Microsoft AZ-801: Active Directory Domain Services Security — Study Guide

By Laurynas Brazys · 7 August 2026 · #microsoft #az-801 #certification #exam-prep #study-guide

Part of the Microsoft Windows Server Hybrid Administrator Associate AZ-801 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Active Directory Domain Services (AD DS) underpins identity and access on Windows networks. Securing AD DS means controlling how credentials are created, stored, and used; constraining where privileged identities can authenticate; hardening authentication protocols; auditing high‑value actions; and ensuring reliable recovery. This section covers fine‑grained password and account policies, privileged identity protections, authentication hardening and delegation, auditing and SACLs, the Recycle Bin, LDAP signing and channel binding, AdminSDHolder behavior, backup and authoritative restores including SYSVOL recovery, and the AD tiering model.

Credential Policies and Privileged Identity Controls

Fine‑grained password policies (PSOs) allow multiple password/lockout policies in a single domain without extra domains. PSOs are msDS-PasswordSettings objects stored in CN=Password Settings Container,CN=System,<domain DN> (the msDS-PasswordSettingsContainer). A PSO applies to users and global security groups through msDS-PSOAppliesTo. When a user has multiple applicable PSOs (directly or via groups), the resultant PSO is the one with the lowest msDS-PasswordSettingsPrecedence value; if there is a tie, the PSO with the lowest GUID wins. The user’s effective PSO is stamped on msDS-ResultantPSO. Design PSOs so that lower precedence numbers map to the most restrictive policies you intend to win, and validate effective policies by reading msDS-ResultantPSO.

The Protected Users security group hardens high‑value accounts by removing legacy and risky authentication behaviors. Members:

• Cannot use NTLM, Digest, or CredSSP
• Are denied RC4 and DES for Kerberos
• Cannot be delegated via Kerberos (unconstrained or constrained)
• Receive non‑renewable TGTs with a fixed short lifetime (default 4 hours)
• Do not cache plaintext credentials or long‑term secrets on the workstation (prevents WDigest fallback and credential material lingering in LSASS) Use this group for human‑operated privileged identities and high‑risk service owners after validating app compatibility. Domain controllers must run Windows Server 2012 R2 or later to enforce these protections.

Authentication policies and authentication policy silos restrict where and how accounts can authenticate. An authentication policy can set per‑account Kerberos constraints such as TGT lifetime and permitted devices (by SPN/host FQDN). An authentication policy silo groups users, computers, and service accounts so that only allowed combinations can authenticate using Kerberos constrained by that policy. This enforces “station‑to‑admin” controls: for example, Tier 0 admins can only log on to domain controllers and designated privileged access workstations (PAWs), not to member servers or workstations. Combine with Protected Users for maximum effect. These features require Windows Server 2012 R2 DCs and KDC armoring.

AdminSDHolder and SDProp protect the ACLs of privileged identities. Members of built‑in admin groups (for example, Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Server Operators, Backup Operators, Print Operators, and others) are “protected.” SDProp runs hourly on the PDC Emulator, copying the ACL from CN=AdminSDHolder,CN=System to protected objects, and it disables ACL inheritance on them (AdminCount=1). To grant helpdesk rights over protected objects, change the ACL on AdminSDHolder—never directly on individual protected objects—or the change will be reverted. When an account is removed from all protected groups, re‑enable ACL inheritance and clear AdminCount so OU‑level ACLs and GPOs apply again.

Adopt an AD tiering model to minimize credential exposure. Tier 0 contains domain controllers, identity systems (PKI, federation, PAM), and the admin accounts that administer them. Tier 1 contains server workloads and their admins. Tier 2 contains workstations and their admins. Prevent logon across tiers, use PAWs for Tier 0/1 administration, and isolate credentials using features like Protected Users, authentication silos, Remote Credential Guard, Just‑Enough Administration (JEA), and Windows LAPS/Windows LAPS for local admin password rotation.

