Windows Server Homelab: Implementing Security Policies | Fine-Grained Passwords

Summary

In this sixth episode of the Windows Server home lab series, the focus is on implementing essential security policies for workplace computers. The tutorial covers setting strong password policies, enforcing password complexity, and managing account lockout policies to protect against brute force attacks. It also addresses user rights assignment for role-based access control and introduces fine-grained password policies for applying different security measures to various user groups, enhancing overall network security.

Takeaways

• 😀 This video is part of a series on setting up a Windows Server home lab, focusing on the sixth episode about security policies.
• 🔒 The video discusses implementing essential security measures to enhance security for all computers in the workplace.
• 🛡️ It covers how to set up security policies, which are configurations applied to desktops to improve their security.
• 🗝️ The video addresses a request from the audience to cover different password rules for various user types, such as admins and standard users.
• 👨‍💻 For prerequisites, viewers should have a Windows Server with active directory tools, Group Policy Management console, and a Windows client joined to the domain.
• 🔑 The script explains how to configure a strong password policy for Active Directory users, including minimum length, complexity, and age.
• 📈 It suggests that the standard for strong passwords should be at least 12 characters, exceeding the default of 8 characters in Windows Server.
• 🚫 The video also explains how to set up an account lockout policy to protect against brute force attacks, specifying the number of failed attempts before lockout and the lockout duration.
• 👥 It describes user rights assignment to enhance security by restricting user groups from performing certain tasks, such as logging in locally or using remote desktop services.
• 🔄 The script includes a step-by-step guide on testing the implemented policies to ensure they are enforced correctly.
• 🌐 Finally, the video introduces fine-grained password policies, allowing different password rules for different user groups, and how to implement them using Active Directory Administrative Center.

Q & A

What is the main focus of the sixth episode in the Windows Server home lab series?

The main focus of the sixth episode is on implementing security policies to enhance the security of computers in the workplace.

Why is security important in the workplace according to the video?

Security is important in the workplace to protect against attacks and to enforce essential security measures for all computers.

What was the request from the comment section that the video addresses?

The request from the comment section was to cover different password rules for different users, such as allowing admins to have basic passwords while enforcing strong password rules for standard users.

What are the prerequisites for creating security policies in the home lab as mentioned in the video?

The prerequisites include having a Windows Server installed with Active Directory tools, Group Policy Management console, and a Windows client for testing that is joined to the domain.

What is the minimum password length recommended in the video for strong passwords?

The video recommends a minimum password length of at least 12 characters for strong passwords, as eight characters is no longer considered strong in the digital age.

How can the default domain policy be edited in the Group Policy Management console?

To edit the default domain policy, right-click on it and select 'Edit' in the Group Policy Management console.

What is the purpose of enforcing password complexity requirements?

Enforcing password complexity requirements ensures that new passwords are not basic and meet certain criteria, such as including symbols, capital letters, or numbers, making them stronger against attacks.

What is the significance of the 'enforce password history' setting in the password policy?

The 'enforce password history' setting determines how many previous passwords the system should remember, preventing users from reusing recent passwords and enhancing security.

What is the recommended account lockout threshold and duration in the video's home lab scenario?

In the home lab scenario, the recommended account lockout threshold is three invalid logon attempts, and the lockout duration is set to 30 minutes.

How can user rights be assigned or restricted to enhance security in a role-based access system?

User rights can be assigned or restricted by configuring policies in the Group Policy Management console, such as denying standard users to log in locally or allowing specific groups to use remote desktop services.

What is the concept of applying different password policies to different user groups called in Windows Server?

The concept of applying different password policies to different user groups is called Fine-Grained Password Policies in Windows Server.

Which tool is used to implement Fine-Grained Password Policies in Windows Server?

The Active Directory Administrative Center is used to implement Fine-Grained Password Policies in Windows Server.

What is the purpose of setting precedence in Fine-Grained Password Policies?

The purpose of setting precedence is to determine the order in which password policies are applied when multiple policies are applicable to a user or group, with the lowest number having the highest priority.

How can you test if the new password policy is enforced after creating a test user account?

You can test the enforcement of the new password policy by attempting to set a weak password for the test user account and verifying that the system rejects it due to not meeting complexity requirements.

What is the process to test the account lockout policy?

The process to test the account lockout policy involves using a test user account to attempt multiple failed login attempts and verifying that the account gets locked out with a message indicating the lockout status.

Outlines

00:00

🔒 Implementing Security Policies in Windows Server Home Lab

This paragraph introduces the sixth episode of a Windows Server home lab series, focusing on security policies. The video aims to implement essential security measures for workplace computers. It addresses a request from the audience to cover different password rules for various user types, such as admins and standard users. The speaker outlines the prerequisites for the lab, including having a Windows Server with Active Directory tools, Group Policy Management console, and a Windows client joined to the domain. The first activity involves configuring a strong password policy for all Active Directory users, emphasizing the need for a minimum password length of at least 12 characters, complexity, and age. The process of creating or editing a group policy object and setting the policy parameters is detailed, including enforcing password history and complexity requirements.

