درباره دوره
دوره مایکروسافت اکتیو دایرکتوری پیشرفته | Active Directory – Part 3 (Hardening) برای افرادی طراحی شده که سطوح مقدماتی و پیشرفته Active Directory رو پشت سر گذاشتن و حالا می‌خوان امنیت و Hardening محیط AD رو به‌صورت عملی یاد بگیرن. توی این دوره شرکت‌کنندگان با نصب و پیکربندی Domain Controllerها، مدیریت Replication، طراحی Trust بین دامنه‌ها، مدیریت Functional Levelها و Partitionها و امن‌سازی سرورها و کلاینت‌ها آشنا می‌شن.
تمام آموزش‌ها مبتنی بر سناریوهای واقعی و محیط Enterprise طراحی شده تا شرکت‌کنندگان تجربه عملی تحلیل تهدیدات، مدیریت Policyها، کنترل دسترسی‌ها و Troubleshooting شبکه‌های سازمانی رو کسب کنن. این دوره مهارت لازم برای اداره حرفه‌ای Active Directory و حفاظت از داده‌ها و سرویس‌های حیاتی سازمان‌ها رو فراهم می‌کنه.
سرفصل‌ها
Review Concepts and Preparing Domain Environment
- Advanced deployment of enterprise identity engines on high-performance,
command-line-driven operating system baselines.
- Provisioning secure domain-joined member servers and deploying multitier corporate Certificate Authority (CA) infrastructures.
- Constructing non-domain stand-alone security bastions and hardening their
underlying structural configurations.
- Engineering high-security administrative terminals, workstation hardening,
and specialized endpoint configuration profiles.
Authentication and Security Protocols
- Cryptographic breakdown of security ticket transactions, token generation,
and the core authentication handshake within the domain.
- Enforcing secure resource delegation constraints, protocol transitions, and
identity impersonation controls.
- Auditing legacy fallback authentication channels, managing risks, and
implementing absolute protocol deactivation policies.
- Principles of defining Service Principal Names (SPNs), detecting
misconfigurations, and mitigating service targeting attacks.
- Deploying automated, system-managed service accounts and groupmanaged account architectures to eliminate static passwords.
- Low-level evaluation of directory data structure access controls, security
descriptors, and system access checking loops.
- Comprehensive auditing of complex Directory Access Control Lists (DACLs)
and executing automated permission chain analysis.
- Implementing transport-layer encryption, forcing secure LDAP
communication channels, and certificate mapping policies.
Protected High Privileged Identity in Active Directory
- Engineering a modern tier-based administrative access model to partition
high-value credentials from internet-facing assets.
- Architectural design and operational guidelines for utilizing highly isolated,
dedicated Privileged Access Workstations (PAW).
- Establishing rigid identity separation rules, tracking administrative actions,
and enforcing dual-account usage standards.
- Harnessing protected account classifications, tracking restriction
enforcement, and monitoring high-privilege group wrappers.
- Investigating automated background protection templates, custom
permissions enforcement, and safeguarding default administrative accounts.
- Enhancing protocol security handling for high-privilege personnel and
enforcing cryptographic binding over local networks.
- Deploying virtualization-based and remote terminal isolation technologies
to secure cached user credentials from local memory theft.
Windows security baselines
- Implementing industry-standard security configuration baselines tailored
explicitly for corporate Domain Controllers.
- Enforcing standardized, tested security configuration frameworks across
organizational member servers and infrastructure nodes.
- Establishing definitive account security guidelines, structural constraints,
and complex restriction baselines for all user tiers.
- Formulating and pushing system-level endpoint security configuration lines
onto enterprise-managed client computers.
- Harnessing advanced system guard baselines to enforce hardware-isolated
runtime protections on modern corporate assets.
- Enterprise-wide centralization of native anti-malware profiles, defensive
settings, and real-time scanning baselines.
- Establishing highly resilient software updating, patching, and vulnerability
management deployment configuration baselines.
- Hardening client productivity software suites, macro execution policies, and
external data blocking security baselines.
- Utilizing advanced standalone configuration utility toolkits to capture,
analyze, compare, and inject unified security baselines.
Secure a Network Infrastructure
- Orchestrating advanced stateful host firewalls and connection security rule
distribution utilizing global policy infrastructure.
- Tailoring specialized, restrictive inbound/outbound communication rules
specifically on identity-critical domain controllers.
- Systematically pushing uniform network packet filtering and connection
constraints across corporate servers and endpoint nodes.
- Forcing packet signing compliance, encrypting intra-network traffic
channels, and completely deprecating archaic transport protocols.
- Constructing isolated logical network perimeters and designing domain
isolation frameworks based on validated cryptographic health.
Securing PowerShell in the Enterprise
- Restricting script execution pathways through absolute cryptographic code
signing requirements and explicit system execution models.
- Forcing line-by-line script language constraints to neutralize high-risk APIs
and block fileless exploitation mechanisms.
- Hardening network-based administrative remote terminals using
mandatory encrypted channels and mutual authentication layer constraints.
- Implementing declarative, role-based administration lines to delegate
scoped administrative actions via restricted shell sessions.
- Enforcing absolute application whitelist constraints over powerful scripting
consoles and terminal execution binaries.
- Implementing comprehensive execution auditing, deep script-block
logging, and utilizing central analytical pipelines to catch malicious commands.
Securing Domain Controllers Against Attack
- Enforcing contemporary hardware abstraction requirements and
cryptographic firmware verification layers on physical and virtual nodes.
- Configuring trusted, multi-stage boot processes to guarantee system files
integrity before full operating system loading.
- Harnessing physical and virtual security cryptoprocessors to bind storage
encryption keys directly to host hardware states.
- Enforcing absolute full-disk data encryption protocols across system drives
containing directory databases and logging logs.
- Utilizing virtualization-backed system hypervisors to isolate core kernel
memory fields and block unauthorized code injection.
- Deploying hardware-validated runtime initializations to protect the boot
sequence from early-stage low-level threats.
- Establishing definitive software execution boundaries and strict whitelisting
to block untrusted executables from domain environments.
Securing Active Directory Domain Service
- Eliminating vulnerable, outdated encryption primitives from active
directory protocols and deprecating insecure cipher suites.
- Mandating state-of-the-art cryptographic encryption standards for crossboundary exchanges and identity ticket generation.
- Implementing strict lifecycle security procedures for core cryptographic
account identities and analyzing high-impact domain takeover attacks.
- Auditing pre-existing legacy compatibility configurations, locating wideopen default access paths, and tightening tenant authorization rules.
- Utilizing attribute-level confidentiality flags to mask highly sensitive object
data within the shared directory database from regular inquiries.
- Tuning policy exceptions, deploying fine-grained password policies, and
engineering adaptable, context-aware password defense parameters.
- Deploying advanced localized administrator password systems, leveraging
secure attributes, and configuring automated rotating server backends.
- Mapping implicit permission chains, evaluating hidden attack paths, and
scanning the entire enterprise directory graph for structural risks.
انتخاب دوره و ثبت‌نام
در حال حاضر گزینه‌ای برای ثبت‌نام در دسترس نیست.
نظر کاربران
نظرت درباره این دوره چیه؟
برای ثبت نظر و امتیاز، وارد حساب کاربری‌ات شو.
ورود با شماره موبایل و کد پیامکی، کمتر از یک دقیقه.
ورود و ثبت نظرهنوز نظری برای این دوره ثبت نشده؛ اولین نفر باش.