Authentication Hardening and Delegation

LDAP signing and channel binding defend against relay and man‑in‑the‑middle attacks. Configure domain controllers to require signing via Group Policy: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\“Domain controller: LDAP server signing requirements” = Require signing. Require client signing where feasible: “Network security: LDAP client signing requirements” = Require signing. For LDAPS, enable channel binding on DCs by setting LDAPEnforceChannelBinding under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters to 1 (Enabled, recommended) or 2 (Always). Inventory legacy devices and applications; enabling signing or channel binding can break anonymous/simple binds or old LDAP stacks. Monitor Directory Service event log: 2886 (signing not required), 2887 (unsigned simple binds summary), 2888 (signing still disabled), 2889 (client IPs performing unsigned simple binds when diagnostic logging is enabled). Stage changes in “Warn” (channel binding=1) before enforcing “Always” (2).

Kerberos delegation controls how services act on behalf of users:

• Unconstrained delegation (“Trust this computer for delegation to any service (Kerberos only)”) allows a service to receive a forwardable TGT and impersonate users to any service. This is high risk; avoid in favor of constrained models.
• Constrained delegation (KCD) (“Trust this computer for delegation to specified services only”) limits where a service can delegate (list of target SPNs). With “Use any authentication protocol,” the service can use protocol transition (S4U2Self) and then S4U2Proxy to reach the specified backends.
• Resource‑based constrained delegation (RBCD) shifts control to the resource by setting msDS-AllowedToActOnBehalfOfOtherIdentity on the target service account. The resource owner grants which front‑end principals may delegate to it, simplifying cross‑domain scenarios and minimizing attack surface. Prefer RBCD for modern designs; audit and periodically verify SPNs and delegation settings.

Auditing and Resilience

AD DS auditing must be deliberate and specific. Use Advanced Audit Policy Configuration to enable subcategories rather than legacy categories, and set “Audit: Force audit policy subcategory settings to override audit policy category settings” to ensure consistency. Recommended subcategories include Account Management, Logon/Logoff (Logon, Logoff, Special Logon), Account Logon (Kerberos Authentication Service/Service Ticket Operations), and Directory Service Changes/Access. Key event IDs:

• 4720 (A user account was created) from Account Management
• 4740 (A user account was locked out) from Account Management
• 4625 (An account failed to log on) from Logon/Logoff
• 4648 (A logon was attempted using explicit credentials) from Logon/Logoff Augment with Directory Service Changes to capture who/what/old/new values for critical attributes (events 5136/5137/5139). To audit specific changes (e.g., group membership, SPNs, ACLs), configure SACLs on targeted objects or OUs (enable Advanced Features in ADUC, open object Security > Advanced > Auditing). Add entries to audit “Write all properties” or specific properties (member, servicePrincipalName), and “Modify permissions/owner” as needed. Validate that logs reach a central SIEM and that DC Security logs have sufficient retention.

The AD DS Recycle Bin protects from accidental deletions by preserving all attributes and backlinks for deleted objects. Enable it once per forest (irreversible) via ADAC or PowerShell (Enable-ADOptionalFeature -Identity ‘Recycle Bin Feature’ -Scope ForestOrConfigurationSet -Target <forest>). After enabling, a deleted object remains in a “deleted object” state for msDS-DeletedObjectLifetime (if unset, defaults to tombstoneLifetime), during which it can be fully restored with attributes intact. After that, it becomes a recycled object and is no longer restorable with attributes, and later it is garbage‑collected. Modern forests typically default tombstoneLifetime to 180 days; older forests might be 60. Restore with ADAC, LDP, or PowerShell (Restore-ADObject), and prefer authoritative group membership recovery via Recycle Bin rather than manual re‑adds to avoid privilege drift.

Backups and authoritative restore are last‑line protections. Take frequent System State backups of each domain controller using Windows Server Backup or wbadmin (wbadmin start systemstatebackup). For object‑level rollbacks beyond Recycle Bin, perform a non‑authoritative restore of System State, then use ntdsutil to mark specific objects or OUs authoritative (bumping their version so replication re‑applies them). Understand the difference: non‑authoritative brings the DC back and then applies current replication; authoritative marks an object so the restored version overwrites newer replicas. For SYSVOL using DFS Replication (DFSR), perform non‑authoritative or authoritative recovery:

• Non‑authoritative: Stop DFSR service, set the affected member’s SYSVOL subscription to non‑authoritative (msDFSR-Options=0), start DFSR so it re‑hydrates from an upstream partner.
• Authoritative: On the chosen good DC, set the SYSVOL subscription msDFSR-Options=1 (authoritative), start DFSR, then force partners to resync (DFSRDIAG PollAD). Validate health with dfsrdiag backlog and event logs. For legacy FRS (unsupported), migrate to DFSR and avoid BurFlags procedures.

