Course overview

In this DeepDive workshop, you will learn how to implement, configure and operate Active Directory environments in a highly secure manner.

The Active Directory is “getting on in years”. In terms of security in particular, an Active Directory should NEVER be operated as standard. Attack scenarios such as pass-the-hash, silver ticket, golden ticket or even skeleton key are common ways for attackers to attack the Active Directory and thus the users and administrators and take over the identities. Last but not least, the hack of the Bundestag with the help of mimikatz and others has shown the vulnerability of the Active Directory.

In this master class course, the attack scenarios on the Active Directory are first examined in depth and also carried out. With the knowledge gained from this, the Active Directory is now fundamentally hardened. This applies to existing installations, which should first be analyzed in depth, as well as new implementations, which are then completely hardened in order to be considered attack-proof in the future. The knowledge for this course was acquired in over 20 years of Active Directory experience, as well as in years of training by Paula Januszkiewicz and Sami Laiho, both world leaders in the field of security.

This course also draws on the experience of over 50+ Active Directory concepts written by the trainer over the last 15 years – from SMB to enterprise level with 375,000 users. The topic of security is also considered in the direction of the General Data Protection Regulation (GDPR), which came into force on May 25, 2018.

We promise: Our best know-how for you and your day-to-day work from our most experienced trainers and consultants

Target group

This course is aimed at experienced system administrators, consultants and Active Directory designers. After this seminar you will be able to design, implement and consult Active Directory in a highly secure manner.

Prerequisites

At least 5 years of experience with Active Directory and client systems

Course objective

This master class course focuses on the topic of Active Directory security – various attack scenarios are now known, such as those used in the Bundestag hack (mimikatz et al.).

These valid attack scenarios are aimed at credential theft or ransomware implementation (e.g. at the logistics company Maersk with an estimated loss of 300 million euros).

The aim of this workshop is to understand these scenarios in order to be able to prevent them and to implement an Active Directory implementation that resists these attacks and is also hardened against future attacks.

The Active Directory is your “crown jewel” – without Active Directory, most company environments are completely paralyzed.

Therefore: Understand, harden and monitor so you can sleep better.

Course content

• Review of best practices for installing domain controllers from 20 years of experience as an ADDS senior consultant
• Homegrown security issues in Active Directory
  • Understanding Kerberos
  • NTLM vs. Kerberos
• SMB
  • SMB versions
  • Attack scenarios
  • Secure use of SMB
• PAC_Validation and the problems with the Microsoft implementation of Kerberos – in detail
• PTH – Pass the Hash – including live attack with all participants
• Silver Ticket
• Golden Ticket
• Skeleton Key
• Kerberos Ticket Service
  • Understanding Kerberos
  • Change Kerberos passwords: Why and how…
  • Changing Kerberos passwords: The silver bullet without failures
• Preventing credential theft – A DeepDive:
  • Attack Scenario
    • Pass-the-Hash
    • Silver ticket
    • GoldenTicket
    • Skeleton-Key
  • – Prevent credential theft
    • Configure Windows Defender Credential Guard
    • Windows Defender Remote Credential Guard Bitlocker
    • Deploy Windows Defender Device Guard
    • Deploy AppLocker
    • Deploy Windows Defender Application Guard
• Understanding concepts:
  • Operating Tier.models
  • From Red-Forest, Golden-Forest and Bastion Forests
  • Highly secure single-domain model
• Clean installation source
  • Verify hash values of *.iso files
  • Fciv.exe, Powershell, 7zip and IgorHasher
• Set up the first domain controller
  • Understanding ms-ds-machineaccountquota
  • Use redircmp for new computer systems
  • Using redirusr for new users
  • Bitlocker
  • Bitlocker and TPM 1.2 vs. 2.0
  • Bitlocker and PreBoot authentication
  • AppLocker
  • Monitoring
    • AD-Audit-Plus
    • CyberArk
  • Secure backup and recovery of Bitlocker-protected backup volumes
  • Firewalling on domain controllers
  • Configuring IPSEC with RDP
  • Hardening domain controllers according to
    • Center of Internet Security
    • gpPack& PaT
    • SIM
    • LDA
    • Microsoft tools
• Setting up additional domain controllers
• Secure deployment of domain controllers, member servers and clients via MDT
  • Highly secure installation and configuration of MDT
  • Hardening of MDT servers
  • Rolling out highly secure member servers and clients
• Operating domain controllers securely via IPSEC
  • Configuring and using IPSEC
  • IPSEC monitoring via MMC
• Set up PKI server as internal Trusted ROOT CA
  • Configure PKI
  • Enable automatic certificate deployment via group policies
  • Enrolment of non-standard certificates
  • Hardening the PKI according to
    • Center of Internet Security
    • gpPack& PaT
    • SIM
    • LDA
    • Microsoft tools
• Jump Server and Privileged Access Workstation ( PAW ) – Understanding and implementing concepts
  • Setting up and configuring jump servers
    • RSAT installation
    • Install ADMIN Center with valid certificate of a Trusted Root PKI
    • Bitlocker
    • Bitlocker and TPM 1.2 vs. 2.0
    • Bitlocker and PreBoot authentication
    • AppLocker
    • Configuring IPSEC with RDP
    • Backup of Jump servers to bitlocker-protected volumes
    • Firewalling on JUMP servers
  • Hardening the Jump server according to
    • Center of Internet Security
    • gpPack& PaT
    • SIM
    • LDA
    • Microsoft tools
  • Set up and configure PAW
    • Bitlocker
    • Bitlocker and TPM 1.2 vs. 2.0
    • Bitlocker and PreBoot authentication
    • AppLocker
    • Configuring IPSEC and RDP
    • Backup of PAWs to bitlocker-protected volumes
    • Firewalling on PAWs
  • Hardening the domain controllers according to
    • Center of Internet Security
    • gpPack& PaT
    • SIM
    • LDA
    • Microsoft tools
• Security in domain networks
  • 802.1X with
    • MAC addresses
    • Certificatesi
  • MAC flooding on switches
    • Switch off hubbing mode
  • IPSEC with Kerberos and certificates
• Windows Defender Advanced Threat Protection ( WDATP )
  • Understanding the concept of WDATP
  • Roll out and monitor WDATP
  • WDATP on domain controllers…
  • WDATP on Jump Servers and PAWs
  • WDATP on Windows 10 clients

Training environment

The training environment works entirely with Hyper-V. For the proactive setup of the training environment, we use a Powershell script with which you can create new virtual machines in seconds. The script was developed by your trainer himself and enables the training to be set up as required by the customer extremely quickly and with little effort.

Hardware

Each participant is provided with a dedicated server in a data center with a total of 1 Gbit connection to the Internet. Each participant server is equipped as follows:

• 128 GB RAM
• at least 20 vCores
• 2 NVME SSDs with at least 3,000 MB/s write and at least 2,000 MB/s read speed
• 1 Gbit to the Internet total bandwidth

Your trainer

The Advanced Master Class was developed by Andy Wendel and is conducted by himself and his experienced team.

Andy Wendel is a Senior Data Center and Cloud Architect and Certified Security Master Specialization Advanced Windows Security. He was and is trained by the internationally renowned security experts Paula Januszkiewicz and Sami Laiho. This certification is renewed every year. Andy Wendel has been working as an IT trainer and consultant since the late 1990s and is also a certified Microsoft Learning Consultant (MCLC). Microsoft has only awarded 56 Certified Learning Consultants worldwide.