Module 2: Domain Controller Hardening

This directory contains security baselines for Domain Controllers running Windows Server 2016 and above in high-security, air-gapped Active Directory environments.

Technical Hardening Controls

• REQ-DC-001 - Disable SMBv1 Requirement to disable the legacy SMBv1 protocol and its associated client-side driver to prevent remote code execution and spoofing vulnerabilities.
• REQ-DC-002 - Disable Multicast Name Resolution Requirement to disable LLMNR, NetBIOS (NBT-NS), and mDNS to prevent local name resolution spoofing and credential harvesting.
• REQ-DC-003 - Disable NTLMv1 Requirement to restrict NTLM authentication to NTLMv2 or Kerberos to protect credentials from offline brute-force cracking.
• REQ-DC-004 - Enforce LDAP Server Signing Requirement to enforce packet signing on LDAP cleartext traffic to protect directory transactions from man-in-the-middle attacks.
• REQ-DC-005 - Enforce LDAP Channel Binding Requirement to enforce LDAP Channel Binding Tokens (CBT) over secure LDAPS connections to prevent authentication relay attacks.
• REQ-DC-006 - Enable LSA Protection Requirement to configure the Local Security Authority (LSA) process to run as a Protected Process Light (PPL) to protect credential secrets from LSASS memory dumps.
• REQ-DC-007 - Disable Credential Guard Requirement to disable Windows Defender Credential Guard on Domain Controllers in accordance with Microsoft recommendations while keeping Virtualization-Based Security (VBS) enabled.
• REQ-DC-008 - Disable Print Spooler Service Requirement to stop and disable the Print Spooler service on Domain Controllers to prevent remote execution and coercive authentication attacks.
• REQ-DC-009 - Enforce SMB Message Signing Requirement to enforce SMB client and server signing to protect file transfer data and block SMB relay attacks.
• REQ-DC-010 - Restrict Kerberos Encryption Types Requirement to configure allowed Kerberos encryption types, restricting to AES128/AES256 and disabling legacy DES and RC4 to prevent Kerberoasting.
• REQ-DC-011 - Restrict Remote SAM API Access Requirement to restrict remote RPC access to the SAM database to local Administrators, preventing remote recon and user enumeration.
• REQ-DC-012 - Disable Unnecessary Services on Domain Controllers Requirement to disable unnecessary system services (such as Xbox services and other non-essential services) on Domain Controllers to minimize the attack surface.
  • REQ-DC-035 - Disable Xbox Live Auth Manager (XblAuthManager)
  • REQ-DC-036 - Disable Xbox Live Game Save (XblGameSave)
  • REQ-DC-037 - Disable ActiveX Installer (AxInstSV)
  • REQ-DC-038 - Disable Bluetooth Support Service (bthserv)
  • REQ-DC-039 - Disable Connected Devices Platform User Service (CDPUserSvc)
  • REQ-DC-040 - Disable Contact Data (PimIndexMaintenanceSvc)
  • REQ-DC-041 - Disable WAP Push Message Routing Service (dmwappushservice)
  • REQ-DC-042 - Disable Downloaded Maps Manager (MapsBroker)
  • REQ-DC-043 - Disable Geolocation Service (lfsvc)
  • REQ-DC-044 - Disable Internet Connection Sharing (ICS) (SharedAccess)
  • REQ-DC-045 - Disable Link-Layer Topology Discovery Mapper (lltdsvc)
  • REQ-DC-046 - Disable Microsoft Account Sign-in Assistant (wlidsvc)
  • REQ-DC-047 - Disable Microsoft Passport (NgcSvc)
  • REQ-DC-048 - Disable Microsoft Passport Container (NgcCtnrSvc)
  • REQ-DC-049 - Disable Network Connection Broker (NcbService)
