M1015 Active Directory Configuration: AD Settings Ranked by the Attacks They Break

Active Directory Configuration (M1015) is the ATT&CK mitigation that decides whether one stolen credential stays one stolen credential or becomes the whole domain. ATT&CK v20 maps M1015 to 15 techniques and sub-techniques, almost all in credential access and lateral movement: forged Kerberos tickets, DCSync, Group Policy Preferences passwords, SID-History injection, forged SAML tokens and certificate abuse. This page ranks the AD settings behind M1015 by the techniques they break, shows how to roll them out without lockouts, names the gaps M1015 leaves to other mitigations, and gives the metrics that prove coverage. It is for identity engineers, AD administrators and detection teams. For the full hardening baseline see the Active Directory and Entra ID Hardening Guide; this page does not repeat it.

Key takeaways

• M1015 is a tier 0 control. Its strongest entries protect the krbtgt key, replication rights, the AD FS signing certificate and the certificate authority, each of which lets an attacker mint credentials for any account.
• Several M1015 entries are recovery actions. Resetting krbtgt twice and rotating the token-signing certificate twice are how ATT&CK says to contain golden tickets and forged SAML tokens after the fact.
• Kerberoasting is not in the v20 M1015 mapping. ATT&CK v20 maps T1558.003 to M1027 Password Policies, M1041 Encrypt Sensitive Information and M1026 Privileged Account Management, so do not count it as M1015 coverage.
• Service accounts sit at the centre. ATT&CK's own M1015 text calls for blocking interactive logon for service accounts; authentication policies can restrict a gMSA's password use to approved hosts.
• Audit mode exists, so use it. Authentication policies log would-be denials (events 305 and 306) before enforcement, which is how you avoid locking out tier 0.

What M1015 covers in ATT&CK v20

ATT&CK describes M1015 as implementing "robust Active Directory (AD) configurations using group policies to secure user accounts, control access, and minimize the attack surface". Its listed measures are: domain accounts rather than local accounts, interactive logon restrictions for service and privileged accounts, Remote Desktop limited to named accounts, dedicated administrative accounts restricted from interactive logon, and authentication silos built around groups such as Protected Users. The technique mappings then add specific settings: krbtgt resets, Group Policy Preferences clean-up, SID filtering, replication ACLs, CA hardening and legacy authentication.

Techniques M1015 mitigates, ranked

Rank is an NHI Mgmt Group judgement of impact (domain-wide versus single account) and how often the weakness is found in assessments. The "ATT&CK says" column paraphrases ATT&CK v20's per-technique text.

The table covers all 15 v20 relationships. Five of them (T1558, T1558.001, T1550.003, T1606.002 and T1649) are about minting or forging credentials, which is why rank 1 is dominated by key material rather than user settings.

The settings behind M1015

Protected Users

Microsoft documents what membership does. On the device, CredSSP and WDigest stop caching plaintext credentials, NTLM stops caching NT one-way function values, Kerberos stops creating DES or RC4 keys, and no cached verifier is created, so offline sign-in stops working. On the domain controller, members cannot use NTLM, DES or RC4 in preauthentication, or unconstrained or constrained delegation, and the TGT lifetime is fixed at 4 hours. It needs a Windows Server 2012 R2 or later domain functional level.

• Who goes in: human administrator accounts. Microsoft says never to add service or computer accounts, because their secrets are always available on the host.
• What breaks: accounts without AES keys (for example a built-in Administrator whose password predates Windows Server 2008 domains) and anything that relies on NTLM or delegation for those users. Reset migrated accounts' passwords first.
• Delegation link: because members cannot be delegated, Protected Users is the simplest way to stop privileged humans being impersonated through delegation. See the Kerberos Delegation Security Guide.

Authentication policies and silos

Silos are containers for high-privilege user, computer and service accounts; policies applied to them set a shorter, non-renewable TGT lifetime and restrict where an account may authenticate from (ms-DS-User-Allowed-To-Authenticate-From) and who may authenticate to a service running under it (ms-DS-Service-Allowed-To-Authenticate-To). Microsoft notes they can restrict a group managed service account's password use to the hosts allowed to retrieve it. User sign-in checks need Kerberos armoring.

• Audit mode: the default. Events 305 and 306 record requests that would have been denied.
• Enforced mode: events 105 (TGT denied), 106 (service ticket denied) and 101 (NTLM failure) appear under Applications and Services Logs, Microsoft, Windows, Authentication.