05:02

🛡️ Configuring Account Lockout and User Rights Policies

The second paragraph delves into configuring an account lockout policy to protect against brute force attacks. It explains setting a threshold for password attempts and the duration of account lockout. The process involves using the Group Policy Management console to edit the default domain policy, focusing on computer configuration and security settings under account policies. The speaker also discusses user rights assignment for role-based access control, restricting certain user groups from tasks like local server login or using remote desktop services. The implementation of these policies is demonstrated through testing with a regular user account, showing the enforcement of 'deny log on locally' and 'allow log on through remote desktop services' policies.

10:02

🔑 Implementing Fine-Grained Password Policies for Different User Groups

The final paragraph introduces the concept of fine-grained password policies, allowing different password rules for different user groups within an organization. The speaker guides through the process of implementing these policies using the Active Directory Administrative Center, rather than Group Policy. The steps include creating a new password settings object (PSO) with specific settings, such as minimum password length and password history, and assigning these settings to particular groups like admins or standard users. The precedence of these policies is highlighted, with lower numbers indicating higher priority. The paragraph concludes with a demonstration of creating PSOs for both admin and regular users, setting different requirements for each group.

Keywords

💡Windows Server

Windows Server is a group of server operating systems developed by Microsoft, designed to handle network and server-related tasks. In the video, it is the platform on which security policies are being implemented and managed, serving as the foundation for the home lab series and the main theme of the video.

💡Security Policies

Security policies are a set of rules and configurations in computing that are put in place to protect the integrity and confidentiality of a system. The video focuses on implementing these policies to enhance the security of desktops in a workplace environment, emphasizing the importance of strong password rules and account lockout policies.

💡Active Directory

Active Directory is a directory service that Microsoft developed for the Windows domain networks. It provides centralized authentication, network access control, and user management. In the script, Active Directory is used to enforce security policies across the network and manage user accounts.

💡Group Policy Management Console

The Group Policy Management Console (GPMC) is a Microsoft Management Console (MMC) snap-in that provides a single location to manage Group Policy in a domain. The video script describes using the GPMC to create and edit Group Policy Objects (GPOs) to apply security configurations.

💡Password Policy

A password policy is a set of rules that govern the creation of passwords, dictating their complexity, length, and expiration. The video explains how to configure a password policy in Windows Server to enforce strong passwords for Active Directory users, including minimum length and complexity requirements.

💡Account Lockout Policy

An account lockout policy is designed to protect user accounts from brute force attacks by locking the account after a certain number of failed login attempts. The video demonstrates how to set a threshold for failed login attempts and the duration of the lockout period to secure the system.

💡User Rights Assignment

User rights assignment refers to the process of granting or denying permissions to users or groups to perform certain tasks or access specific resources. The video discusses assigning user rights in a role-based access control system to enhance security by restricting who can log in locally or use remote desktop services.

💡Remote Desktop Services

Remote Desktop Services, previously known as Terminal Services, is a feature of Windows Server that allows users to remotely access and control another computer. The video script includes a discussion on allowing or denying access to these services as part of the security policy configuration.

💡Fine-Grained Password Policies

Fine-Grained Password Policies (FGPP) are an advanced feature in Windows Server that allows administrators to apply different password policies to different groups of users. The video script describes how to implement FGPP using the Active Directory Administrative Center to meet the specific security requirements for different user groups.

💡Active Directory Administrative Center

The Active Directory Administrative Center is a Microsoft Management Console snap-in that provides a graphical user interface for managing Active Directory objects. The video script mentions using this tool to create and manage Fine-Grained Password Policies, which is a more advanced configuration than what is available in the Group Policy Management Console.

💡Precedence

In the context of the video, precedence refers to the priority order in which password settings are applied when multiple policies could affect a user or group. The script explains setting precedence numbers for different password policies to ensure that the most restrictive or relevant policy is enforced.

Highlights

Introduction to the sixth episode of the Windows Server home lab series focusing on security policies.

Importance of implementing security policies to enhance computer security in the workplace.

Request from the comment section to cover different password rules for admin and standard users.

Explanation of prerequisites needed for creating security policies, including Windows Server with active directory tools.

Demonstration of how to configure a strong password policy for Active Directory users.

Details on setting minimum password length, complexity, and age to improve security standards.

Instructions on creating or editing a Group Policy Object (GPO) for security policy application.

Process of enforcing password history and complexity requirements through Group Policy.

