Five Active Directory policies you should know

How to create a group policy?

1. Go to "Server Manager" --> "Tools" --> "Group Policy Management"

2. Right click on Group Policy Object (GPO) and create a new GPO. 

3. Right click on your newly created GPO and select edit to set a group policy

How to apply a group policy?

1.Right click where you need to apply policy on domain tree and select "Link existing GPO" to select the GPO

01. Password Policy

Password Policy is for change some attributes of domain users passwords to force users to apply good secure password to gain high security. Refer the following image to find the policy location.

There are 5 attributes under password policy.

Enforce password history – Determine the no of passwords, user account can use before it reuse its old password.

Maximum Password age – Valid period for users’ current password. User need to renew the password after exceeding this value.

Minimum Password age – Minimum days need to use password after changing it before change it again.

Password must meet complexity requirements – Password should met following requirements.

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters.

Be at least six characters in length.

Contain characters from three of the following four categories:

English uppercase characters (A through Z)

English lowercase characters (a through z)

Base 10 digits (0 through 9)

Non-alphabetic characters (for example, !, $, #, %)

Store passwords using reversible encryption - This security setting determines whether the operating system stores passwords using reversible encryption. This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes. This is same as keeping password in plain text

02. Account Lock Policy

This policy prevents malicious user access by locking the user account for period of time after particular no of attempts of unsuccessful passwords. This will prevent attempts of burst force attacks.

Account Lock Down Duration – Period of time account keep lock after unsuccessful attempts

Account lockout threshold – No times user can try password before account get lock

Reset account lockout counter after – Period of time need to reset, lock out counter to 0

03. Rename Administrator Account

This policy use to rename the local administrator accounts in domain computers. Keeping default local administrator account may vulnerable for attacks because everyone know the username.

04. Guest account statues

This policy is use to enable or disable local guest account. Accessing through a guest account will also reveal considerable amount of data about domain computer. So disabling it will increase the security level.

05. All Removable Storage classes: Deny all access

This policy will disable mounting all removable disks. This will prevent stealing sensitive data out from computer and virus attacks which come though removable disks.