5.1 Directory Services, Authentication, MFA & Account Management

5.1 Directory Services, Authentication, MFA & Account Management

[!IMPORTANT] Enterprise Identity Principle: Centralized identity management is the foundational pillar of enterprise cybersecurity. Technicians must never treat authentication as merely entering a password; it is part of an integrated framework encompassing directory services, multi-factor verification, granular authorization, and strict human identity validation.

In modern enterprise IT environments, managing access to workstations, cloud applications, file shares, and network infrastructure requires scalable, centralized directory services. When a user logs in, accesses an internal database, or calls the support desk for a password reset, technicians interact with the core identity infrastructure that governs security across the entire organization.

---

Directory Services: Centralized Authentication vs. Local Machine Accounts

To understand why enterprise directory services exist, consider how standalone operating systems manage credentials:

Standalone Local Accounts: The Security Accounts Manager (SAM)

On an unmanaged Windows workstation, local user accounts are stored in the Security Accounts Manager (SAM) database located at C:\Windows\System32\config\SAM.

• Scalability Breakdown: If an organization has 500 workstations and 500 employees, creating a local account for each employee on every machine requires managing $500 \times 500 = 250,000$ individual credentials.
• Security Vulnerability: If an employee leaves the company, an administrator must physically or remotely touch all 500 machines to delete that user's local account. Passwords cannot be synchronized, and security policies cannot be enforced globally.

Active Directory Domain Services (AD DS)

Active Directory Domain Services (AD DS) is Microsoft's centralized, hierarchical directory service built upon the X.500 standard, Lightweight Directory Access Protocol (LDAP over TCP 389, LDAPS over TCP 636), and Kerberos v5 authentication (TCP/UDP 88). In an AD DS environment, identity information is stored on specialized Windows Servers designated as Domain Controllers (DCs).

+-----------------------------------------------------------------------------------+
|                      ACTIVE DIRECTORY LOGICAL HIERARCHY                           |
+-----------------------------------------------------------------------------------+
|  [FOREST]  --> The ultimate security boundary; contains one or more domain trees.  |
|     │                                                                             |
|  [DOMAIN]  --> Administrative boundary; shares a common database and security      |
|     │          policies (e.g., corp.contoso.com).                                 |
|  [ OU ]    --> Organizational Unit; container used to organize objects and apply |
|     │          Group Policy Objects (GPOs) or delegate admin rights.              |
|  [OBJECT]  --> Leaf objects: Users, Computer Accounts, Security Groups, Printers.|
+-----------------------------------------------------------------------------------+

• Forest: The top-most logical container and ultimate security boundary in an Active Directory deployment. All domains within a forest share a single common schema (the blueprint of object types and attributes) and a Global Catalog.
• Domain: A logical group of network objects (computers, users, devices) that share the same Active Directory database, security policies, and trust relationships.
• Organizational Units (OUs): Logical administrative containers within a domain. Administrators create OUs to mirror corporate departments (e.g., Finance, Engineering, Human Resources) or physical branch offices (e.g., Chicago_Branch, Dallas_HQ). OUs are the smallest administrative units to which Group Policy Objects (GPOs) can be linked and administrative permissions can be delegated.
• Domain User Accounts vs. Computer Accounts: In Active Directory, both human users and physical/virtual workstations are first-class security principals. When a Windows PC joins a domain, a Computer Account is created in AD DS. The computer establishes a secure trust relationship with the domain controller using its own dynamically rotated machine password, allowing any authorized domain user to log into that machine.

Security Groups vs. Distribution Groups

Active Directory categorizes group objects into two distinct functional types:

[!WARNING] Common Exam Trap: Never attempt to assign folder permissions or share rights to a Distribution Group. Because distribution groups lack a Security Identifier (SID), Windows access control lists cannot evaluate them. If resource access is required, a Security Group must be created.

---

Cloud Identity and Hybrid Architectures: Microsoft Entra ID

As enterprise workloads migrate to the cloud and Software-as-a-Service (SaaS) platforms, traditional on-premises AD DS has expanded to include cloud-native identity services.

Microsoft Entra ID (Formerly Azure Active Directory)

Microsoft Entra ID is a cloud-based Identity and Access Management (IAM) service. Unlike traditional AD DS, Entra ID does not use Kerberos, NTLM, or LDAP. Instead, it relies on modern, RESTful web authentication and authorization protocols:

• OAuth 2.0: Authorization framework for granting third-party applications scoped access to APIs.
• OpenID Connect (OIDC): Identity layer built on top of OAuth 2.0 for user authentication.
• Security Assertion Markup Language (SAML 2.0): XML-based standard for exchanging authentication data between an Identity Provider (IdP) and a Service Provider (SP).

Hybrid Identity and Entra Connect Sync

Most large organizations operate in a hybrid identity model. On-premises Active Directory remains the authoritative source for internal employee accounts, while Microsoft Entra Connect (formerly Azure AD Connect) runs on an internal server to synchronize on-premises user accounts, security groups, and password hashes up to Entra ID in the Microsoft Cloud.

Synchronization modes include:

1. Password Hash Synchronization (PHS): A cryptographic hash of the user's already-hashed on-premises password is synchronized to Entra ID. Users log in with the exact same password whether accessing an on-premises workstation or cloud services.
2. Pass-through Authentication (PTA): Password validation requests are brokered directly back to on-premises domain controllers via lightweight outbound agents.

Single Sign-On (SSO)

Single Sign-On (SSO) enables a user to authenticate once with a single set of enterprise credentials and subsequently gain access to multiple independent applications—such as Microsoft 365, ServiceNow, Salesforce, and internal intranet portals—without being prompted to re-enter credentials. SSO improves productivity and eliminates "password fatigue," preventing users from writing passwords on sticky notes.

---

The AAA Security Framework

The AAA Framework is the universal model for managing network access and resource control:

+-----------------------------------------------------------------------------------+
|                             THE AAA FRAMEWORK                                     |
+-----------------------------------------------------------------------------------+
| 1. AUTHENTICATION | "Who are you?"  --> Proving identity with credentials,         |
|                   |                     MFA tokens, or biometric attributes.       |
| 2. AUTHORIZATION  | "What can you   --> Determining specific permissions, ACL      |
|                   |  do?"               rights, and role privileges.               |
| 3. ACCOUNTING     | "What did you   --> Tracking, logging, and auditing user      |
|                   |  do & when?"        actions and access timestamps.             |
+-----------------------------------------------------------------------------------+

• Authentication (AuthN): The process of verifying the identity of a user, device, or system. The entity presents a claim of identity (e.g., username) and provides proof (e.g., password, smart card, fingerprint).
• Authorization (AuthZ): Once authenticated, the system evaluates what resources the user is permitted to access and what actions they can perform (e.g., Read, Modify, Full Control). Authorization is governed by Access Control Lists (ACLs) and Role-Based Access Control (RBAC).
• Accounting / Auditing: The continuous recording of user activities, session durations, accessed resources, and security events. On Windows systems, accounting data is recorded in the Event Viewer Security Log:
  • Event ID 4624: Successful account logon.
  • Event ID 4625: Failed account logon attempt.
  • Event ID 4740: User account locked out due to excessive failed attempts.

---

Account Security and Enterprise Password Policies

Organizations enforce account security policies across the domain via Group Policy Objects (specifically, the Default Domain Policy). These parameters safeguard systems against credential stuffing, automated dictionary attacks, and brute-force cracking.

Core Password Policy Attributes

• Password Complexity: Requires passwords to contain at least three of the following four character categories: uppercase letters (A–Z), lowercase letters (a–z), base-10 digits (0–9), and non-alphanumeric special characters (!, @, #, $, %, etc.). It also prevents passwords from containing the user's account name or display name.
• Minimum Password Length: Specifies the minimum number of characters required (typically 12 to 16+ characters in modern enterprise standards; NIST SP 800-63 guidelines emphasize length and passphrases over complex symbol combinations).
• Password History: Enforces password uniqueness by remembering the last $N$ passwords used (e.g., 24 passwords), preventing users from toggling between two familiar passwords.
• Maximum Password Age: Establishes how long a password remains valid before expiring (commonly 60 to 90 days, though modern guidelines favor no expiration unless a compromise is suspected).
• Minimum Password Age: Establishes the minimum amount of time (e.g., 1 or 2 days) that must elapse before a user can change their password again. This prevents a user from resetting their password 24 consecutive times in five minutes to circumvent the password history requirement and reuse their favorite password.

