3

I work for a small company (35 employees). Earlier this year we implemented Active Directory (to support an enterprise level application). We didn't implement AD for AD's sake but to provide LDAP authentication for a line of business application. In this company I provide IT support and am responsible for all things computers. AD is not my strong suit. We hired a consultant who did a great job with the implementation.

Now, we're so many months into this and I'm getting a lot of complaints about security being too tight. This has grown to the point where the CFO (my boss) is asking to loosen the security by allowing a subset of our company to become PC-Admin users and several others to be allowed Domain Admin rights. Our consultant has repeatedly advised against loosening or sharing the Administrator controls. I've tried repeatedly to explain the value of what AD is and why the security is now so tight.

My initial response is no don't do it. I've said this much to him and it has not changed his mind. Basically, they want what they want and they're not as concerned with security.

My question to this community is: What options do I have? I don't think I'm going to be able to change anybody's minds on this (both the CFO & CEO have stated that they want this changed). I also don't want to stand in the way of users being to do their jobs either.

We're running AD on Server 2012 R2 with all windows 10 clients.

I apologize if this is not the correct forum or if I have posted in bad form. This is my first post to Stack Exchange. I really appreciate all of the information that gets shared with SE and look forward to being able to contribute myself.

3

You will have to weigh decisionmaker risk tolerance against your overall business loss exceedance, typically both on curves of the same graph.

What is at risk (tell the CFO and CEO that what's at stake is the top-line of the company -- it's entire sales and all of its growth capabilities)? What will cost extra to manage installs and centralize Domain Administration as opposed to allowing willy-nilly admin access? If your company makes under $100M per year, then you are already fortunate to be running at a Active Directory domain functional level of Server 2012 R2 (which allows Protected Users) and utilizing the amazing security protections that default in Windows 10 client infrastructure. You could also stand to gain some advantages by adding SysMon and EMET log streaming to a centralized log infrastructure (a free one named MozDef, which runs on Linux, comes to mind but there are also free AutoRuns and SysMon Windows-based services). However, Windows 10 is so strong, it would only need EMET for the event-log capabilities.

Try to upgrade everything to Powershell v5, if not already. Windows 10 gives many advantages with Powershell v5 as well, but these advantages can work against you. Consider implementing AppLocker in any form (even as strong as whitelisting everything -- but you'll likely want to blacklist a few things, at least occasionally) which, when combined with Powershell v5, has Script Block Logging, Protected Event Logging, and Antimalware Scan Interface Integration (AMSI). Please enable all of these -- they're free wins. If you really want to go crazy, get the Microsoft Advanced Threat Analytics platform. Do not loosen UAC policies, but ensure that servers have full/max UAC for any accounts used on them. Domain Administrator is very dangerous -- use Protected Users and mark these up with full UAC. Protected Users should only be able to log into servers and regular users only into their workstations (possibly by OU or however you categorize).

If decisionmakers can live with a 1 percent chance per year of losing anywhere from $5M to $75M, then you'll be fine with a few free tools, at least until you can prove out your program. I don't see any reason for you to provide any extraneous admin access to anyone (not even local). Have one or two sets of Forest/Domain Administrator accounts (never use them except in emergency, make their passphrases 30 characters long, safely print them, and then store in fire safe or two), and a few Protected Users (for those who need server or domain-change access).

If your time and the company's resources are better spent elsewhere, then don't do any of this. It's really unlikely you'll be compromised if you indeed have only Windows Server 2012 R2 with a domain functional level of the same and all clients are Windows 10. One XP machine can mess this all up, though. One user with local admin or domain admin privileges can completely mess this up. Your consultant is right to tell you that handing out admin accounts willy-nilly is weak form.

My suggestion is to grab the book Windows PowerShell in 24 Hours, Sams Teach Yourself and use its guide to install OneGet, Chocolately, and ChocolatelyGUI. Then you can use your powers as admin to make installs and upgrades of applications very easy for everyone. Another alternative is to get the book Learning Puppet for Windows Server, but this will require a Linux server for the Puppet components. Using Foreman (a web UI for Puppet), you can setup normal users with just enough access on Foreman to install apps to their PCs. This way, you do so through the Puppet agents and not through admin accounts.

When you log in to a computer as Domain Admin on console, through runas, or via RDP you are severely degrading the ability of each system to defend its registry, especially the Security (especially Policy Secrets) and System hives. Attackers use tools such as mimikatz to access these hives, but can also pull tokens out of running processes to impersonate Domain Admins. The best way to avoid running as Domain Admin is to use the Protected Users, as well as either WMI (through wmic) or PS Remoting to make changes, install things, et al.

Your job is to enable the business by protecting it. You are being challenged by people very skilled at negotiation -- so you have to understand it's a little give and a little take. What you can't allow to be taken is control of admin rights -- i.e., privileged-account management. You could show them that you could do so if you were given an allowance to purchase all of the solutions from CyberArk, BeyondTrust, Varonis, and STEALTHbits, but that a typical integration of those four solution sets costs around $10M. Instead, offer to solve the problem by providing better-quality service from yourself regarding changes and installs. If you can automate this via Chocolately (or OneGet) and/or productize installs through Foreman, then you are really seeing win-win with your C-levels. This is known in negotiation as a BATNA. If all else fails, tell them that by giving away admin access, the 1 percent per year for a loss of $5M to $75M still applies but that they are adding a separate other 10 percent per year for a loss of $10M. See if they like those numbers and want you to give up access still. They'll probably ask where you're getting those numbers from. Tell them howtomeasureanything.com/cybersecurity

A lot of my answer comes from the information culled out of this slide deck -- http://www.info-assure.co.uk/public_downloads/Talk%20is%20cheap-IR%20tools%20can%20be%20too.pdf

  • 1
    Thank you for the in-depth answer. I will look into all of your suggestions and take them where possible. I really appreciate you sharing this. Thanks! – j_unknown Jul 30 '16 at 11:54
  • 1
    If i could up-vote your answer i would. – j_unknown Jul 30 '16 at 11:56
  • 1
    Almost three years later and this answer has benefited me greatly! Thank you! – j_unknown Jun 26 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.