  • REQ-DC-050 - Disable Phone Service (PhoneSvc)
  • REQ-DC-051 - Disable Printer Extensions and Notifications (PrintNotify)
  • REQ-DC-052 - Disable Program Compatibility Assistant Service (PcaSvc)
  • REQ-DC-053 - Disable Quality Windows Audio Video Experience (QWAVE)
  • REQ-DC-054 - Disable Radio Management Service (RmSvc)
  • REQ-DC-055 - Disable Sensor Data Service (SensorDataService)
  • REQ-DC-056 - Disable Sensor Monitoring Service (SensrSvc)
  • REQ-DC-057 - Disable Sensor Service (SensorService)
  • REQ-DC-058 - Disable Shell Hardware Detection (ShellHWDetection)
  • REQ-DC-059 - Disable Smart Card Device Enumeration Service (ScDeviceEnum)
  • REQ-DC-060 - Disable SSDP Discovery (SSDPSRV)
  • REQ-DC-061 - Disable Still Image Acquisition Events (WiaRpc)
  • REQ-DC-062 - Disable Sync Host (OneSyncSvc)
  • REQ-DC-063 - Disable UPnP Device Host (upnphost)
  • REQ-DC-064 - Disable User Data Access (UserDataSvc)
  • REQ-DC-065 - Disable User Data Storage (UnistoreSvc)
  • REQ-DC-066 - Disable WalletService (WalletService)
  • REQ-DC-067 - Disable Windows Audio (Audiosrv)
  • REQ-DC-068 - Disable Windows Audio Endpoint Builder (AudioEndpointBuilder)
  • REQ-DC-069 - Disable Windows Camera Frame Server (FrameServer)
  • REQ-DC-070 - Disable Windows Image Acquisition (WIA) (stisvc)
  • REQ-DC-071 - Disable Windows Insider Service (wisvc)
  • REQ-DC-072 - Disable Windows Mobile Hotspot Service (icssvc)
  • REQ-DC-073 - Disable Windows Push Notifications System Service (WpnService)
  • REQ-DC-074 - Disable Windows Push Notifications User Service (WpnUserService)
  • REQ-DC-146 - Disable WebClient Service (WebClient)
• REQ-DC-013 - Enable Kerberos Armoring Requirement to enable Kerberos Armoring (FAST) on Domain Controllers and client endpoints to encrypt pre-authentication exchanges and protect credentials from offline brute-force attacks.
• REQ-DC-014 - Restrict NTLM Requirement to audit and restrict NTLMv2 and domain-wide NTLM authentication to prevent credential relaying and force the transition to Kerberos.
• REQ-DC-015 - Migrate SYSVOL Replication to DFSR Requirement to migrate SYSVOL folder replication from legacy FRS to secure DFSR to ensure replication integrity and disable deprecated services.
• REQ-DC-016 - Harden adminSDHolder Permissions Requirement to secure the adminSDHolder object's Access Control List to prevent privilege escalation backdoors on protected accounts.
• REQ-DC-017 - Harden Microsoft DNS AD Container Permissions Requirement to secure CN=MicrosoftDNS,CN=System container permissions and block DNS service DLL hijacking (ServerLevelPluginDll).
• REQ-DC-018 - Harden Virtualization Hosts for Domain Controllers Requirement to treat virtualization hypervisors hosting Domain Controllers as Tier 0 systems, separating host hardware and enforcing VM encryption.
• REQ-DC-019 - Enforce RDP Restricted Admin Mode Requirement to configure and require RDP Restricted Admin Mode on administrative clients and servers to protect credentials in host memory.
• REQ-DC-020 - Windows Defender Antivirus Domain Controller Baseline and Exploit Guard Requirement to configure and harden Windows Defender Antivirus on Domain Controllers, enabling real-time scanning, preventing local exclusion modifications, enforcing server-compatible ASR rules (including LSASS protection), activating Tamper Protection, and sandboxing execution.
  • REQ-DC-075 - Disable Real-Time Monitoring and Behavior Monitoring Override on Domain Controllers
  • REQ-DC-076 - Configure Potentially Unwanted Applications (PUA) Protection on Domain Controllers
  • REQ-DC-077 - Prevent Local List Merging and Exclusions Configuration on Domain Controllers
  • REQ-DC-078 - Configure Auto Exclusions Configuration on Domain Controllers
  • REQ-DC-079 - Prevent MAPS Local Setting Override on Domain Controllers
  • REQ-DC-080 - Enable EDR in Block Mode on Domain Controllers
  • REQ-DC-081 - Allow Network Protection on Windows Server on Domain Controllers
  • REQ-DC-082 - Enable File Hash Computation on Domain Controllers
  • REQ-DC-083 - Configure Network Inspection System (NIS) settings on Domain Controllers
  • REQ-DC-084 - Configure OOBE Real-Time Protection and Security Intelligence on Domain Controllers
  • REQ-DC-085 - Enable Dynamic Signature Dropped Event Reporting on Domain Controllers
  • REQ-DC-086 - Disable Generic Reports on Domain Controllers
  • REQ-DC-087 - Configure Behavioral Network Brute Force Protection Aggressiveness on Domain Controllers
  • REQ-DC-088 - Configure Behavioral Network Remote Encryption Protection Aggressiveness on Domain Controllers
  • REQ-DC-089 - Configure Quick Scan and Scanning Exclusions on Domain Controllers
  • REQ-DC-090 - Configure Scheduled Scan Parameters on Domain Controllers
  • REQ-DC-091 - Configure Security Intelligence Update Schedule on Domain Controllers
  • REQ-DC-092 - Configure Attack Surface Reduction Rules on Domain Controllers
    • REQ-DC-098 - ASR: Block abuse of exploited vulnerable signed drivers on Domain Controllers
    • REQ-DC-099 - ASR: Block credential stealing from the Windows local security authority subsystem on Domain Controllers
    • REQ-DC-100 - ASR: Block execution of potentially obfuscated scripts on Domain Controllers
    • REQ-DC-101 - ASR: Block persistence through WMI event subscription on Domain Controllers
    • REQ-DC-102 - ASR: Block process creations originating from PSExec and WMI commands on Domain Controllers
    • REQ-DC-103 - ASR: Use advanced protection against ransomware on Domain Controllers
  • REQ-DC-093 - Configure Threat Severity Default Quarantine Actions on Domain Controllers
  • REQ-DC-094 - Configure Family Options UI Lockdown on Domain Controllers
  • REQ-DC-095 - Configure Tamper Protection on Domain Controllers
  • REQ-DC-096 - Configure Sandbox Execution Environment on Domain Controllers
  • REQ-DC-097 - Configure AMSI Authenticode Signature Verification on Domain Controllers
• REQ-DC-021 - Configure AppLocker Policies on Domain Controllers Requirement to configure strict AppLocker rules on Domain Controllers to prevent administrative users from executing unapproved binaries, scripts, installers, or web browsers on Tier 0 systems.
• REQ-DC-022 - Enable WDAC Driver Blocklist Requirement to configure the Windows Defender Application Control (WDAC) driver blocklist to protect kernel memory from Bring Your Own Vulnerable Driver (BYOVD) attacks.
• REQ-DC-023 - Configure User Rights Assignments for Domain Controllers Requirement to restrict local user rights assignments on Domain Controllers to prevent default operator groups (Print Operators, Server Operators, Backup Operators) from logging on locally, backing up/restoring files, or shutting down Domain Controllers.
  • REQ-DC-104 - Configure User Rights: Access this computer from the network on Domain Controllers
  • REQ-DC-105 - Configure User Rights: Act as part of the operating system on Domain Controllers
  • REQ-DC-106 - Configure User Rights: Add workstations to domain on Domain Controllers
  • REQ-DC-107 - Configure User Rights: Adjust memory quotas for a process on Domain Controllers
  • REQ-DC-108 - Configure User Rights: Allow log on locally on Domain Controllers
  • REQ-DC-109 - Configure User Rights: Allow log on through Remote Desktop Services on Domain Controllers
  • REQ-DC-110 - Configure User Rights: Back up files and directories on Domain Controllers
  • REQ-DC-111 - Configure User Rights: Bypass traverse checking on Domain Controllers
  • REQ-DC-112 - Configure User Rights: Change the system time on Domain Controllers
  • REQ-DC-113 - Configure User Rights: Create a pagefile on Domain Controllers
  • REQ-DC-114 - Configure User Rights: Create a token object on Domain Controllers
  • REQ-DC-115 - Configure User Rights: Create permanent shared objects on Domain Controllers
  • REQ-DC-116 - Configure User Rights: Debug programs on Domain Controllers
  • REQ-DC-117 - Configure User Rights: Deny access to this computer from the network on Domain Controllers
  • REQ-DC-118 - Configure User Rights: Deny log on as a batch job on Domain Controllers
  • REQ-DC-119 - Configure User Rights: Deny log on as a service on Domain Controllers
  • REQ-DC-120 - Configure User Rights: Deny log on locally on Domain Controllers
  • REQ-DC-121 - Configure User Rights: Deny log on through Remote Desktop Services on Domain Controllers
  • REQ-DC-122 - Configure User Rights: Enable computer and user accounts to be trusted for delegation on Domain Controllers
  • REQ-DC-123 - Configure User Rights: Force shutdown from a remote system on Domain Controllers
  • REQ-DC-124 - Configure User Rights: Generate security audits on Domain Controllers
  • REQ-DC-125 - Configure User Rights: Load and unload device drivers on Domain Controllers
  • REQ-DC-126 - Configure User Rights: Lock pages in memory on Domain Controllers
  • REQ-DC-127 - Configure User Rights: Log on as a batch job on Domain Controllers
  • REQ-DC-128 - Configure User Rights: Log on as a service on Domain Controllers
  • REQ-DC-129 - Configure User Rights: Manage auditing and security log on Domain Controllers
  • REQ-DC-130 - Configure User Rights: Modify firmware environment values on Domain Controllers
  • REQ-DC-131 - Configure User Rights: Profile single process on Domain Controllers
  • REQ-DC-132 - Configure User Rights: Restore files and directories on Domain Controllers
  • REQ-DC-133 - Configure User Rights: Shut down the system on Domain Controllers
  • REQ-DC-134 - Configure User Rights: Synchronize directory service data on Domain Controllers
  • REQ-DC-135 - Configure User Rights: Take ownership of files or other objects on Domain Controllers
• REQ-DC-024 - Configure dSHeuristics Requirement to audit and configure the dSHeuristics forest-wide attribute to reach maximum Level 5 security, blocking anonymous LDAP and NSPI operations, securing adminSDHolder, and enforcing KB5008383 owner implicit rights protections.
• REQ-DC-025 - Configure Security Options for Domain Controllers Requirement to configure baseline administrative template Security Options, disabling anonymous access to SAM/shares and enforcing credential policies.
• REQ-DC-026 - Configure TCP/IP and Network Parameter Hardening for Domain Controllers Requirement to configure hardened network configurations, TCP/IP MSS parameters, disabling LLTDIO/RSPNDR drivers, Peer-to-Peer, and Windows Connect Now.
  • REQ-DC-147 - Configure TCP/IP KeepAliveTime on Domain Controllers
  • REQ-DC-148 - Disable TCP/IP Router Discovery on Domain Controllers
  • REQ-DC-149 - Configure TCP Max Data Retransmissions on Domain Controllers
  • REQ-DC-150 - Disable Default IPv6 DNS Servers on Domain Controllers
  • REQ-DC-151 - Disable Link-Layer Topology Discovery Mapper I/O Driver on Domain Controllers
  • REQ-DC-152 - Disable Link-Layer Topology Discovery Responder Driver on Domain Controllers
  • REQ-DC-153 - Disable Microsoft Peer-to-Peer Networking Services on Domain Controllers
  • REQ-DC-154 - Disable Windows Connect Now Wireless Settings Configuration on Domain Controllers
  • REQ-DC-155 - Prohibit Access to Windows Connect Now Wizards on Domain Controllers
• REQ-DC-027 - Configure Telemetry, Diagnostics and Privacy Options for Domain Controllers Requirement to restrict telemetry collection, online diagnostics, advertising IDs, diagnostic tools, and cloud content integration.