Putting It Together: Operations, Hardening Priorities, and Tiered Access

Prioritize Tier 0 first: enforce LDAP signing/channel binding, remove unconstrained delegation, move to KCD/RBCD, place privileged identities in Protected Users and attach authentication policies/silos to restrict logon endpoints, and require PAWs for Tier 0/1 admins. Establish PSOs for privileged accounts with strict lockout and rotation. Turn on advanced auditing with SACLs on Tier 0 containers. Ensure daily DC System State backups and documented authoritative restore and SYSVOL recovery runbooks. In Tier 1/2, block admin logon to lower tiers, remove local admin reuse with Windows LAPS, and monitor 4625/4740 spikes and 4648 misuse for lateral movement attempts.

Practical Problem Scenario

Adobe must secure an on‑premises AD DS forest rapidly after acquiring a subsidiary whose line‑of‑business apps rely on legacy protocols. The goals are to reduce password spraying success, stop credential relay into DCs, restrict privileged logons to PAWs, modernize delegation for a web tier, and ensure rapid recovery from accidental deletions.

1. Define PSOs and assign them to privileged groups

• Create a strict PSO (low precedence value) in msDS-PasswordSettingsContainer with short password age, high complexity, and aggressive lockout.
• Apply via msDS-PSOAppliesTo to “Domain Admins,” “Server Admins,” and a custom “Tier0‑Privs” group. Why: Fine‑grained PSOs target only high‑risk accounts without disrupting the entire domain, and precedence guarantees the strict policy wins.

2. Enforce Protected Users and authentication silos

• Add Tier 0 human admins to Protected Users.
• Create an authentication policy allowing Kerberos logon only from PAW host SPNs and DCs; link accounts and PAWs in an authentication policy silo. Why: Protected Users eliminates NTLM/RC4 and prevents delegation; silos enforce “only from PAWs,” reducing token exposure and credential theft paths.

3. Harden LDAP and monitor for breakage

• Set “Domain controller: LDAP server signing requirements” to Require; configure LDAPEnforceChannelBinding=1 initially.
• Review Directory Service events 2886–2889 to identify legacy binds; remediate apps, then set LDAPEnforceChannelBinding=2. Why: Signing and channel binding kill common relay paths to DCs while staged enforcement avoids outages.

4. Migrate delegation to RBCD for the web tier

• Convert front‑end web servers from unconstrained delegation to RBCD by adding their computer accounts to the back‑end API service account’s msDS-AllowedToActOnBehalfOfOtherIdentity.
• Remove legacy “Trust this computer for delegation to any service” flags; define service SPNs precisely. Why: RBCD lets the resource dictate who can delegate to it and limits impersonation to intended targets, shrinking lateral movement.

5. Enable advanced auditing and SACLs

• Configure Advanced Audit Policy for Account Management, Logon/Logoff, Account Logon, and Directory Service Changes.
• On Tier 0 OUs and key groups, add SACLs auditing Write on member and servicePrincipalName, and permission/owner changes.
• Forward logs to SIEM; alert on 4720, 4740, 4625, and 4648 anomalies. Why: You cannot defend what you cannot see; these events expose account creation, lockouts, failed logons, and explicit credential use patterns.

6. Turn on AD DS Recycle Bin and finalize recovery runbooks

• Enable the Recycle Bin at the forest level and document Restore-ADObject workflows.
• Standardize daily DC System State backups with Windows Server Backup, test authoritative restore via ntdsutil in a lab.
• Document DFSR SYSVOL authoritative and non‑authoritative recovery and rehearse. Why: Fast, accurate recovery deters attackers’ destructive actions and mitigates admin mistakes without privilege drift.

7. Implement the AD tiering model operationally

• Define Tier 0/1/2 assets; restrict admin logons by tier using Group Policy and authentication silos.
• Deploy PAWs for Tier 0/1, enforce Remote Credential Guard, and rotate local admin passwords with Windows LAPS. Why: Tiering ensures credential isolation and stops attacker escalation across layers, aligning daily operations with security boundaries.

← Microsoft Sentinel and Security Monitoring · All domains · Azure Arc and Hybrid Server Management →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →