Active Directory Administration Cookbook

How it works...

Using Authentication Policies and Authentication Policy Silos is a perfect way to set the scene for Microsoft's Privileged Access Workstation strategy to prevent people from signing in with their privileged account to devices other than their secure ones. This way, lateral movement toward admin (cached) credentials is hugely limited, benefiting the overall security posture of the organization.

Authentication Policies define policies, but do not assign these policies to accounts. Authentication Policy Silos assign policies to accounts. An Authentication Policy can be assigned through many Authentication Policy Silos, as the policies need to be the same, but for different audiences of accounts.

When a person tries to log on ...