Active Directory Domain Services 2022

Microsoft Active Directory Domain Services (AD DS) has been in the industry for over 21 years now. The first Microsoft Active Directory version was released on February 17, 2000, along with Windows Server 2000. The first production Active Directory domain was redmond.corp.microsoft.com and it was upgraded from the Windows NT4 domain to the pre-release version of Active Directory 2000 on April 9, 1999. After Windows Server 2000, with each and every Microsoft Server release, a new AD DS version has been released as well.

Each and every time Microsoft releases a new version of their software, as IT engineers, we talk about it, we learn about it, and then we go ahead and try it. It's good practice to be on top of industry updates. However, simply migrating to the latest version of AD DS is not going to fix or improve anything related to corporate digital identities. Before we upgrade to a newer version, we need to identify any existing problems...

The features of AD DS 2022

AD DS's improvements are found in its forest and domain functional levels. Upgrading the operating system or adding domain controllers that run Windows Server 2022 to an existing AD infrastructure isn't going to upgrade the forest and domain functional levels automatically. We need to upgrade them manually once all older domain controllers are decommissioned. When it comes to forest and domain functional levels, there is a big difference in Windows Server 2022. Up to the Windows Server 2016 release, there have been new forest and domain functional levels. But starting from Windows Server 2019 there are NO new forest or domain functional levels.

The most recent forest and domain functional levels we can choose are still from Windows Server 2016. But what does this mean? If the improvements are bound to forest and domain functional levels, does this mean there are no new features on AD DS 2022? Yes, that's correct: there are no new AD DS...

Privileged Access Management (PAM)

Most banks have a safety deposit box service. A safety deposit box is a safe place where you're able to keep belongings that are very valuable. Once you've decided what to protect, you can place it in your safety deposit box at the bank, located in a highly secure facility. When you sign up with a banking service, the bank will provide you with a key card, PIN, or key to open your deposit box. When you need to access your box, first you need to go to the facility and prove who you are. After a successful verification process, you will be allowed to access your deposit box. This facility may have thousands of different deposit boxes with lots of valuable assets, but your key will only give you access to the box that belongs to you. But imagine if there was a master key that could open all the boxes in the entire facility. Which key would have more value to a thief? Your key or the master key that has the "privilege" to open all...

What does PAM have to do with AD DS 2022?

AD DS 2022 allows time-based group membership, which makes the process outlined above possible. This feature was first introduced with AD DS 2016. A user is added to a group with a Time-to-Live (TTL) value and, once it expires, the user is removed from the group automatically. For example, let's assume your CRM application has administrator rights assigned to the CRMAdmin security group. The users in this group only log in to the system once a month to do some maintenance. But the admin rights for the members in that group remain untouched for the remaining 29 days, 24/7. This provides enough of an opportunity for attackers to try and gain access to privileged accounts. So, if it's possible to grant access privileges for a shorter time period, isn't that more useful? Then, we can be assured that, for the majority of the days in a month, the CRM application does not run the risk of being compromised by an account in the CRMAdmin...

Windows Hello for Business

The most common way of protecting access to a system or resource is to introduce authentication and authorization processes. This is exactly what AD does as well; when a user logs in to a domain-joined device, AD first authenticates the user to see whether they're the user they claim to be. Once authentication is successful, it then checks what the user is allowed to do (authorization). For the authentication process, we use usernames and passwords. This is what all identity infrastructure attackers are after. They need some kind of username and password to get into the system. A password is a symmetric secret that is transmitted to the server every time we authenticate. When passwords appear in different systems, they can be stolen or intercepted on transmission. Back in 2004 at the RSA Security conference, Bill Gates said "People use the same password on different systems; they write them down and they just don't meet the challenge for anything...

PowerShell 7

In Windows Server 2022, we still have PowerShell version 5.1. But the future of PowerShell lies with the cross-platform PowerShell version. When we open the PowerShell console in Windows Server 2022, we can see a message saying Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows and this refer to PowerShell 7. Back in 2017, Microsoft released its first cross-platform PowerShell version, which was PowerShell Core 6.0. It is supported to run on Windows, macOS, and Linux operating systems. It was built on .NET Core 2.x. and it was the first release of PowerShell to be made under an open-source license (MIT).

On November 11, 2020, Microsoft announced the general availability of PowerShell 7. This is built on .NET 5. Most of the modules used in Windows PowerShell 5.1 already work with PowerShell 7, including Azure PowerShell and AD. PowerShell 7 can run side by side with PowerShell 5.1. In this book, I am going to use PowerShell 7...

Summary

In this chapter, we looked at the features of AD DS 2022. Even though there are no changes from AD DS 2019, we looked at Microsoft's approach to PAM and why it is more important now than ever. There are many different things to be taken care of in an AD environment, which will be explained further in later chapters. AD DS helps to protect identity infrastructures from novel adversaries, as traditional techniques and technologies are no longer valid in the face of rising threats. We also explored the improvements made to time synchronization to maintain time accuracy across an AD domain.

In the next chapter, we are going to look at designing AD infrastructures.