The logs showed a single credentialed account had enumerated every user, group, and policy in their directory. No malware. No phishing. It walked right through the front door because no one had reviewed the directory service security in over a year.
Directory Services hold the keys to your identity infrastructure. They govern who can access systems, how authentication works, and what roles users play. When attackers compromise them, they gain the highest level of control with the quietest path in. A Directory Services Security Review is not optional. It is the firewall of record for every identity, permission, and privileged account.
A proper review starts with an inventory. Know every directory — Active Directory, Azure AD, LDAP, or any custom store — and how it connects to internal and cloud systems. Map trust relationships. Identify unmonitored service accounts. Flag legacy protocols still in use. Outdated configurations are open doors.
Next, audit permissions. Over-provisioning is the enemy. Ensure accounts follow least privilege principles. Review admin group membership. Remove stale accounts. Check for shadow admins created through delegated rights. Attackers thrive on privilege escalation paths that should not exist.
Then, analyze authentication paths. Enforce strong password policies or better yet, modern authentication like FIDO2 or certificate-based logon. Block NTLM where possible. Require MFA for every administrative action, not just login. Ensure conditional access policies are consistent and enforced.