• REQ-DC-028 - Configure Untrusted Font Blocking for Domain Controllers Requirement to configure the Untrusted Font Blocking mitigation on Domain Controllers to prevent kernel font parser exploits.
• REQ-DC-029 - Configure svchost.exe Mitigation Options Requirement to configure svchost.exe mitigation options on Domain Controllers and Member Servers to restrict binary loading to Microsoft-signed code and block dynamic code execution.
• REQ-DC-030 - Secure Directory Services Restore Mode (DSRM) and Recovery Parameters Requirement to secure DSRM restore mode logon behavior and recovery credentials parameters.
• REQ-DC-031 - Configure NTP Time Synchronization on the PDC Emulator Requirement to configure NTP time synchronization on the PDC Emulator to serve as a reliable time source and secure Kerberos exchanges.
• REQ-DC-032 - Enable UEFI Secure Boot Requirement to enforce hardware-rooted platform integrity checks, verifying that UEFI Secure Boot is active on Domain Controllers.
• REQ-DC-033 - Configure Secure Boot Revocations and Bootloader Updates Requirement to configure and enforce BlackLotus revocation updates and bootloader integrity verification policy variables in system firmware.
• REQ-DC-034 - Configure Windows Defender Application Control Requirement to deploy Windows Defender Application Control (WDAC) on Domain Controllers in Audit Mode to block unauthorized system-level binaries and scripts.
• REQ-DC-135 - Configure Advanced Security Audit Policies for Domain Controllers Enforces granular Windows security audit policies (including logons, group memberships, directory service modifications, and object access) to log critical threat telemetry on Domain Controllers.
  • REQ-DC-136 - Audit Policy: Advanced Audit Policy Overrides
  • REQ-DC-137 - Audit Policy: Account Logon Auditing
  • REQ-DC-138 - Audit Policy: Account Management Auditing
  • REQ-DC-139 - Audit Policy: Detailed Tracking Auditing
  • REQ-DC-140 - Audit Policy: Directory Service Access Auditing
  • REQ-DC-141 - Audit Policy: Logon and Logoff Auditing
  • REQ-DC-142 - Audit Policy: Object Access Auditing
  • REQ-DC-143 - Audit Policy: Policy Change Auditing
  • REQ-DC-144 - Audit Policy: Privilege Use Auditing
  • REQ-DC-145 - Audit Policy: System Events Auditing
• REQ-DC-156 - Configure Early Launch Antimalware (ELAM) Policy on Domain Controllers Requirement to enforce the Early Launch Antimalware (ELAM) boot-start driver initialization policy on Domain Controllers to prevent kernel-level rootkits, BYOVD exploits, and unverified driver loading at startup.
• REQ-DC-157 - UEFI Firmware Security Hardening on Domain Controllers Requirement to enforce hardware-rooted platform integrity, supervisor password protection, native UEFI mode, boot order lockdown, CPU virtualization, TPM 2.0, and out-of-band management interface hardening across physical and virtual Domain Controllers.
• REQ-DC-158 - Harden DMA and Physical Security for Domain Controllers Requirement to mitigate physical access and direct memory access threat vectors by disabling standby sleep states (S1-S3), enforcing wake passwords, blocking DMA device enumeration under lock, disabling unapproved device classes and hardware IDs, and blocking unencrypted USB write access.
• REQ-DC-159 - Disable Windows Script Host and Remap Scripting Extensions on Domain Controllers Requirement to eliminate Living-off-the-Land Binary (LOLBin) attack surfaces by disabling Windows Script Host across 64-bit and WOW6432Node hives, enforcing TrustPolicy, and remapping legacy script file extensions to Notepad.
• REQ-DC-160 - Configure Event Log Maximum File Sizes and Retention Policies on Domain Controllers Requirement to configure event log maximum file sizes and retention policies on Domain Controllers, expanding Security to 4 GB, System, Directory Service, and DNS Server to 256 MB, Application and DFS Replication to 128 MB, and Setup to 32 MB to mitigate log-flushing attacks and ensure forensic evidence preservation.