Account Lockout Mechanics and ADUC Unlocking

To prevent automated brute-force tools from guessing passwords over the network, domain policies enforce Account Lockout:

• Account Lockout Threshold: The maximum number of consecutive invalid password attempts permitted (typically 3 to 5 attempts) before the account is automatically locked.
• Account Lockout Duration: The number of minutes an account remains locked out before automatically resetting (e.g., 30 minutes), or requiring manual administrative intervention.
• Reset Account Lockout Counter After: The time window (e.g., 15 to 30 minutes) that must pass without failed attempts before the counter resets to zero.

Step-by-Step: Unlocking a Locked Account in ADUC

When an employee is locked out, Tier 1 support technicians perform an account unlock:

1. Launch Active Directory Users and Computers (dsa.msc).
2. Navigate through the domain tree to the user's specific Organizational Unit (OU), or use the Find tool (Ctrl + F).
3. Right-click the target user account and select Properties.
4. Click the Account tab.
5. Locate the checkbox labeled: "Unlock account. This account is currently locked out in this Active Directory Domain Controller."
6. Check the box and click Apply, then OK.

# Alternative: Unlocking via PowerShell ActiveDirectory Module
Unlock-ADAccount -Identity "jdoe"

---

Multi-Factor Authentication (MFA): Factors & Threat Modeling

Multi-Factor Authentication (MFA) requires a claimant to provide two or more distinct authentication factors before gaining access. Combining two items from the same category (e.g., entering a password and an ATM PIN) is not MFA; it is multi-step single-factor authentication because both rely on "something you know."

The Core Authentication Factors

+-----------------------------------------------------------------------------------+
|                           AUTHENTICATION FACTORS                                  |
+-----------------------------------------------------------------------------------+
| 1. Something You KNOW   (Knowledge)  --> Password, PIN, Passphrase.               |
| 2. Something You HAVE   (Possession) --> Smart card, FIDO2 USB key, Authenticator |
|                                          app, Hardware TOTP token.                |
| 3. Something You ARE    (Inherence)  --> Fingerprint, Facial recognition (Windows |
|                                          Hello), Retina / Iris scan.              |
| 4. Somewhere You ARE    (Location)   --> GPS coordinates, corporate IP geofence. |
+-----------------------------------------------------------------------------------+

MFA Delivery Methods Comparison

---

Help Desk Identity Verification Standards

The IT support desk is the primary front-line target for social engineering and vishing (voice phishing). Attackers routinely impersonate traveling executives, remote employees, or contractors demanding an urgent password reset or MFA token registration.

Mandatory Identity Verification Protocols

Technicians must adhere to strict corporate verification policies before performing password resets or unlocking accounts:

1. Never Rely on Caller ID: Attackers easily spoof phone numbers to appear as internal executive extensions.
2. Perform an Out-of-Band Corporate Callback: Terminate the incoming call and dial the employee back on their officially documented corporate desk extension or corporate-issued mobile phone listed in the authoritative HR directory or Active Directory.
3. Pre-Shared Verification Secrets: Challenge the caller with verified corporate data, such as their official Employee Identification Number, direct supervisor's name, or pre-registered security questions.
4. Manager Out-of-Band Confirmation: If an employee is calling from a personal phone because their corporate device is lost or inoperable, the technician must contact the employee's direct manager via corporate email or Teams to obtain explicit verbal or written authorization before resetting credentials.
5. Temporary Password Hygiene: Always set a temporary, random complex password and ensure the "User must change password at next logon" attribute is checked in ADUC.