Testing the new password policy with a test user account to ensure policy enforcement.

Configuration of an account lockout policy to protect against brute force attacks.

Setting thresholds for password attempts and lockout durations in the Group Policy.

Testing the account lockout policy to verify its effectiveness in preventing unauthorized access.

User rights assignment to enhance security through role-based access control.

Restricting user groups from logging in locally or using remote desktop services for security.

Implementation of fine-grained password policies for different user groups using Active Directory Administrative Center.

Creating password settings objects (PSO) with different precedence for admin and standard users.

Assigning password settings to specific groups to apply different policies based on user roles.

Conclusion of the home lab series episode with a call to action for questions and feedback.

Transcripts

hello everyone welcome back to the

channel this video is a continuation of

our Windows Server home lab series and

this is the sixth episode and we are

going to be focusing on security

policies on this video so we are going

to be implementing the essential

security measures for all of our

computers in the workplace so in this

video we are going to be covering how to

implement security policies and security

policies or a set of configurations that

can be applied onto the desktops to

enhance their security and security is

very important in the workplace we also

have a request from the comment section

to cover different password rules for

different users example letting admin

making basic passwords but have strong

password rules standard users so later

on we can also make different settings

for different users just like from this

request we can set up different

parameters for it admin and different

password parameters for the users so if

you're interested in today's video

please keep on watching and without

further Ado let's get started okay so if

you're planning to follow along and

create the security policies in this

home lab you should check on the

prerequisites first and you should have

all of this first before you can do this

lab so you should have a Windows Server

installed with active directory tools

Group Policy Management console and a

Windows client for testing that is

joined to The Domain okay so for our

first activity we are going to do a

password policy configuration and we are

going to configure and enforce a strong

password for all of our active directory

users so this is really basic and we are

going to configure the minimum password

length password complexity and password

age in this activity because the default

for the minimum password in Windows

server is eight characters and that is

no longer the standard for strong

passwords it should be at least 12

characters or more to make it strong in

this digital age so we have to also

protect our users from attacks by

enforcing this security policy okay so

on the Windows Server open the group

policy Management console and then

create a new group policy object or you

can also edit the default domain policy

so for this case we are just going to

edit the default domain policy because

we want this to apply to all of the ad

users under our main so you can right

click on this and click edit and what do

we choose in here is it going to be

computer configuration or user

configuration this needs to be applied

to all the computers when a user login

so we should select computer

configuration in here and then select

policies and then window settings and

security settings and then under account

policies there are different policy but

for this situation we should be

selecting password policy policy and

this is where you can set up the

different policy for strong passwords

for ad users so first we can select

enforce password history in here this is

setting up how many password the system

should

remember and then we can also set up the

maximum password age on when the

password should expire usually we do it

every quarter at work but it also

depends on your company then we can set

up the minimum password length to create

stronger passwords so typically eight

characters is the minimum now or

sometimes there's more so it also

depends on your company and last is

password must meet complexity

requirements so this should be always

enabled to enforce strong password so

this is where systems is stricter when

taking a new password that you're going

to set up like it's not going to take a

basic password and there's different

characters that you should meet for the

p the passwords for example you should

have a symbol or capital letter or a

number so this is how you configure and

enforce a strong password policy for ad

users through the group

policy so to test if our new password

policy works we can create a test user

account and attempt to set a week

password to verify that the password

policy is enforced make sure to check

user must change password at next log on

because we want to to check if we can

change the password to meet the

complexity

rules okay so let's test the account

that you just created so now log into

the new

account okay so it's going to ask us to

change the password so let us type in

some basic passwords so we can test if

the password complexity was

enforced so I've typed in 1 2 3 4 5 6 7

in here and see if it will take it so as

you can see in here we are getting this

message now that we are not meeting the

complexity requirements so that's a good

sign that our policy was enforced so now

I'm going to type in the password that

meets all the requirements in here and

also the minimum length

required and let's see if the system

will take it and change the

password okay so our password was

changed so it means that our policy

works so that is how you can test this

so for our next activity we are going to

do the account lockout policy

configuration and we are going to

configure an account lockout policy to

protect against boot Force attacks so in

this activity we are going to set a

threshold for password how many password

attempts they have before their account

will be locked out and the duration of

the lock out like how long will they be

locked out before they can be unlocked

from their accounts so the higher the

threshold is set the higher the

probability also for a successful Brute

Force attack which gives them more

opportunities to guess the password and

be successful with the attack okay so we

can open the group policy Management

console again and we can create a new GP

or edit the default domain

policy so I'm going to edit the default

policy here I'm going to right click on

it and click on

edit so we are going to choose computer

configuration in here and then go to

policies and then select window settings

and security settings and under that

will be account policies and under

