Green Sys admin asking...What are the basic "must have" GPOs that you set up for every new ADDS domain?

[-]

MiniOozy5231@reddit

I’d say DISA STIGs, but honestly they are a bit overkill and if not applied with an understanding of the underlying benchmarks it can be confusing.

Reply

[-]

Basically the top 10 in the CIS Benchmarks, off the top of my head: Disable NTLMv1 Disable SMB1 Disable user ability to domain join Point and print restrictions Bitlocker LAPS Prevent delegation of admin accounts Prevent service accounts from interactive login Replace local admin account/change name UAC elevation behaviour PKI distribution for MECM/802.1x/etc. Others I can't think of at the moment, but those are big.

Reply

[-]

sysacc@reddit

A good tool to use to check the status of most of these is PingCastle

Reply

[-]

30yearCurse@reddit

owned by netwrix... there is a recipe for lots of emails and calls lol

Reply

[-]

sysacc@reddit

You can still download it without sending any information.

Reply

[-]

30yearCurse@reddit

should have tried to download first, seems interesting, their releases are timed so that you get the current data.

Reply

[-]

Pineapple-Due@reddit

This is a good list. I'd add password policy settings to enable password complexity, expiration, etc. Its been a while but I think the default settings are pretty lax.

Reply

[-]

itguy9013@reddit

Enable Credential Guard on all Endpoints. That takes care of things like NTLM on the endpoint while hardening things like LSASS.

Reply

[-]

thisguy_right_here@reddit

Sync bitlocker key to m365 too. Because if you get crowdstrike'd, you will need them.

Reply

[-]

hosalabad@reddit

MDNS AND LLMNR

Reply

[-]

ctwg@reddit

Password complexity and age

Reply

[-]

FenixSoars@reddit

Lots of recommendations against password ages these days.

Reply

[-]

ctwg@reddit

yep, ideally this question would involve mfa

Reply

[-]

kFURVqNY2BAxD2UtP2rq@reddit

If you don’t set a policy, it uses the default.

Reply

[-]

touchytypist@reddit

Just to clarify, ideally, use the modern native Windows LAPS and not legacy LAPS.

Reply

[-]

BrvtvsBvckeye@reddit

This is the way. Use the CIS benchmarks.

Reply

[-]

Open_Somewhere_9063@reddit

disable SMB1

Reply

[-]

No_Self_5190@reddit (OP)

Is it still enabled by default on Server 2022?

Reply

[-]

30yearCurse@reddit

it is not active, however you can disable it Set-SmbServerConfiguration -EnableSMB1Protocol $false -force Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Reply

[-]

thefpspower@reddit

No but if you've upgraded other servers it might still be enabled.

Reply

[-]

Oricol@reddit

You'll want a policy set to turn it off so if someone just turns it on for no reason it will get turned off.

Reply

[-]

No_Self_5190@reddit (OP)

Ah, makes sense. Thanks for clarifying.

Reply

[-]

Cheomesh@reddit

Yeah, when I.E. expired for good I had a policy forcing its uninstall *and* stopping the exe from launching for example. Just in case.

Reply

[-]

Oricol@reddit

Another resource to check is cisecurity.org. They have baseline configurations for multiple os's.

Reply

[-]

MonkeyWrench@reddit

Unless you have legacy AS400 shares…..

Reply

[-]

NeverDocument@reddit

put a server in front of it that you connect to with SMBv2 while that same server connects to the AS400 with SMBv1. Make the AS400 only reachable from that new server. AS400 goes to the legacy VLAN that you're not including in your active scans. End users aren't using SMBv1, everyone wins. YMMV

Reply

[-]

Ragepower529@reddit

Idk even some network folders need SMB1

Reply

[-]

usa_reddit@reddit

Lock down the right mouse button. Only let users use the left mouse button. You can never be too careful.

Reply

[-]

FireLucid@reddit

Heh, this was set in a lab at a place I started at. One of the first things that was reverted as it crippled the 3D modelling software.

Reply

[-]

AwalkertheITguy@reddit

One place that a friend of mine worked, this got someone almost shot. Engineering guy came in. He was likely already at the "I don't give a fk about life stage," and much of his stuff was jacked due to a new gpo. I was told he walked to his car and came back inside with his firearm. Said he demanded that the SysAdmin come down stairs. Way too much to explain here, but it got UGLY. No one got shot though. But jesus!!!

Reply

[-]

Kawasakison@reddit

Did they roll back the GPO?

Reply

[-]

CompWizrd@reddit

One of the things I've considered doing is there's an option to require a minimum drag distance to drag and drop. Would cut down on the times people move folders by accident while trying to double click.

Reply

[-]

Longjumping_Ear6405@reddit

Wait for network to startup

Reply

[-]

Kill3rT0fu@reddit

Download DISA STIG’d GPOs and apply

Reply

[-]

DenialP@reddit

Setup time in AD once, then never again: [https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/configuring-an-authoritative-time-server-with-group-policy-using/ba-p/395806](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/configuring-an-authoritative-time-server-with-group-policy-using/ba-p/395806) Only time I ever see this done is when I've done it :)

Reply

[-]

cbass377@reddit

I did something similar, but following the guide a Jorge's Quest For Knowledge. It really is set it and forget it. 4 part series, here is part 4 because it has the links to all the others [https://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-4/](https://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-4/) I just wanted to post this here to give Jorge some exposure.

