Engineering Authentication

While information lookup may not actually be needed for every identity using your directory services, authentication is a different matter. It is Active Directory’s primary function and must be provided in a reliable and secure manner. For decades, reliability and, more generally, usability were IT organizations’ primary focus, relegating security to the back seat. A series of devastating cyberattacks followed, leaving Windows and Active Directory with a bad reputation for authentication security. In this chapter, we shall mitigate authentication-related risk by careful engineering and generous use of security controls that modern Windows versions place at our disposal.