Recovering Active Directory

We learned basic concepts on implementing group policies and the least privilege model in the previous room. In this room, we will focus on Active Directory vulnerabilities, methods for recovering the compromised Active Directory domain controller, and preventive measures to avoid hacking attempts. We will also discuss the Active Directory red architecture to implement operating system hardening and benchmarks defined for the server environment.

The topics that we will cover in this room include:

• Immediate actions after infection
• Identifying attack patterns and how to locate an infection vector
• Basic recovery process
• Common misconfigurations by domain administrators
• Post-recovery steps

We recommend going through the Windows Hardening room to develop a solid understanding of Windows protection architecture.  

We will use Windows Server 2019, serving a compromised domain controller throughout the room. We assume that the hackers somehow got access to the domain controller on Apr 10, 2023, and now creating additional accounts, modifying group policies, and disrupting essential services of our network. The credentials to access the VM are mentioned below:

Let's begin.