Robust Password Solutions for Active Directory. Derek Melber.

Transcription

1 Robust Password Solutions for Active Directory Derek Melber

2 About Your Speaker

3 About Derek Melber Derek Melber, MVP (AD and Group Policy) Online Resources ManageEngine Active Directory Blog Security Hardening Site 2017 World Tour Santiago, Buenos Aires Stockholm, Poznan, Tel Aviv Rome, Milan, Copenhagen

4 Agenda Default Password Policy Fine Grained Password Policies Password Attack Strategies Password Policies using ADSSP End user self service password reset

5 Default Password Policy

6 Default Password Policy Configured using Group Policy Default Domain Policy Linked to AD domain node

7 GPO Password Policy Q&A How many password policies can you have in a single domain?

8 GPO Password Policy Q&A Can you link a GPO containing a password policy to the Domain Controllers OU? What is the result?

9 GPO Password Policy Q&A Can you link a GPO containing a password policy to an OU containing users? What is the result?

10 GPO Password Policy Q&A Are there any options to increase the security of the password policy beyond what is in the Account Policies section of a GPO?

11 Fine Grained Password Policies

12 Fine Grained Password Policies Not configured in Group Policy Not configured by default Configured using ADSIEdit

13 Fine Grained Password Policies

14 FGPP Password Policy Q&A How many password policies can you have in a single domain?

15 FGPP Password Policy Q&A How are FGPP applied to users?

16 FGPP Password Policy Q&A Are there any options to increase the security of the password policy beyond what the FGPP wizard prompts you for?

17 Password attack strategies

18 Password attack strategies Dictionary attack Brute force attack Rainbow table attack Pass the Hash (PtH) attack Pass the Ticket (PtT) attack

19 Password Policies using ADSSP The Enforcer

20

21 Password policy enforcer interaction If user has no Password Policy Enforcer GPO based password policy OR Fine-grained password policy If user has Password Policy Enforcer GPO based password policy + Password Policy Enforcer OR Fine-grained password policy + Password Policy Enforcer (Note: More secure setting if overlap)

22 Password policy enforcer features

23 Password policy enforcer features Key features for securing passwords 4 of 4 character types Minimum password length over 15 characters Disallow 5 continuous characters from old password Dictionary import/verification Enforce the policy in GINA Show policy requirements

24 End user self service password reset

25 ADSelfService Plus Policies Defines user interaction with ADSelfService Plus Policy components need to be defined, to ensure security Self Service features for user Which users will receive policy Multifactor authentication for password manipulation Advanced configurations

26 ADSelfService Plus Policies Self Service features

27 ADSelfService Plus Policies Which users will receive policy

28 ADSelfService Plus Policies Multifactor authentication for password manipulation

29 Enrolling users into ADSelfService Plus Users need to enroll to be known by system Enrollment can be more manual for user Send only User must logon to ADSSP Enrollment can be more automated for user Send Single Sign On enabled Enrollment can be forced before using computer Forced Enrollment Single Sign On enabled

30 Enrolling Users into ADSelfService Plus

31 End user password reset Web-based, not Microsoft GUI based Allows for easier communication with user Allows for user to reset password remotely Features include Custom message Message can include URL link Administrative Tools Gina/MAC

32 End user unlock Web-based! Shows the current password policy to ensure easy password entry for end user CAPTCHA support

33 Summary Default Password Policy Fine Grained Password Policies Password Attack Strategies Password Policies using ADSSP End user self service password reset

34 Thank you! Derek Melber