Lion Cipher Lab
Harden Active Directory with Group Policy (AD series, Part 2)
- Identity & Access Management
- Intermediate
- ~75-90 min
- Free · no account required
Why it matters
Active Directory (AD) is the identity backbone of the overwhelming majority of organizations -- it is how companies decide who you are and what you can touch across thousands of Windows machines at once. That also makes it the single richest target an attacker can find: compromise the domain and you often own everything in it. Part 1 of this series had you BUILD a small AD domain in a home lab so the pieces stopped being abstract. This lab teaches the other half of the job -- HARDENING that domain -- using the exact tool real administrators use to configure Windows at scale: Group Policy.…
What you'll learn
- what Group Policy is and how a domain pushes settings to every machine and user at once
- the exact vocabulary: GPO (Group Policy Object), GPO link, scope, and Organizational Unit (OU)
- opening the Group Policy Management Console (GPMC) and creating + linking your own GPOs
- what a security baseline is and why professionals harden against a named standard, not by feel
- enforcing a strong password and account-lockout policy in the domain
- disabling the obsolete SMBv1 file-sharing protocol across the domain with a GPO
- turning on audit logging for logon events so sign-ins are actually recorded
- restricting who is a local administrator, and what LAPS (Local Administrator Password Solution) does
- applying a Microsoft Security Compliance Toolkit baseline as a GPO
- forcing policy with gpupdate and PROVING it applied with gpresult / RSOP
Steps in this lab
- First: the one safety rule, and snapshot your Part 1 lab
- The vocabulary: Group Policy, GPO, OU, link, and scope
- Open GPMC and get oriented on the domain controller
- Baseline 1: enforce a strong password and account-lockout policy
- Baseline 2: disable SMBv1 across the domain with a new GPO
- Baseline 3: turn on audit logging for logon events
- Baseline 4: restrict local administrators and understand LAPS
- Baseline 5: apply a Microsoft Security Compliance Toolkit baseline
- Force the policy and PROVE it applied with gpupdate and gpresult
- What you built, and where the AD series goes next