In the world of technology, information security is a constant concern. For those of us who manage enterprise networks, protecting user credentials is a top task. Today I'm going to tell you about a special group in Active Directory (AD): the "Protected Users" group, and why its use is crucial in our fight against attack tools like Mimikatz.
What is the "Protected Users" ?
Introduced in Windows Server 2012 R2, the "Protected Users" is an Active Directory security feature that provides additional protection for user accounts. Adding a user account to this group enables enhanced security policies, limiting the methods by which credentials can be compromised.
The Menace of Mimikatz
To understand the importance of the "Protected Users" group, you first need to know Mimikatz. Mimikatz is an infamous hacking tool that can recover passwords, password hashes, and other types of credentials from Windows memory. It is a powerful tool in the arsenal of cybercriminals for carrying out pass-the-hash attacks. or "pass-the-ticket".
Why Use the "Protected Users" ?
Improved Authentication Security : Members of the "Protected Users" benefit from enhanced security measures. For example, they cannot authenticate using older, less secure authentication methods, such as NTLM, WDigest, or CredSSP.
Protection against Pass-the-Hash/Ticket Attacks : Mimikatz and other similar tools often exploit these older authentication methods to their attacks. By limiting their use, the risk is considerably reduced.
Attack Surface Reduction : Accounts in the "Protected Users" do not store their credentials in memory in a reusable manner, making memory mining attacks much less effective.
Implementation and Best Practices
Server Version : Make sure your AD environment is running Windows Server 2012 R2 or later.
Account Selection : Do not add all user accounts to this group. Start with high privilege accounts like administrators.
Password Policy : Encourage or enforce the use of strong passwords and multi-factor authentication for group accounts.
Test Before Deployment : Test the settings on a small number of accounts before applying them on a large scale.
Training and Awareness : Inform users of changes and good security practices.
In conclusion, the use of the "Protected Users" in Active Directory is an essential step in strengthening the security of your user credentials. By limiting the use of outdated and vulnerable authentication methods, and reducing the attack surface that tools like Mimikatz can exploit, you can significantly increase the security of your network.
Remember, IT security is an ongoing and evolving process. Adding accounts to the "Protected Users" is one measure among others, and it must be part of an overall security strategy, including regular user training, constant system updates and proactive monitoring.
As IT managers, our role is to remain vigilant and proactive. Judicious use of the "Protected Users" is a step in the right direction to stay ahead of threats. Together, let's secure our digital environment.
Enjoy 😎
AlexIn Tech