AWS Managed Microsoft AD Security: Secure Delegated Admins, Trusts and Hybrid Links

AWS Managed Microsoft AD takes domain controller patching and replication off your hands, but the delegated groups, trusts and service accounts you add still decide whether a compromise in AWS reaches your on-premises forest, or the other way round. AWS runs the domain controllers and keeps the most powerful built-in groups for itself, and you administer the directory through the Admin account and a set of AWS Delegated groups. That model removes some classic attack paths and leaves others fully in your hands: who sits in the delegated groups, which trusts exist and in which direction, which legacy protocols remain enabled, and whether domain controller security logs ever leave the directory. This guide covers the administrative model, password policies, directory security settings, LDAPS, forest trusts, AD Connector, logging and a hardening baseline. It is written for identity and cloud engineers running hybrid Active Directory on AWS. General AD hardening is covered in the Active Directory and Entra ID Hardening Guide; this page stays on the AWS managed service.

This is an independent guide from NHI Mgmt Group, based on AWS's public documentation as of November 2026. It is not sponsored or reviewed by AWS. Product features change, so confirm settings against AWS's current documentation.

Key takeaways

• Your top tier is the delegated groups. Admin and members of AWS Delegated Administrators, Group Policy Administrators and Server Administrators can take over every domain-joined workload; treat them as Tier 0.
• Turn off what the directory settings let you turn off. NTLM v1, SSL 2.0 and 3.0, TLS 1.0 and 1.1, RC4, DES and 3DES secure channel options are configurable; TLS 1.2 and AES 256 are always on.
• Trusts are the hybrid risk. Use the narrowest direction your applications need, enable selective authentication, and remember that WorkSpaces, IAM Identity Center and console access need a two-way trust.
• Encrypt LDAP. Server-side LDAPS needs a certificate from a Microsoft Enterprise CA joined to the domain on every domain controller; client-side LDAPS protects AWS applications talking to your own AD.
• Forward security logs before you need them. Domain controller security event logs reach CloudWatch Logs only after log forwarding is enabled, per Region; nothing earlier is recoverable.

How identity and access work in AWS Managed Microsoft AD

When you create the directory, AWS provisions domain controllers in two Availability Zones and creates a fixed structure. Knowing what you own and what AWS owns tells you where your controls must sit.

AWS also notes that the Default Domain Controllers Policy is not used; the AWS Managed Active Directory Policy applies in its place. Because domain controllers are managed, you do not log on to them or install agents on them, which is why log forwarding matters so much later.

Password policies

The default domain policy remembers 24 passwords, sets a maximum age of 42 days, a minimum age of 1 day, a minimum length of 7 characters, complexity on and reversible encryption off. Seven characters is short by current guidance. Five pre-created fine-grained policies, CustomerPSO-01 to CustomerPSO-05, have fixed precedence values of 10 to 50 (lower wins). You can edit their name, history, minimum length, minimum and maximum age, complexity, reversible encryption and lockout threshold, duration and reset period, and apply them to security groups.

A policy assigned directly to a user wins over group-assigned ones; otherwise the lowest precedence among the user's groups applies. Password history and minimum age are not enforced when an administrator resets a password. The AWS Delegated Fine Grained Password Policy Administrators group can modify these policies, so keep its membership small. See the Password Policy Guide (NIST-aligned).

Admin roles and privileged access

The AWS Delegated groups replace the built-in administrative groups you would use on self-managed AD. Several of them are effectively domain-wide control.

• Use named admin accounts, not Admin: put individual, separate admin accounts into the delegated groups and vault the Admin password for break-glass use.
• Separate AWS and AD control planes: IAM principals with ds:ResetUserPassword or rights to change directory settings and trusts can alter the directory from outside AD. Restrict these actions to a small platform role.
• Admin workstations: manage the directory from a hardened, domain-joined EC2 instance with the AD administration tools, reached through Systems Manager Session Manager rather than open RDP. See the Active Directory Delegation.
• Kerberos delegation: prefer resource-based constrained delegation and audit every account with delegation enabled. See the Kerberos Delegation Security Guide.

Integrations, API tokens and service accounts

Forest and external trusts

• Prerequisites: conditional forwarders before the trust, Kerberos pre-authentication on user accounts, matching trust passwords, unique NetBIOS and domain names, no single-label domains, and an outbound security group rule to your network.
• Only one trust per domain pair: changing direction means deleting and recreating the trust; plan a change window.
• Verification is partial: the console checks only the outgoing direction; verify incoming trusts with Windows tools.
• Trust direction is a blast radius decision: a two-way forest trust lets principals in each forest be granted access in the other. Keep SID filtering and selective authentication in mind on the on-premises side. See the Active Directory Trusts and SID Filtering Guide.
• Multi-Region: trust operations are global and must be done in the primary Region.

