Indentifying an Under Optimised Active Directory

• Introductory Note
• Organisational Unit Structure
• Administrative Authority Groups
• Group Policy Architecture
• Inappropriate Authority
• Role Based Authority
• Role Based Authority - An Interface Example
• Documentation (Thorn In The Side)

Organisational Unit Structure

Normal

Optimised

The Structure based on the organisation (not helpful) rather than the technology (best practice) leading to unnecessary complexity. There are lots of OUs hanging off the ‘root’ of the domain making security by inheritance difficult. Naming standards are variable. These structures would be difficult to learn and maintain.

Clean, and consistent structures. All the OUs represent the company technology - excellent design practice offering simplicity, versatility and strength. These structures are intuitive and easy to maintain.

Administrative Authority Groups

Normal

Optimised

The Authority Groups are spread around the structure, often in the same OUs as the objects over which they grant control. This leads to Administrators having direct control over peer administrator accounts and group memberships – invalidating the system audit trails. “Distributed” Administrative groups make it very difficult to hierarchically organise any role-based authority breakdown.

Clean, and consistent Authority Groups. Each group is clearly named and its function is obvious from a combination of naming and position within the OU structure. Authority can be hierarchically organised.

Group Policy Architecture

Normal

Optimised

We have either no policy definition (i.e. defaults only - offering only limited functionality in a rigid form), or too many policies, poorly organised. Poor naming and inconsistent OU association makes policy applications volatile, degrading the user experience, lowering security and in worst cases actually increasing ROI by wasting Administrators time with excess support and complex troubleshooting.

Optimised, carefully layered, consistent Group Policy architecture ensures reliable, secure and trouble free group policy application.

Inappropriate Authority

Normal

Optimised

Every User account that is granted a higher level authority like “Domain Admins” has the power to destroy, by accident or malice, anything anywhere in the ENTIRE windows infrastructure.

It is common to find too many members of the high level security groups. Excess members are often lower level Administrators who lack the proper training, but, just as often, they are ordinary users who should NEVER have been granted any elevated authority.

Higher Level Authority should be strictly limited to the smallest possible number of the most senior, most trusted, and most skilled Administrators.

This, of course can only be done when alternate, role-based lower level authorities have been created (see below...)

Role Based Authority

Normal

Optimised

System defaults. Everyone who requires
any sort of authority is “Higher Level Admin”.

Clear and Hierarchically organised Role Based Authority. Administrators are granted the powers they need to do their job and no more.

Lack of Role-based Authority is detrimental to the security of the whole Windows Infrastructure. It is one of the most common audit failures.

Role Based Authority - An Interface Example

Normal

Optimised

A “Higher Admin” can create anything, anywhere! It could be inappropriately used to create a user in an OU that is not covered by Group Policy - allowing that user to evade security controls.

A role-based “Client Administrator” can only perform tasks defined for the job - in this case creating a computer object in the proscribed location.

Documentation (Thorn In The Side)

Normal

Optimised

Enough said.... Almost...

Remember that lack of appropriate documentation is one of the most common causes of compliance audit failures.

The way it should be - in line with best practice - administrators can recover from disasters with the support of the instructions, new starters get up to speed quickly and there is no ‘key man reliance’.