Optimal Hardening of Active Directory Security

Real-world use case

You need to prove how robust your Active Directory is: here's how PurpleKnight and PingCastle helped me harden its security, beyond Microsoft's recommendations.

Applications and systems are by nature configured with defaults designed, among other things, to ensure maximum compatibility. As a result, it's crucial to understand that the Active Directory directory is exposed to risks, and securing it is a major challenge for any organization. It's essential to implement Microsoft's recommendations, supported by the PurpleKnight and PingCastle audit tools.

A significant reduction in risk

Fully implementing the Purple Knight and PingCastle controls provides extensive coverage of the most critical AD vulnerabilities. While it's not a miracle solution, it nonetheless lays the essential foundations of a modern, solid security strategy, drastically reducing exposure to common attacks.

Key points of this technical implementation:

• 185 Purple Knight indicators (IoE + IoC)
• 32 rules: Stale objects
• 78 rules: Privileged accounts
• 23 rules: Trust relationships
• 53 rules: Anomalies
• 55 ANSSI rules: compliant (levels 1 to 4)
• 26 techniques: MITRE ATT&CK covered
• 371 security controls implemented in total

Implementation methodology

Hardening a production Active Directory environment requires careful planning and project management adapted to operational constraints. Effectively applying the 371 controls without impacting users and devices can be complex. This section details the approach I successfully applied.

Discovery phase

1. Reading Microsoft AD best practices
2. Learning Microsoft AD best practices
3. Audit with Purple Knight
4. Audit with PingCastle
5. Results analysis
6. Prioritization by criticality
7. Mapping interdependencies between controls
8. Planning maintenance windows with justification

Technical implementation phase

1. Stale objects and inactive accounts: tracking the 32 PingCastle rules
2. Privileged accounts and delegations: tracking the 78 PingCastle rules
3. Trusts and inter-domain relationships: tracking the 23 PingCastle rules
4. Anomalies and advanced configurations: tracking the 53 PingCastle rules and 185 Purple Knight indicators.

Validation phase

1. Regression testing across all services
2. Functional validation of business applications
3. Final compliance audit with both tools
4. Documentation of operational procedures

Purple Knight

185 Security Indicators

Purple Knight, developed by Semperis, performs a full scan of the AD environment looking for Indicators of Exposure (IoE) and Indicators of Compromise (IoC). The tool offers about 185 security controls split into several categories, available at the following link.

Here's our score as of August 8, 2025 (version 5.0.2506.11001 | Community):

The Indicators of Exposure found:

Each anomaly can be fixed through standardized procedures, ensuring a gradual improvement of the security score.

PingCastle

186 Control Rules

PingCastle, originally developed by Vincent Le Toux and later acquired by Netwrix, offers a methodological approach based on a risk model with 4 main categories, with 186 detailed control rules available at the following link.

Here's our score as of August 8, 2025 (version 3.4.1.38 | Free):

Here too, these anomalies can be fixed following recommended procedures to improve the security score. A planned outage has so far been acceptable for restoring the primary DC. Deploying a second physical domain controller is needed if we want to ensure redundancy.

Conclusion

This experience shows that a rigorous, comprehensive approach to AD hardening, based on official recommendations and complementary tools, makes it possible to reach an optimal level of security while keeping directory services fully operational.