account policies you can see the account

lockout policy which we are looking for

to set this up so let's configure the

account lockout duration to 30 minutes

then let's set the account lck out

threshold to three invalid log on

attempts just for the sake of this home

lab you can choose it depending on your

company policy then let's set up the

account lockout counter after 30

minutes so to test this policy you can

use a test user account and attempt

multiple failed login attempts to verify

that the account gets logged out then

you will see this message that is

currently locked out which means that

our policy

worked next is user rights assignment

and this is assign and restrict user

rights to enhance security this is more

of a role-based access and we can

restrict different user groups for

different tasks for example we can deny

standard users to log in locally or

directly to the servers because we don't

want them to be messing around with the

servers if they can figure out or

accidentally log into them and we can

also restrict using or allowing them

remote desktop services so standard

users can just log into to different

computers or servers remotely using RDS

so for this lab open the group policy

Management console then you can create a

new GPO or edit the default domain

policy I'm going to create a new GPO so

I'll right click on this group policy

objects and click on new and let's type

in user rights for

example expand the group policy objects

and look for user rights and right click

and click edit and then navigate to

computer configuration then select

policies then window settings and select

security settings under local policies

select user right assignment so the

first example that you want to do is to

deny log on locally so look for deny log

on locally in this list and check Define

these policies and then add groups for

users who should not log on directly to

the servers so just make sure that you

already have groups added in active

directory so you have something to add

to this lab just like each group or

Accounting Group so that's what you are

going to add in this restriction so

let's let's add the HR department for

example then next we just want to

specify groups or users that are allowed

to use remote desktop just like it

department for example so find allow log

on through remote desktop services and

click on Define these policy settings

and then you can add the users or groups

you want to allow to use remote desktop

just like the IT

department so let's test the Deni log on

locally policy first I am going to go to

my Windows server and I'm going to sign

out from admin account and I'm just

going to use a regular user account that

is not a member of the it group and

let's see if we can sign in to the

Windows Server so I'm getting this error

message which means that our policy

Works cuz I'm not allowed to log onto

this Windows Server directly because I'm

not an admin the next policy we're

testing is allowing log on through

remote desktop services so in testing

this just make sure that you're logged

in as regular user and not as admin so

open the remote desktop program then

type in the name of your server and then

click connect and it's going to ask you

to enter your

password and then click okay and then as

you can see you're getting this error

message so this means that our policy

work because we're not allowed to use

remote desktop with this regular user

account okay so for our last Hands-On

lab it's going to be implementing fine

grained password policies so this is

covering the request from the comment

yes earlier which will be applying

different password policies to different

groups of users so for example your

organization wants to apply stricter

policies to admin accounts while

allowing standard users to have more

lenient requirements or vice versa if

you want admins to have less stricter

requirements and more stricter with

standard users so this is how you

implement this kind of security policy

so the concept of applying and

implementing different password policies

to different user groups is called

theine grain password policies and

window server and we also use different

tools other than the group policy

management to implement this since this

is more advanced settings so for this

configuration we're not going to use

Group Policy but we're going to use a

tool that's called active directory

administrative Center and you can find

it under your windows admin tools okay

so go ahead and open the active

directory administrative Center so to

your left side click on your domain name

and then select system and select

password settings container because we

are going to create a new password

settings object or

PSO next go to the upper right side

click on new and password settings so

this is where you're going to type the

name for your password set settings

we're going to do the admin password

policy first thenx is precedence this

determines the order in which the policy

objects are applied when multiple

password settings are applied to a user

or a group so the password setting with

the lowest president number has the

highest priority and will be applied for

example there's a user with two password

setting first setting with the

Precedence of 20 and second with the

Precedence of 30 so the one with the

lower number will take presidence and

that's the one with presidence

20 so for this admin password setting

I'm going to put number one to make it

the highest precedence and below is

where you can edit the settings to make

stricter policies for admin for example

set up the minimum password length in

here and also enforce password history

in here so I'm just going to put 15 for

minimum password length and three for

password history then at the bottom you

can click on ADD so we can add the

groups where we want this admin password

setting applied or implemented to in

this case I'm going to select the group

for it

admins then just click on okay and now

we have created a password setting

object here for

admin then if you want to create another

one for regular users we can create

another password settings object or PSO

and follow the same process type in the

name of the setting and then type in the

presidence here I'm going to use a

number two just to make it lower than

the admin presidence and below is where

you can change the settings to make it

less stricter than the admin or more

stricter depending on your company

policy and same process you can add the

groups where you want this to be

implemented and then click on okay and

then you have created another password

setting

object okay so that would be it for this

episode of our home lab series if you

have any questions please let me know in

the comment section down below and I

hope you learn something from this video

thank you so much and hope to see you

guys in the next one