$ cd blue-team/

Active Directory hardening and defensive security notes, tested in a home lab.

These write-ups are being drafted. Pages marked draft are outlines, not finished research.

• AD tiering and the admin model draft
  Separating Tier 0, Tier 1 and Tier 2 admin accounts so a compromised workstation can't hand over the domain.
• Kerberos and NTLM hardening draft
  Reducing NTLM, tightening Kerberos encryption types, and finding what still depends on legacy auth.
• Windows LAPS rollout draft
  Unique, rotating local admin passwords with Windows LAPS, and who is allowed to read them.
• GPO security baselines draft
  Applying and testing a security baseline with Group Policy, and handling the exceptions.
• AD auditing and detection draft
  Audit policy that actually captures the events that matter, and what to alert on.