- Tiered administration model (Tier 0/1/2)
- Protected Users group for privileged accounts
- LAPS for local admin password management
- Harden AdminSDHolder and SDProp
- Group Managed Service Accounts (gMSA)
- Restrict Kerberos delegation
- Disable NTLM authentication
- Enforce LDAP signing & channel binding
- Require SMB signing on all systems
- Disable LLMNR, NetBIOS, and WPAD
- AES Kerberos encryption, disable RC4
- Enforce LDAPS (LDAP over TLS/SSL)
- Enable BitLocker on Domain Controllers
- Advanced audit policies for AD
- Monitor and detect DCSync attacks
- Monitor Group Policy Object changes
- Detect AS-REP Roasting accounts
- Disable Print Spooler on DCs
- Restrict logon rights on DCs
- Secure SYSVOL & Group Policy deployment
- Secure DNS and prevent DNS attacks
- DC patching strategy & schema updates