With Active Directory, Microsoft has provided administrators with a powerful directory service to organize network data and to control access to network resources from a central point. However, “powerful” by necessity also means complex, and the complexity of Active Directory has probably contributed to slowing down the rollout of Windows 2000 and 2003 servers. Initially, many organizations found simply migrating their flat NT4 domain structures into a more sophisticated Active Directory wrapping to be a significant challenge. By now, many have defined their Active Directory Forests, survived an often cumbersome deployment process, and seen their directories mature into efficient tools for centralized administration. Policies have become the levers of network management, and, as a result, Active Directory has become a repository holding extremely sensitive data.

Passwords Remain the Weakest Link in the Security Chain
Surprisingly, in most organizations, authentication is still based on passwords only, regardless of how sophisticated their use of Active Directory otherwise may be. Ideally, in a pure Windows 2000 / XP environment, Windows clients use NTLM 2 or Kerberos to protect authentication requests, which is certainly a great improvement compared to the old LM or NTLM 1 protocols. Yet, by default and for backwards compatibility, Windows clients will revert to the old, weaker protocols if required to do so by one of the nodes involved.

Although you can configure clients to refuse LM and NTLM 1 communication, this may conflict with other important services, and the gain is limited since password cracking tools such as @stake LC™ 5 (L0phtCrack™), KerbCrack and John the Ripper continue to represent serious threats. Furthermore, in modern networking environments users often depend upon being able to switch between online and offline with their laptops, which means that caching Windows domain account credentials must be allowed for practical reasons. Tools such as cacheDump enable the details about any locally cached account, which may include a recent administrator login, to be derived in a couple of minutes.

Download pdf BoKS Access Control for Desktops and Microsoft Active Directory