Best Practices for Restricting Domain Administrator Access in Active Directory

Question

Hello everyone,

I’m seeking insights on the best practices for securing Domain and Active Directory environments, specifically regarding limiting of Domain Administrator access privileges. The goal is to ensure that individuals with Domain Admin account privileges  have limited access or denied modification to the credentials of senior management (can be Domain Administrator account or domain account) within an organization.(Since Domain Authentication is also used to access some of the internal confidential applications)

I’m interested in learning about the various solutions that can be implemented, whether they are technological, strategic or based on an understanding between the IT department and upper management.

In my research I have found that:

·        Most commonly an Identity and Access Management solution (IAM) inclusive of both Privileged Access Management (PAM) and Privileged Identity Management (PIM) solutions are generally deployed.

·        Other solutions include Tiering Approach and then limiting access based on tiers.

·        Another cost effective but not very dynamic approach was break-glass domain admin account, no day to day activities are done by Domain Admin Accounts, all the daily/ regular tasks can be delegated initially and then the domain admin account can be made break-glass, i.e. change password and new password known to no one but only person incharge, and can be given to the authorized person whenever required (critical situations).

Please feel free to add any other methods, which I may not considered.

So it boils down to what are the standard methods companies typically take to protect the sensitive accounts of their leadership team from being accessed by Domain Administrators? How do they balance the need for security with the necessary access rights for IT operations?

Any shared experiences, insights, or recommended resources would be greatly appreciated.

Answer 1

You should not modify the default permissions granted via the built-in privileged groups. Instead, creating custom groups instead and restrict/control the membership of the Domain Admins group (e.g. via breakglass or JIT elevation).

Details at https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin