Active Directory question

Dave85 · 28 Nov 2012 at 12:52

In the middle of writing up my report for my degree and totally stumped on what this part is asking for can anyone give me a general idea of what it is I should be writing about before I waffle some unrelated rubbish

Under Design the Administrative structure its asking for statement of Administrative security practices.

Now does that sound like proactive security and reactive security for hardware or does it relate more to practices for active directory configuration side security I have read all the course materials and cannot see that exact sentence used anywhere I am truly stumped

Any help appreciated

Burnsy2023 · 28 Nov 2012 at 12:58

I think it's probably taking about change control for security purposes.

Dave85 · 28 Nov 2012 at 13:01

Thanks burnsy that gives me a direction to try look up the course material appreciated

ASE001 · 28 Nov 2012 at 13:24

Have a look at these

http://technet.microsoft.com/en-us/library/cc773318(v=ws.10).aspx

http://technet.microsoft.com/en-us/library/cc778219(v=ws.10).aspx

or download this doc

http://www.microsoft.com/en-us/download/details.aspx?id=21678

Dave85 · 28 Nov 2012 at 13:28

Thanks will have a good look at that document bud thats going to help as well thanks

Knubje · 30 Nov 2012 at 21:02

I'd consider administerative security practices when talking about Active Directory as such things as enforcing password policy, having few domain admin accounts but many admin accounts with neccessary delegated permissions for the job.
Also, keeping with best practice in terms of not having anyone in the Schema or Organisational admins group, etc.

What about security pushed out through group policy, like forcing local admin passwords on servers or evne PowerShell script execution policy. There is a whole section in AD GP dedicated to this, do you have anything specific enforced that could buy you some speil?

Thats what I think when I think of AD adminsitrators and security in a brief minute or two.

kefkef · 30 Nov 2012 at 21:52

A has been said, look at RBAC (role based access control), having groups for certain tasks such as backup, installation, AV, email where you can only do certain things required by your role rather than just an all encompassing admin type access. Also having time limited admin accounts for staff rather than letting them use their own stndard accounts (for example, I have a Kefkef account for my day to day PC, email, access to help desk software etc, but I have an -adm-Kefkef account which I have to get activated every month and added to the relevant group to allow me to work on a specific server or task. It's a ball ache but very secure)