Deflect AD Attacks

AD object quotas are stored in the NTDS Quotas container of the AD NC or partition as objects of the msDS-QuotaControl class. To set an AD object quota of 10 for user Joe in the Accounting domain NC, you could type the following Dsadd command:

Dsadd quota 
  -part DC=Accounting,DC=COM
  -acct Accounting\Joe
  -qlimit 10
  -desc "Quota for Joe" 

To change the tombstone quota factor for the Accounting domain NC to 25, you would type the following Dsmod command:

Dsmod
  partition DC=Accounting,DC=COM
  -qtmbstnwt 25 

To change the default object quota setting to 0 for the Accounting domain NC, you would type the following Dsmod command:

Dsmod
  partition DC=Accounting,DC=COM
  -qdefault 0 

Only DCs running Windows 2003 can enforce quotas. Quotas are enforced only on originating directory operations. They aren't enforced on replicated operations. To effectively use AD object quotas in an AD domain directory partition, all DCs in that domain must be running Windows 2003. To use AD object quotas in an AD configuration partition, all DCs in the forest must be running Windows 2003 (i.e., all domains and the forest must be at Windows 2003 functionality level 2). Realize that the availability of the AD object quota feature itself isn't related to any specific functionality level—it's available on any Windows 2003 DC. If a Windows 2003 domain that has quotas defined still has Win2K DCs, users can continue connecting to these DCs and work around the quota restrictions.

Win2K includes a very limited version of the Windows 2003 AD quota system. In Win2K, administrators can restrict how many computer accounts can be created by a particular user account. To do so, they must use the ms-DS-MachineAccountQuota attribute of the AD domain object. The restrictions don't apply to members of the Domain Admins and Account Operators groups. The ms-DS-MachineAccountQuota attribute is supported in Windows 2003 (the default value is 10). To disable the addition of computer accounts, you can set this attribute to 0.

A similar effect can be obtained by taking away the Add workstations to domain user right from the Authenticated Users group. In both Windows 2003 and Win2K, this right is given by default to the Authenticated Users group.

Playing All the Angles
The attacks outlined in this article underline the importance of taking a multipronged approach to securing an AD infrastructure. In addition to technology-focused security solutions, you must also think about physical and organizational security measures. Physical security measures include securing physical access to Windows DCs, your network infrastructure, and your organization's buildings. Organizational security measures include the creation of security policies and operational procedures, regularly performing external security audits of the AD infrastructure, and continuously training administrators and users on security risks and best practices. Securing AD is a big task that should be a high priority for a team of people in your organization that focuses on the combination of technical, physical, and organizational security.