A R U N

Important steps to secure Active Directory-

# Rename or disable the Administrator account (and guest account) in each domain to prevent attacks on your domains.

# Physically secure all domain controllers in a locked room.

# Manage the security relationship between two forests and simplify security administration and authentication across forests.

# To provide additional protection for the Active Directory schema, remove all users from the Schema Admins group, and add a user to the group only when schema changes need to be made. Once the change has been made remove the user from the group.

# Restrict user, group, and computer access to shared resources and to filter Group Policy settings.

# Avoid disabling the use of signed or encrypted LDAP traffic for Active Directory administrative tools.

# Some default user rights assigned to specific default groups may allow members of those groups to gain additional rights in the domain, including administrative rights. Therefore, your organization must equally trust all personnel that are members of the Enterprise Admins, Domain Admins, Account Operators, Server Operators, Print Operators and Backup Operators groups.

# Use global groups or universal groups instead of domain local groups when specifying permissions on domain directory objects replicated to the global catalog. For more information, see Global catalog replication.

“`*“`arun …