Server security

Question

Hi,
Would it have many other problem (in security), if Windows server having active directory, is directly linked to outside internet? How to make it better on the server?

Answer 1

Hello @Peter_1985 ,

Thank you for posting here.

Based on my understanding, AD domain is a security boundary. We suggest not to expose AD to the Internet, which may cause many security problems.

Here is a similar case we can refer to.

Should I expose my Active Directory to the public Internet for remote users?
https://serverfault.com/questions/573681/should-i-expose-my-active-directory-to-the-public-internet-for-remote-users/573721

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hello @Peter_1985 ,

Thank you for your update.

what should be the configuration?
Do you mean how to set up AD? If so, you can refer to links below.

Install Active Directory Domain Services (Level 100)
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-active-directory-domain-services--level-100-

Active Directory Domain Services Overview
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

Hello @Peter_1985 ,

Thank you for your update.

Usually, we can deploy an AD forest, while ensuring network security, ensure that the password of the management account meets a certain level of complexity.

The following article explains other instructions of securing active directory domain controllers for your reference.

Reference:
Best Practices for Securing Active Directory
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 4

Hello @Peter_1985 ,

Thank you for your update.

As I mentioned above, we do not suggest you do that.

Even if AD is not connected to the Internet, no one can guarantee that AD will always be absolutely secure.

If you must do this, then you should always monitor for possible security issues.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 5

Hi,
How to adjust network configuration to ensure it's safe, having AD inside?