature.
It is not necessary that the PDC emulator operations monster remain on the Windows Server 2012 our two
domain controller and it is not necessary to maintain the Domain Controller.
However because the domain controller can only be promoted when the schema has been extended the schema
extension for Windows Server 2012 R2 or newer needs to be in place even if the feature does not require
it.
The protected users feature is a client site feature that protects the main accounts on domain member
computers protected users depend on the demand members operating system and is available on the following
operating systems.
Windows 8 dot 1 or newer and Windows Server 2012 are 2 on you're older operating systems will not support
this feature and will not prevent the counts and the protected users group from being cast locally to
ensure that accounts within the protected users group are not compromised.
An older operating systems use the other methods such as denial log on locally.
Security is certain where appropriate protected to users who assign into demand member a computer that
has a supported operating system will be prevented from using the following protocols like default credential
delegation or credential security support provider which is great SSP digest authentication and A.L.
AM when all domain controller also assigning domain are based on Windows Server 2012 our two and the
domain functional well as the race to Windows Server 2012 R2 additional security is provided because
of this additional security.
Users can not use e s or our AC for encryption in Canberra's pre authentication.
They cannot be delegated with unconstrained or constrained delegation and they cannot renew their Gerber
TGT without contact with the demand controller.
The following applies when a user is a member of the Protector to user a security group.
The user must be able to use authentication based on a e s encryption.
Therefore all domain controllers must be at a Windows Server 2008 level or newer the password of any
accounting protected user group must have been changed against a Windows Server 2008 or newer domain
controller to ensure that the password was encrypted by using a s unsupported domain controllers.
Domain members.
Sorry such as Windows 10 and Windows Server 2016 the credentials of the user will not be cached the
user will only be able to sign in to domain members that are able to authenticate against their domain
controller of line saying nil will not work for these accounts.
The startup of services that use an account that is a member of the protected User Group will fail when
the domain member says of fly and the maximum lifetime of the issued.
Gerber as TGT and the maximum lifetime for ticket renewal are limited to two for two minutes or four
hours while administrators configure all other accounts by using the domain policy settings which are
10 hours by default for the ticket and seven days for renewal.
Four hours are hard coded to protected users protected users is a security certain that is global within
the domain.
This setting does not allow you to protect certain users only on certain devices.
Therefore use protected users carefully and tested before relying on the protected users feature.
Now let's talk about another functionality for credential protection and management reaches authentication
policies with authentication policies you can configure more restrictive Gerber sadness for a specific
user or service account.
Additionally you can use Dec claims to define conditions that need to be met by users or service accounts
and or devices during signing authentication policies implement by using a new object class with the
name authentication policy in added years to implement authentication policies you need to ensure that
you meet the following prerequisites including that old domain controller is in the domain must be based
on Windows Server 2012 R2 or newer the domain functional level must be Windows Server 2000 16 or 2012
are two domain controllers must be configured to support deck windows stand Windows 8 and a dot one
Windows Server 2016 2012 are 2 and 2012 domain members must be configured to support Dec including Cobra's
compound claims or device claims when configuring an authentication policy in the active directory administrative
center.
You can configure the following sentence display in name of the authentication policy description if
the policies should be enforced which is default or if you want to well a date the policy by audit policy
restrictions only accounts to which the policies should apply.
Accounts are in the authentication policies Saturns.
However be aware that you can figure this on the account.
Unlike authentication policies silence where their accounts are configured within the silo for user
service and computer accounts you can define the following sentence.
Certainly the digital TV lifetime of the count and access control conditions used in deck claims that
define rich users or services are able to run on which devices you can configure this sentence to user
accounts are there within the user properties window in the active directory administrative center or
by configuring them in the authentication policy properties window regardless of where you can figure
these surgeons they are written to the authentication policy after you configure this sentence you will
sign in to do YS or you will receive the message that your account is configured to prevent you from
using this P.C. in either case an event is logged.
Please note that while older operating systems have options to restrict users from signing into specific
devices they are easier to circumvent authentication policies and authentication policies silos that
are built on core birth instead of names only and DEC claims provide a security method to ensure that
only certain users can sign into certain devices.
Also please note that authentication policies do not prevent users from signing in by using anti-Islam.
When a domain member is fully able to communicate by using Gerber as it is likely that the rules configured
in the authentication policy work as expected.
However there might be scenarios where lamb is used to prevent this.
Consider combining protected users and account policies.
And now let's talk about another functionality for credential but protection and management which is
authentication policies Silas authentication policies silence enable administrators to configure users
service accounts and computers within the same security scope to apply the same authentication policy
authentication policies enable administrators to select a separate authentication policy for each security
principal type user a service or computer accounts.
The system then adds an additional claim to silence principles which enables file server administrators
to restrict access to certain files for security principles of specific authentication policies silence
the prerequisites of authentication policies Silas are the same are the prerequisites of authentication
policies you should use them as an alternative means to assign user a service or computer account to
use certain authentication policies by using active directory delegation your rebuild to assign different
rules to create authentication policies and then assign those policies to security principles by use
an authentication policies silence like authentication policies you can configure authentication policies
silence to be enforced or in auditing mode authentication policies are enforced by default while authentication
policies silos are configured in order and mode additionally authentication policies Silas have a higher
precedence than authentication policies.
Furthermore authentication policies Silas do provide a claim and an administrator can use it to ensure
that certain files or certain files structures can only be accessed when users or computers have been
validated by an administration policies sale.
Next up we'll be talking about configure and user account policies.
I'll see you there.