New Enhancements to Microsoft Defender for Identity (MDI)

Summary

Microsoft Defender for Identity (MDI) has introduced significant enhancements aimed at improving identity security for on-premises infrastructure. With the addition of ten new Identity Security Posture Recommendations (ISPMs), organizations can better identify misconfigurations and vulnerabilities. These recommendations focus on Active Directory and Group Policy Objects, ultimately helping reduce risks and strengthen overall security posture.

Introduction

In today’s rapidly evolving digital landscape, identity security is more crucial than ever. Cyber threats continue to target organizations, exploiting weaknesses in identity management systems. Microsoft Defender for Identity is at the forefront of this battle, providing advanced tools to safeguard your on-premises infrastructure. The recent update introduces ten new recommendations designed to enhance your security posture, ensuring that your organization is better equipped to fend off potential attacks.

What’s New in MDI?

The latest enhancements to MDI include ten new recommendations integrated into Microsoft Secure Score. Each recommendation targets specific aspects of Active Directory and Group Policy Objects (GPOs), aiming to rectify misconfigurations and enhance security. Here’s a detailed look at these new posture reports:

1. Accounts with Non-Default Primary Group ID

This recommendation identifies accounts that have been assigned a non-default Primary Group ID. Non-default settings can often indicate misconfigurations that may lead to unauthorized access. More Info

2. Change Domain Controller Computer Account Old Password

It’s critical to regularly update the passwords for domain controller computer accounts. This recommendation ensures that outdated passwords are changed, minimizing the risk of credential theft. More Info

3. GPO Assigns Unprivileged Identities to Local Groups with Elevated Privileges

Organizations should be cautious about assigning unprivileged accounts to groups that have elevated permissions. This report helps identify such configurations, reducing the risk of privilege escalation. More Info

4. GPO Can Be Modified by Unprivileged Accounts

If unprivileged accounts can modify GPOs, it can lead to unauthorized changes and potential security breaches. This recommendation identifies these vulnerabilities for remediation. More Info

5. Reversible Passwords Found in GPOs

Reversible passwords can compromise security by making it easier for attackers to gain access to sensitive information. This report highlights instances where such passwords are found in GPOs. More Info

6. Built-In Active Directory Guest Account is Enabled

The built-in guest account should be disabled to prevent unauthorized access. This recommendation alerts organizations if this account is still active. More Info

7. Unsafe Permissions on the DnsAdmins Group

The DnsAdmins group requires strict permissions to safeguard DNS-related functions. This recommendation highlights any unsafe permissions that may expose the organization to risks. More Info

8. Ensure All Privileged Accounts Have the “Sensitive and Cannot Be Delegated” Flag

Privileged accounts should have the configuration flag set to prevent delegation. This report identifies accounts that lack this critical protection. More Info

9. Change Password of krbtgt Account

The krbtgt account is a vital component of Kerberos authentication. Regular password changes for this account are essential to maintaining security. This recommendation prompts organizations to perform this crucial update. More Info

10. Change Password of Built-In Domain Administrator Account

The built-in domain administrator account is a high-value target for attackers. This recommendation emphasizes the importance of regularly updating its password to prevent unauthorized access. More Info

Conclusion

The new enhancements to Microsoft Defender for Identity represent a significant step forward in the ongoing battle against cyber threats. By implementing these ten Identity Security Posture Recommendations, organizations can identify vulnerabilities and misconfigurations within their identity management systems. These proactive measures will not only help reduce risks but also strengthen overall identity security.

With these updates, MDI provides a more robust framework for protecting your on-premises infrastructure. Organizations are encouraged to review these recommendations and take action to bolster their security posture.

Emmanuel’s Cyber Security Insights