5 Essential Active Directory Security Fixes Every Organisation Should Implement

Charles Ndolo Mutiso · 2026-10-28

If your organisation runs Microsoft Active Directory (AD), it holds the keys to almost everything: user logins, file shares, email, servers and often VPN access. That makes it the first thing an attacker wants once they get a foothold.

The five fixes below close the gaps attackers use most often: keep admin accounts separate and off ordinary PCs, give every machine a unique local admin password with Windows LAPS, require MFA for admin and remote access, retire old protocols and weak service-account passwords, and watch, tidy and back up the directory properly.

Why Attackers Go After Active Directory

Three common attacks explain most of the advice that follows:

Password spraying: Instead of trying many passwords against one account (which triggers lockouts), the attacker tries one or two common passwords against every account. In any large enough list of users, someone has "Company2026!" or similar.

Kerberoasting: Any ordinary domain user can ask AD for a ticket to use a service, such as a SQL Server or a backup application. Part of that ticket is locked with the service account's password. The attacker takes the ticket away and guesses the password offline, at their leisure, without setting off lockouts. A short or old service-account password can fall quickly.

Ransomware spreading through AD: Once attackers hold a Domain Admin account, they can use the same tools your IT team uses, such as Group Policy, to push ransomware to every machine at once.

1. Use a Tiered Admin Model with Separate Admin Accounts

The single most important rule: Domain Admin accounts never sign in to ordinary PCs.

When an admin logs in to a laptop, traces of their credentials can be left on that machine. If the laptop is compromised, so is the domain.

What This Looks Like in Practice

  • Each IT person has a normal account for email and browsing, and a separate admin account used only for admin work.

  • Split admin rights into tiers: domain controllers and AD itself, then servers, then workstations. An account for one tier is not used on another.

  • Please keep the Domain Admins group as small as possible. Day-to-day tasks such as password resets can be delegated with narrower rights.

  • Perform AD administration from a dedicated, locked-down admin machine, not from the PC used for email.

2. Deploy Windows LAPS for Local Admin Passwords

Many networks still have the same local administrator password on every PC, set years ago in a build image. If one machine is compromised, it can then be used to access all the others.

Windows LAPS (Local Administrator Password Solution), built into Windows since the April 2023 updates, provides each computer with each computer a unique, regularly rotated local admin password stored securely in the directory.

  • Enable it through Group Policy for workstations and member servers.

  • Limit who can read the stored passwords to the people who genuinely need them.

  • Once LAPS is working, remove or disable any old shared local admin accounts.

3. Require MFA for Admin and Remote Access

Password spraying and phishing both rely on a password being enough. Multi-factor authentication stops that for the accounts that matter most.

  • Put MFA on VPN, remote desktop gateways and any remote access tools.

  • Require MFA for admin accounts, including cloud admin portals connected to your directory.

  • Remove direct remote desktop access to servers from the internet. Route it through a VPN or gateway with MFA.

Alongside MFA, a sensible password policy and account lockout settings make spraying much less effective.

4. Retire NTLMv1 and SMBv1, and fix service-account passwords.

Old Protocols

NTLMv1 and SMBv1 are decades old and have well-known weaknesses. They tend to linger because one old printer, scanner or application still uses them.

  • Audit first: turn on logging to identify what still uses NTLMv1 and SMBv1.

  • Upgrade or replace the devices and software that depend on them.

  • Then disable them through Group Policy and confirm nothing breaks.

Service Accounts

Kerberoasting becomes much harder when service-account passwords are strong and unpredictable. Therefore:

  • Give service accounts long, random passwords (for example, 25 characters or more) and change them periodically.

  • Where the application supports it, use group-managed service accounts, which let Windows manage long passwords automatically.

  • Do not put service accounts in Domain Admins just to make it work. Give them only the rights the service needs.

5. Monitor, Tidy and Back Up

Watch Privileged Groups

An attacker who gains control often adds an account to Domain Admins, Enterprise Admins or similar groups.

Set up alerts for any change to these groups so someone sees it the same day.

Clean Up Stale Accounts and Computers

Accounts belonging to leavers, old test users and computers that have not logged in for months are easy targets because nobody notices them being used.

Review them regularly, disable what is unused, and delete after a holding period.

Back Up Domain Controllers and Test Restores

  • Back up domain controllers, including system state, on a regular schedule.

  • Keep at least one copy offline or immutable so ransomware with admin rights cannot delete or encrypt it.

  • Test a restore in an isolated environment. Recovering AD under pressure is not the time to learn how.

Frequently Asked Questions

We Only Have One or Two Domain Controllers. Does Tiering Still Apply?

Yes, and it matters even more in a small network, because there is less in the way between a compromised PC and the domain.

Even simply having separate admin accounts and keeping them off everyday PCs is a big improvement.

Will Disabling NTLMv1 or SMBv1 Break Things?

It can, if something still relies on them.

That is why you audit first, fix or replace what depends on them, and then switch them off in stages.

How Often Should We Review AD Security?

Watch privileged groups continuously, review stale accounts and access regularly, and do a fuller review at least once a year or after major changes, such as a merger or a new remote access system.

Get an Independent Look at Your Active Directory

APOPS Assurance supports Active Directory, servers and virtual machines through our managed IT services, and can test your defences as part of our cybersecurity services or an IT audit.

Explore our services:

WhatsApp: +254 722 102 317

APOPS Assurance Ltd
Website: https://apopsassurance.com