Chapter 1: Planning In-Depth Active Directory Security

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 R2

A layered, in-depth approach to security includes protecting the physical environment, securing administrative policies and practices, and configuring domain controllers with settings that protect them from tampering. This security-in-depth approach provides the general outline for planning Active Directory security.

Active Directory security planning begins with an analysis of the environment in which Active Directory is being deployed. The scope of the environment (intranet, extranet, and branch office) determines the methods that are required to secure the environment.

To best plan for secure operations, assess the security threats against which your Active Directory deployment must be protected, and then implement a deterrent to each threat to address potential problems before they can occur. In addition, put contingency plans in place to ensure appropriate responses to unforeseen disasters.