ENSURING THE SECURITY OF CORPORATE USERS ACCOUNTS

Abstract

Today, the need to protect user accounts of network operating systems is beyond doubt, as unauthorized changes to them in the system can negate the operation of software and hardware tools to protect corporate information. User access rights to the corporation's information resources are established in accordance with the organization's information security policy in order to maintain the confidentiality, integrity and availability of corporate information. With this in mind, the article discusses the rules for creating users accounts for a corporate network and explores ways to ensure their security based on Windows network operating systems. The basic list of rules for creating, assigning and using credentials is defined, namely: setting the maximum restriction of administrative rights for users with administrator rights, providing users and support groups with only those rights that they need to perform their daily tasks, using the organization's domain administrator accounts only to manage domain controllers. An installation file is organized that contains a set of the most common Active Directory (AD) administration utilities. The core of this package is made up of the following utilities: Account Lockout Examiner, Netwrix Auditor, SolarWinds Permissions Analyzer, Active Directory Health Profiler, and Semperis DS Protector. Modeling of AD security diagnostics has shown that using the collected tools in a single installation file greatly simplifies the process of monitoring the AD security status and diagnosing the established user access rights. It has been established that the highest level of security for accounts of privileged users and system administrators using Active Directory is achieved starting with Windows Server 2012 R2, since this OS and later versions implement the functionality of a protected user group, which provides additional protection against compromising their credentials during the authentication procedure.