Reply

[-]

DenialP@reddit

Thx - fixing time can be brutal folks, that is an informative link :) It’s important to note that some of the GP settings are ignored for hierarchy if NT5DS is set. That’ll save someone a few hours eventually. This is also a fantastic overall guide https://theitbros.com/configure-ntp-time-sync-group-policy/ and more or less what I’d consider best practice. I use a gps source of truth for time in my environment for funzies, plus it’s nice to tie the network time together

Reply

[-]

hybrid0404@reddit

[https://www.reddit.com/r/activedirectory/comments/xdiid7/ad\_resources\_sticky/](https://www.reddit.com/r/activedirectory/comments/xdiid7/ad_resources_sticky/) There is plenty of information in here about various baselines and such. Finding a security baselines is really good because they are policies you can just import to start off with versus needing to do all of that manual work yourself.

Reply

[-]

bobmonkey07@reddit

Disable fast startup

Reply

[-]

NSFW_IT_Account@reddit

why?

Reply

[-]

bobmonkey07@reddit

"Have you tried turning it off and on again?" works well because turning it all the way off, and then back on resets almost everything. Fast startup turns shut down from power off into suspend or sleep, so it doesn't clear many issues. Even taking into account the problem it was meant to solve, Fast Startup being enabled by default has been terrible because it took something most people understood, and changed it to a function that won't fix the problems it should. It changed "Shut Down" to "Not Shut Down", and has been a headache.

Reply

[-]

NSFW_IT_Account@reddit

What about restart? Does fast startup mess with that too?

Reply

[-]

Catalyst30@reddit

No, restart still works.

Reply

[-]

dirtyredog@reddit

Anytime I disable fast startup I tell the user if this doesn't fix it I'll replace the device. Never have

Reply

[-]

disgruntled_joe@reddit

This is the way, unless you like receiving lots of needless extra tickets.

Reply

[-]

Alzurana@reddit

Underrated. There's a lot of other great comments but I need to give this some love. Disabling fast startup saves you 70% of calls and you will not have to explain to everyone that the "reboot" button is better than turning it completely off and on again. Fast startup is a curse

Reply

[-]

BrilliantEffective21@reddit

it'll start so fast, it misses the CrowdStike outage updates! haha

Reply

[-]

stesha83@reddit

Look at NIST, NCSC, Cyber Essentials etc.

Reply

[-]

disposeable1200@reddit

Don't waste your time with Cyber Essentials. Look at the CIS Baselines instead, much better

Reply

[-]

stesha83@reddit

Also good, don't forget there's also Microsoft's own security baselines which are a great starting point. [Security baselines guide | Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines)

Reply

[-]

disposeable1200@reddit

Microsoft's are awful. Not only do they break core functionality, but the documentation is lacking and the changes between versions isn't clear. Would just use the CIS ones as the default, never use Microsoft's own. Broken so many things rolling it out - whereas L1 CIS doesn't break anything particularly. L2 maybe but that's not the right level for all orgs.

Reply

[-]

stesha83@reddit

Documentation for every setting is perfectly clear. You wouldn’t simply turn them on in an established environment and hope for the best without proper understanding and testing, but it kinda sounds like that’s what you did if it “broke so many things”? I actually have Purview running benchmarks for NCSC, NIST, CIS, Cyber Essentials etc. Always good to know where the overlaps and gaps are. Most of the recommendations in most of the benchmarks map to the others, they’re pretty similar. The Microsoft baselines obviously only cover Microsoft products, but they’re highly useful in that regard. CIS and everything else mentioned are broad and agnostic in nature, they’re complementary rather than competitive.

Reply

[-]

No_Self_5190@reddit (OP)

Thanks!

Reply

[-]

Key-Basil-5874@reddit

AppLocker plus whatever PingCastle tells me to do.

Reply

[-]

Cheomesh@reddit

See: STIG.

Reply

[-]

TruthSeekerWW@reddit

If you want your system to be so secure it's unusable in normal circumstances

Reply

[-]

Cheomesh@reddit

Been there...

Reply

[-]

shizakapayou@reddit

Disable user ability to join systems to the domain, and AppLocker/SRP.

Reply

[-]

disposeable1200@reddit

AppLocker is very overkill for initial setup.

Reply

[-]

thelastquesadilla@reddit

Allowing users to run whatever they want and then telling them they can't run something is very politically costly in the work environment. If you can get this policy in early, then life down the road will be much easier.

Reply

[-]

Gumbyohson@reddit

Enforce ntp to pdc and force pdc to np pools and configure standard ntp settings

Reply

[-]

UnimpeachableTaint@reddit

I gotchu, fam: https://gprivate.com/6cn93

Reply

[-]

PhillyGuitar_Dude@reddit

FWIW, in addition to what's been said, I'm in the "put everything in a separate GPO" camp.

Reply

[-]

BrilliantEffective21@reddit

book mark this page for years to come. basics keep things in nice order.

Reply

[-]

AnotherTakenUser@reddit

Get your Kerberos cryptography using the strongest ciphers you can without breaking your environment

Reply

[-]

rolfdins@reddit

https://learn.microsoft.com/en-gb/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines The Windows Security Baselines are a good place to start for baseline GPOs.

Reply

[-]