Manage security in Active Directory
This module covers how to manage security in an Active Directory Domain Services (AD DS) environment. You learn how to configure user account rights following the principle of least privilege, restrict privileged accounts from dangerous sign-in methods, delegate AD permissions to non-administrative users for tasks like password resets, add accounts to the Protected Users group to prevent credential caching and enforce Kerberos-only authentication, deploy Windows Defender Credential Guard to isolate credentials against Pass-the-Hash and Pass-the-Ticket attacks, block legacy NTLM authentication in favor of Kerberos, and find and remediate problematic accounts including inactive users and accounts with non-expiring passwords.
Learning objectives
By the end of this module, you'll be able to:
Configure user account rights.
Configure user account rights to restrict access.
Delegate permissions in Active Directory.
Protect User Accounts with the Protected Users group.
Describe Windows Defender Credential Guard.
Block Windows NTLM authentication.
Locate problematic accounts.
Prerequisites
Knowledge of and experience working with:
Windows Server.
Core networking technologies.