Mastering Active Directory - Second Edition

Authentication policies and authentication policy silos

A rule of thumb in pass-the-hash attack protection is to prevent trusted users from appearing on untrusted systems. Rebeladmin Corp. uses the MS SQL farm to host its database. During the SQL Server setup, engineers use service accounts. It is obvious that these SQL service accounts should be used only with SQL Server. If the accounts appear on a receptionist's computer, something is definitely wrong. With Windows Server 2012 R2, Microsoft introduced authentication policies and policy silos that can be used to limit the use of highly privileged accounts to only selected systems.