A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
I've penetrated domains with CrowdStrike, Defender for Endpoint, and Splunk all running. The SIEM caught my nmap scan. The EDR flagged Mimikatz. But neither stopped me from Kerberoasting a Domain Admin service account with a password of Sql2016! and DCSyncing the domain. Detection without prevention is just a slower compromise with better logs.
Real hardening addresses the root causes. Weak service account passwords. Excessive ACL permissions. Unnecessary trusts. Legacy protocols enabled. These are configuration problems, not malware problems. No amount of endpoint detection fixes a Domain Admin account with Welcome1 as its password.
Members of Protected Users cannot be delegated (constrained or unconstrained). Their credentials aren't cached in LSASS via NTLM. They can't authenticate with DES or RC4. TGT lifetime is capped at 4 hours instead of the default 10. This single group membership eliminates most credential theft and delegation attacks for your most sensitive accounts.
Don't dump all privileged users into Protected Users without testing. It breaks NTLM authentication entirely for members. Legacy applications that rely on NTLM will fail. Service accounts that use NTLM for backward compatibility will stop working. Test in a staging environment first. Roll out gradually. Monitor for authentication failures (Event ID 4625 with sub-status 0xC000006D).
Hardening isn't a product you buy. It's a process you maintain. Quarterly BloodHound scans. Annual password audits for service accounts. Review of every new ACL change. The organizations that get breached aren't missing tools. They're missing process. And that's a people problem, not a technology problem.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.