Let's say we secure all servers in the domain..
- Domain controllers allow RDP access only from jump servers
- Domain admins can't connect to non-dc servers
- And so forth
This is all swell and should be considered a safe configuration to prevent the existence of a domain admin's password in the memory of any member server.
Now let's say an attacker magically manages to apprehend a domain admin password on one of the member servers, then runs Mimikatz (or any other password extracting tool for that matter) through PsExec remotely on the DC - game over.
However, if I enforce the
Deny access to this computer from the network
on DCs and configure it for all Domain Admins, will something break?
There's also a reasoning behind this, where in no case should domain admins authenticate to the DC from another server, except from the jump server.
I have modeled this in my lab and nothing breaks, and running psexec with the domain admin password fails because of this configuration. this is a win. question is, will it work in a real network?
From what I gathered, this restriction is for any auth attempt made over SMB.
Should maybe be moved to Server Fault.