Best Practices for Active Directory

Best Practices for Active Directory

• 
  As a security best practice, it is recommended that you do not log on to your computer with administrative credentials. When you are logged on to your computer without administrative credentials, you can use ‘Run as’ to accomplish administrative tasks. For more information, see “Why You Should Not Run Your Computer as an Administrator” and “Using Run As” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  To further secure Active Directory, you should implement the following security guidelines:
  

• 
  Rename or disable the Administrator account (and guest account) in each domain to prevent attacks on your domains. For more information, see User and Computer Accounts, in the on-screen Help and Support Center.
  
• 
  Physically secure all domain controllers in a locked room. For more information, see “Domain Controllers and Securing Active Directory” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Manage the security relationship between two forests and simplify security administration and authentication across forests. For more information, see “Forest Trusts” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  To provide additional protection for the Active Directory schema, remove all users from the Schema Admins group and add a user to the group only when schema changes need to be made. Once the change has been made, remove the user from the group.
  
• 
  Restrict user, group, and computer access to shared resources and to filter Group Policy settings. For more information, see “Security Groups” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  By default, all traffic on Active Directory administration tools is signed and encrypted while in transit on the network. Do not disable this feature. For more information, see “Managing Active Directory from MMC” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Some default user rights assigned to specific default groups may allow members of those groups to gain additional rights in the domain, including administrative rights. Therefore, your organization must equally trust all personnel that are members of the Enterprise Admins, Domain Admins, Account Operators, Server Operators, Print Operators, and Backup Operators groups. For more information about these groups, see “Default Groups” in the on-screen Help and Support Center.
  For general security information about Active Directory, see “Security Overview for Active Directory” and “Securing Active Directory” in the Windows Server 2003 on-screen Help and Support Center.
  General (lot. generalis - umumiy, bosh) - qurolli kuchlardagi harbiy unvon (daraja). Dastlab, 16-a.da Fransiyada joriy qilingan. Rossiyada 17-a.ning 2-yarmidan maʼlum. Oʻzbekiston qurolli kuchlarida G.
  
  

• 
  Establish as a site every geographic area that requires fast access to the latest directory information.
  Establishing areas that require immediate access to up-to-date Active Directory information as separate sites will provide the resources required to meet your needs. For more information, see “To Create a Site” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Place at least one domain controller in every site, and make at least one domain controller in each site a global catalog. Sites that do not have their own domain controllers and at least one global catalog are dependent on other sites for directory information and are less efficient. For more information, see “To Enable or Disable a Global Catalog” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Leave all site links bridged and leave site link connection schedules unrestricted. Bridging all site links maximizes replication links between sites and prevents the need to create site link bridges manually. Leaving site link connection schedules unrestricted eliminates connection-scheduling conflicts that might prevent replication. By default, all site links are bridged, and site link connection schedules are unrestricted. For more information, see “To Enable or Disable Site Link Bridges” and “To Configure Site Link Connection Availability” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Establish a preferred bridgehead server if you are using a firewall or if you want to dedicate a computer to intersite replication. A bridgehead server serves as a proxy for communications with other sites outside of a firewall. All sites must be associated with at least one subnet and in at least one site link, or they will not be usable. For more information, see “To Associate a Subnet with a Site” and “To Add a Site to a Site Link” in the Windows Server 2003 on-screen Help and Support Center.
  
• 
  Perform regular backups of domain controllers in order to preserve all trust relationships within that domain. For more information, see “Domain Controllers” in the Windows Server 2003 on-screen Help and Support Center.