امن‌سازی مایکروسافت اکتیو دایرکتوری | Active Directory – Part 3 (Hardening)

  • اساتید دوره: میلاد اسحاقی

سرفصل‌ها

Review Concepts and Preparing Domain Environment
  • Advanced deployment of enterprise identity engines on high-performance,
    command-line-driven operating system baselines.
  • Provisioning secure domain-joined member servers and deploying multitier corporate Certificate Authority (CA) infrastructures.
  • Constructing non-domain stand-alone security bastions and hardening their
    underlying structural configurations.
  • Engineering high-security administrative terminals, workstation hardening,
    and specialized endpoint configuration profiles.
Authentication and Security Protocols
  • Cryptographic breakdown of security ticket transactions, token generation,
    and the core authentication handshake within the domain.
  • Enforcing secure resource delegation constraints, protocol transitions, and
    identity impersonation controls.
  • Auditing legacy fallback authentication channels, managing risks, and
    implementing absolute protocol deactivation policies.
  • Principles of defining Service Principal Names (SPNs), detecting
    misconfigurations, and mitigating service targeting attacks.
  • Deploying automated, system-managed service accounts and groupmanaged account architectures to eliminate static passwords.
  • Low-level evaluation of directory data structure access controls, security
    descriptors, and system access checking loops.
  • Comprehensive auditing of complex Directory Access Control Lists (DACLs)
    and executing automated permission chain analysis.
  • Implementing transport-layer encryption, forcing secure LDAP
    communication channels, and certificate mapping policies.
Protected High Privileged Identity in Active Directory
  • Engineering a modern tier-based administrative access model to partition
    high-value credentials from internet-facing assets.
  • Architectural design and operational guidelines for utilizing highly isolated,
    dedicated Privileged Access Workstations (PAW).
  • Establishing rigid identity separation rules, tracking administrative actions,
    and enforcing dual-account usage standards.
  • Harnessing protected account classifications, tracking restriction
    enforcement, and monitoring high-privilege group wrappers.
  • Investigating automated background protection templates, custom
    permissions enforcement, and safeguarding default administrative accounts.
  • Enhancing protocol security handling for high-privilege personnel and
    enforcing cryptographic binding over local networks.
  • Deploying virtualization-based and remote terminal isolation technologies
    to secure cached user credentials from local memory theft.
Windows security baselines
  • Implementing industry-standard security configuration baselines tailored
    explicitly for corporate Domain Controllers.
  • Enforcing standardized, tested security configuration frameworks across
    organizational member servers and infrastructure nodes.
  • Establishing definitive account security guidelines, structural constraints,
    and complex restriction baselines for all user tiers.
  • Formulating and pushing system-level endpoint security configuration lines
    onto enterprise-managed client computers.
  • Harnessing advanced system guard baselines to enforce hardware-isolated
    runtime protections on modern corporate assets.
  • Enterprise-wide centralization of native anti-malware profiles, defensive
    settings, and real-time scanning baselines.
  • Establishing highly resilient software updating, patching, and vulnerability
    management deployment configuration baselines.
  • Hardening client productivity software suites, macro execution policies, and
    external data blocking security baselines.
  • Utilizing advanced standalone configuration utility toolkits to capture,
    analyze, compare, and inject unified security baselines.
Secure a Network Infrastructure
  • Orchestrating advanced stateful host firewalls and connection security rule
    distribution utilizing global policy infrastructure.
  • Tailoring specialized, restrictive inbound/outbound communication rules
    specifically on identity-critical domain controllers.
  • Systematically pushing uniform network packet filtering and connection
    constraints across corporate servers and endpoint nodes.
  • Forcing packet signing compliance, encrypting intra-network traffic
    channels, and completely deprecating archaic transport protocols.
  • Constructing isolated logical network perimeters and designing domain
    isolation frameworks based on validated cryptographic health.
Securing PowerShell in the Enterprise
  • Restricting script execution pathways through absolute cryptographic code
    signing requirements and explicit system execution models.
  • Forcing line-by-line script language constraints to neutralize high-risk APIs
    and block fileless exploitation mechanisms.
  • Hardening network-based administrative remote terminals using
    mandatory encrypted channels and mutual authentication layer constraints.
  • Implementing declarative, role-based administration lines to delegate
    scoped administrative actions via restricted shell sessions.
  • Enforcing absolute application whitelist constraints over powerful scripting
    consoles and terminal execution binaries.
  • Implementing comprehensive execution auditing, deep script-block
    logging, and utilizing central analytical pipelines to catch malicious commands.
Securing Domain Controllers Against Attack
  • Enforcing contemporary hardware abstraction requirements and
    cryptographic firmware verification layers on physical and virtual nodes.
  • Configuring trusted, multi-stage boot processes to guarantee system files
    integrity before full operating system loading.
  • Harnessing physical and virtual security cryptoprocessors to bind storage
    encryption keys directly to host hardware states.
  • Enforcing absolute full-disk data encryption protocols across system drives
    containing directory databases and logging logs.
  • Utilizing virtualization-backed system hypervisors to isolate core kernel
    memory fields and block unauthorized code injection.
  • Deploying hardware-validated runtime initializations to protect the boot
    sequence from early-stage low-level threats.
  • Establishing definitive software execution boundaries and strict whitelisting
    to block untrusted executables from domain environments.
Securing Active Directory Domain Service
  • Eliminating vulnerable, outdated encryption primitives from active
    directory protocols and deprecating insecure cipher suites.
  • Mandating state-of-the-art cryptographic encryption standards for crossboundary exchanges and identity ticket generation.
  • Implementing strict lifecycle security procedures for core cryptographic
    account identities and analyzing high-impact domain takeover attacks.
  • Auditing pre-existing legacy compatibility configurations, locating wideopen default access paths, and tightening tenant authorization rules.
  • Utilizing attribute-level confidentiality flags to mask highly sensitive object
    data within the shared directory database from regular inquiries.
  • Tuning policy exceptions, deploying fine-grained password policies, and
    engineering adaptable, context-aware password defense parameters.
  • Deploying advanced localized administrator password systems, leveraging
    secure attributes, and configuring automated rotating server backends.
  • Mapping implicit permission chains, evaluating hidden attack paths, and
    scanning the entire enterprise directory graph for structural risks.