Service account logon restrictions

ATT&CK's M1015 text gives the example of SQL Server service accounts that should not have interactive logon. In Group Policy that means the "Deny log on locally" and "Deny log on through Remote Desktop Services" user rights for service account groups, and moving services to gMSAs so there is no human-known password. See How to convert AD service accounts to gMSA and the gMSA Guide.

krbtgt and federation signing keys

Microsoft's forest recovery guidance says to reset krbtgt twice and to wait at least 10 hours between resets, because 10 hours is the default maximum user and service ticket lifetime and the account's password history holds two values. ATT&CK adds forcing replication between resets. The same logic applies to the AD FS token-signing certificate: ATT&CK says to rotate it twice in rapid succession after suspected forgery.

Group Policy Preferences passwords

MS14-025 (May 2014) removed the ability to set passwords in preference items such as local users and groups, mapped drives, services, scheduled tasks and data sources. Microsoft states the update does not remove GPOs created before it, so old Groups.xml-style items can still sit in SYSVOL readable by any authenticated user. Finding and deleting them is an M1015 task, and any password found must be rotated. See the Group Policy Security Guide.

Rollout without lockouts

1. Inventory: list replication-right holders, accounts with SID-History, trusts and their SID filtering state, preference items holding passwords, AD CS templates allowing requester-supplied SANs, and service accounts with interactive logon rights. See How to build a service account inventory from Active Directory.
2. Remove obvious exposures: delete GPP passwords and rotate them, strip unexpected replication rights, fix vulnerable certificate templates. These rarely break anything legitimate.
3. Protected Users pilot: add two test administrators, confirm AES keys and admin workflows, then add tier 0 humans in small groups.
4. Silos in audit mode: create a tier 0 silo and policy, watch events 305 and 306 for a full admin cycle, then enforce. Roll back by switching the policy back to audit.
5. Service account restrictions: apply deny-logon rights to service account groups one application at a time, after testing the service restarts.
6. Key rotation drills: run a krbtgt rotation in a test forest, then production, on a schedule; document the AD FS double rotation for incident use.

What M1015 does not cover

• Kerberoasting (T1558.003): mapped in v20 to M1027, M1041 and M1026: long random service account passwords, AES-only encryption and least privilege. gMSAs address all three.
• ACL abuse and AdminSDHolder persistence: not named in M1015's v20 text. They are directory permission problems covered in the Active Directory ACL and Delegation Hygiene Guide.
• Credential theft from endpoints: LSASS protection and Credential Guard are endpoint controls (see T1003 OS Credential Dumping).
• The initial foothold: phishing and help desk social engineering fall to M1017 User Training and MFA.

Common failure patterns

• One krbtgt reset, or two back to back without replication: leaves forged tickets valid or breaks domain controller replication.
• Forged federation tokens treated as a password problem: in the SolarWinds SUNBURST compromise attackers used a stolen SAML token-signing certificate to sign their own tokens, so password resets alone did not remove access.
• Service accounts in Protected Users: gives no protection and can break the service.
• SID filtering disabled "temporarily" after a migration and never re-enabled, with SID-History left on migrated accounts.
• Patching MS14-025 but not cleaning SYSVOL: the old encrypted passwords stay readable.
• Sync and backup accounts with replication rights that nobody owns, which are DCSync-capable non-human identities.

Measuring coverage

Framework mapping

Practitioner checklist

• Export the domain head ACL and remove replication rights from anything that is not a DC or a named sync account.
• Rotate krbtgt twice with at least 10 hours and replication between resets, then on a schedule.
• Write and test the AD FS token-signing double rotation procedure.
• Delete Group Policy Preferences items that hold passwords and rotate those passwords.
• Remove stale SID-History and confirm SID filtering on forest and external trusts.
• Put tier 0 human admins in Protected Users, after AES and workflow testing.
• Build a tier 0 authentication silo, run it in audit mode, then enforce.
• Deny interactive and RDP logon to service accounts; move services to gMSAs.
• Audit AD CS templates for requester-supplied SANs and treat CA servers as tier 0.

Standards and references

• MITRE ATT&CK: Active Directory Configuration (M1015)
• Microsoft Learn: Protected Users security group
• Microsoft Learn: Authentication policies and authentication policy silos
• Microsoft Learn: AD Forest Recovery, resetting the krbtgt password
• Microsoft: Security Bulletin MS14-025
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Active Directory ACL and Delegation Hygiene Guide · Golden Ticket, Silver Ticket and DCSync Guide · Active Directory Security Monitoring and Event IDs Guide