Mastering Active Directory

Authentication policies and authentication policy silos

A rule of thumb in pass-the-hash attack protection is to prevent trusted users from appearing on untrusted systems. Rebeladmin Corp. has the MS SQL farm to host its databases. When they were setting up the SQL services, engineers used service accounts. It is obvious that these SQL service accounts should be used only with SQL servers. If they appear on a receptionist's computer, something is definitely wrong. With Windows Server 2012 R2, Microsoft introduced authentication policies and policy silos that can be used to limit highly privileged accounts to highly valued systems.