درباره دوره

دوره مایکروسافت اکتیو دایرکتوری پیشرفته | Active Directory – Part 3 (Hardening) برای افرادی طراحی شده که سطوح مقدماتی و پیشرفته Active Directory رو پشت سر گذاشتن و حالا می‌خوان امنیت و Hardening محیط AD رو به‌صورت عملی یاد بگیرن. توی این دوره شرکت‌کنندگان با نصب و پیکربندی Domain Controllerها، مدیریت Replication، طراحی Trust بین دامنه‌ها، مدیریت Functional Levelها و Partitionها و امن‌سازی سرورها و کلاینت‌ها آشنا می‌شن.

تمام آموزش‌ها مبتنی بر سناریوهای واقعی و محیط Enterprise طراحی شده تا شرکت‌کنندگان تجربه عملی تحلیل تهدیدات، مدیریت Policyها، کنترل دسترسی‌ها و Troubleshooting شبکه‌های سازمانی رو کسب کنن. این دوره مهارت لازم برای اداره حرفه‌ای Active Directory و حفاظت از داده‌ها و سرویس‌های حیاتی سازمان‌ها رو فراهم می‌کنه.

انتخاب دوره و ثبت‌نام

در حال حاضر گزینه‌ای برای ثبت‌نام در دسترس نیست.

از کلاس بعدی این دوره باخبر شوید

اطلاعات خود را بگذارید تا کارشناسان کندو برای کلاس بعدی با شما تماس بگیرند.

فیلد های "(اجباری)" اجباری هستند

اساتید دوره

میلاد اسحاقی 1

میلاد اسحاقی

تدریس در آموزشگاه مهندسی کندو تدریس در آموزشگاه سماتک تدریس در مجتمع فنی تهران تدریس در مرکز جهاد دانشگاهی صنعتی شریف تدریس در گروه شرکت های بهمن خودرو شاسی سازی ایران تدریس در مجتمع فرهنگی…

۳ دوره
آنلاینحضوری

Advanced active directory domain services

دوره Advanced Active Directory Domain Services به افرادی که می‌خوان دانش خودشون رو در زمینه Active…

(۲ دانشجو)
مشاهده جزئیات دوره
آنلاینحضوری

System Administrator – کارشناس شبکه

مدیر سیستم یا SysAdmin یکی از گسترده‌ترین و پرتقاضاترین موقعیت‌های شغلی در حوزه شبکه و زیرساخته.…

(۲۶ دانشجو)
از۳۰٬۸۰۰٬۰۰۰تومان