Your network contains an Active Directory Domain Services (AD DS) domain. You need to implement a solution that meets the following requirements: - Ensures that the members of the Domain Admins group

Question

Exhibits

Explanation

The solution requires using Active Directory Authentication Policies and Silos to restrict Domain Admins' sign-in to domain controllers only and limit their Kerberos TGT lifetime to one hour.

Approach. The most effective and precise method to meet both requirements for a specific group like 'Domain Admins' is to utilize Active Directory Authentication Policies and Authentication Silos. This feature, introduced in Windows Server 2012 R2, allows for granular control over authentication settings for specific user, computer, or service accounts.

Here are the three sequential actions:

1. Create an Authentication Policy: This policy object defines the specific restrictions. You would configure it to set the 'Maximum TGT lifetime' to 60 minutes (one hour) and specify that 'User account is restricted to specific computers', listing the domain controllers (DC1, DC2, DC3) as the only allowed sign-in locations. This addresses both requirements.

2. Create an Authentication Silo: An Authentication Silo is an Active Directory object that groups accounts (users, computers, service accounts) together to apply a common authentication policy. Once created, you would link the Authentication Policy from step 1 to this Authentication Silo.

3. Associate the Domain Admins group with the Authentication Silo: This step ensures that the members of the 'Domain Admins' group are subject to the policies defined in the silo. This is typically done by editing the properties of the 'Domain Admins' group object in Active Directory Administrative Center (ADAC) and setting its 'Authentication Policy' attribute (msDS-AuthNPolicySilo) to the Authentication Silo created in step 2. This applies the TGT lifetime and logon restrictions to all members of the Domain Admins group.

This sequence ensures that Domain Admins can only sign in to domain controllers and that their TGTs are limited to one hour, as per the question's requirements.

Common mistakes.

• common_mistake. Common mistakes include:
• Modifying the 'Default Domain Policy' or another GPO linked to the domain: While Kerberos policies (like TGT lifetime) are typically set in GPOs at the domain level, these settings apply to all users in the domain, not just 'Domain Admins'. This would violate the requirement to limit TGT lifetime only for members of the Domain Admins group.
• Adding 'Domain Admins' to the 'Protected Users' group: The 'Protected Users' group automatically enforces several security measures for privileged accounts, including a reduced TGT lifetime. However, the default TGT lifetime for 'Protected Users' is 4 hours, not the required 1 hour. Therefore, this option does not meet the precise TGT lifetime requirement.
• Using GPOs to configure 'Deny logon locally' and 'Deny logon through Remote Desktop Services' for Domain Admins on member servers/workstations: While this approach effectively prevents Domain Admins from logging onto non-DCs (addressing the first requirement), it does not provide any mechanism to specifically limit their Kerberos TGT lifetime to one hour, which is the second requirement. Furthermore, this method is less centrally managed for logon restrictions compared to Authentication Policies which can specify allowed hosts.
• Configuring logon restrictions directly on individual servers: This is not a scalable or manageable solution for an entire domain and a critical group like 'Domain Admins'.

Concept tested. Active Directory Domain Services (AD DS) security, specifically advanced authentication management using Authentication Policies and Authentication Silos, Kerberos policy configuration, and user rights assignment for logon restrictions.

No community discussion yet for this question.