AD Connector

AD Connector is a gateway that redirects directory requests to your on-premises AD without caching directory data in AWS. It supports RADIUS-based MFA, has no transitive trust support, needs one connector per domain, cannot be shared across accounts and is not multi-VPC aware. Its service account is a non-human identity with standing access to your directory:

• Delegate, do not use Domain Admins: AWS recommends a dedicated account in a group (its example is Connectors) with delegated control over one OU: read on user and computer objects, plus create, delete and write where Seamless Domain Join or WorkSpaces need them.
• Password: 8 to 128 characters with three of four character categories; generate a long random value, store it in a vault and update the connector when you rotate it.
• Network: TCP and UDP 53, 88 and 389 from both connector subnets to your DNS servers and domain controllers, over VPN or Direct Connect.
• Kerberos: pre-authentication must be enabled; AD Connector supports AES-256, AES-128 and RC4-HMAC, so make sure AES is used and plan for RC4 removal. See the Kerberos RC4 Deprecation guide.

Other service identities

• Group managed service accounts: the AWS Delegated Managed Service Account Administrators group can create them; prefer them over user accounts with static passwords for Windows services.
• Domain join credentials: automated domain join for EC2 uses a credential with join rights. Scope it to the computers OU and keep it in AWS Secrets Manager. See the guide to retiring AD service accounts with SPNs.

Logging and detection

Logs created before forwarding is enabled are not transferred, and forwarding must be enabled in each replicated Region. The Windows event IDs above are standard Microsoft auditing events; confirm they appear in your forwarded stream. See the Active Directory Security Monitoring and Event IDs Guide.

Metrics: members of Tier 0 delegated groups (trend down, reviewed monthly); directories with log forwarding enabled in every Region (target 100 percent); legacy protocol and cipher settings enabled (target zero); trusts without selective authentication, with a justification for each; service accounts not on gMSA or a long-password PSO; Kerberos tickets issued with RC4 per week.

Hardening baseline

Directory security settings

AWS deploys these settings and manages any domain controller reboots. Settings show a status (Default, Ready to Update, Updating, Updated, Failed); a failed setting can be reverted or retried, which is your rollback path.

LDAPS and network

• Server-side LDAPS: the certificate must come from a Microsoft Enterprise CA joined to the managed domain (standalone and third-party CAs are not supported) and be installed on every domain controller. AWS's procedure duplicates the Kerberos Authentication template, grants Domain Controllers Read, Enroll and Autoenroll, and allows traffic between the CA's and directory's security groups. Allow up to 30 minutes for issuance, then test with LDP. See the LDAP Security Deep Dive Guide and the AD CS Security Guide.
• Client-side LDAPS: encrypts traffic from AWS applications such as WorkSpaces to your self-managed AD.
• Security group: restrict the directory's security group to the CIDRs of workloads that need it, rather than broad VPC or on-premises ranges.
• MFA: enable RADIUS MFA for AWS applications that authenticate against the directory. See the Amazon WorkSpaces Security guide.

Rollout order

1. Inventory delegated group members, trusts, service accounts, PSO assignments and current directory settings.
2. Enable log forwarding in every Region and baseline events for two weeks.
3. Use the baseline to find NTLMv1, RC4 and old TLS users; fix or replace them.
4. Disable legacy protocols and ciphers one group at a time; revert a failed or disruptive setting from the console.
5. Assign PSOs per tier, empty unneeded delegated groups, move routine admin work to named accounts.
6. Review trusts: reduce direction where possible, add selective authentication, document why each exists.

Small versus large: a small estate can run one directory with Admin vaulted, two named admins and log forwarding to one log group. Large estates should split directories per environment, share directories across accounts rather than trusting them where possible, feed logs to a central SIEM and run quarterly delegated group attestations.

Common misconfigurations

• Everyone in AWS Delegated Administrators: the directory has no tiering at all.
• Default 7-character policy left in place: no PSO assigned to administrators or users.
• Two-way forest trust created for convenience: when only EC2 or RDS needed a one-way trust.
• AD Connector service account in Domain Admins: a single stolen password gives full control of the on-premises domain.
• Log forwarding never enabled: investigators discover that domain controller security logs from the incident window were never collected.
• Legacy protocols left on: NTLMv1, TLS 1.0 and RC4 remain available because nobody tested the settings.

Framework mapping

Practitioner checklist

• Admin password vaulted for break-glass; named admin accounts in delegated groups.
• Tier 0 delegated groups listed, minimal and attested monthly; MS-NPRC Non-Compliant Devices group empty.
• PSOs assigned to administrators, service accounts and users; no reliance on the 7-character default.
• NTLMv1, SSL, TLS 1.0 and 1.1, RC4, DES and 3DES disabled in directory settings.
• Server-side LDAPS issued by an enterprise CA on every domain controller.
• Each trust justified, narrowest direction, selective authentication where supported.
• AD Connector service account delegated on one OU, not Domain Admins; password vaulted and rotated.
• Log forwarding enabled in every Region; alerts on delegated group and trust changes.
• IAM rights to change directory settings, trusts and passwords restricted to a platform role.

Standards and references

• AWS: What gets created with your AWS Managed Microsoft AD
• AWS: Editing directory security settings
• AWS: Understanding password policies for AWS Managed Microsoft AD
• AWS: Creating a trust relationship
• AWS: Enabling server-side LDAPS
• AWS: Enabling CloudWatch Logs log forwarding
• AWS: AD Connector prerequisites
• AWS: AD Connector

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide, Kerberos Security Guide, AWS Security Guide, Top 10 Active Directory Security Risks.