Active Directory Setup for Corporate Infrastructure

company.local
├── _ServiceAccounts (technical accounts, PasswordNeverExpires)
├── _AdminUsers (admins with separate accounts)
├── Groups
│   ├── Security (groups for GPO and access rights)
│   └── Distribution (mail groups)
├── Computers
│   ├── Servers
│   │   ├── Production
│   │   └── Dev
│   └── Workstations
│       ├── Moscow
│       ├── Remote
│       └── _Quarantine (new machines before verification)
└── Users
    ├── Moscow
    ├── Remote
    └── _Disabled (deactivated, before deletion)

_Quarantine for workstations is good practice: a new machine lands there, receives minimal policies, passes verification, then moves to the appropriate OU.

How to Configure Fine-Grained Password Policy?

Default Domain Policy applies one policy to everyone. Fine-grained allows different requirements for different groups — essential for separating regular users and admins. We set up separate PSOs with varying parameters: for admins — length 16, history 24, lockout after 3 attempts; for users — length 10, history 12, lockout after 5. This is 4 times more secure than a single policy, as admins cannot use weak passwords.

Step-by-step instructions:

1. Create a PSO for admins using New-ADFineGrainedPasswordPolicy, setting MinPasswordLength 16, PasswordHistoryCount 24, LockoutThreshold 3.
2. Apply the PSO to admin groups via Add-ADFineGrainedPasswordPolicySubject.
3. Create a PSO for users with weaker requirements (MinPasswordLength 10, LockoutThreshold 5).
4. Apply to the Domain Users group.
5. Ensure the admin policy has a higher Precedence (lower number).

# Strict policy for admins
New-ADFineGrainedPasswordPolicy `
    -Name "PSO-Admins" `
    -Precedence 10 `
    -MinPasswordLength 16 `
    -PasswordHistoryCount 24 `
    -MinPasswordAge (New-TimeSpan -Days 1) `
    -MaxPasswordAge (New-TimeSpan -Days 60) `
    -ComplexityEnabled $true `
    -LockoutThreshold 3 `
    -LockoutDuration (New-TimeSpan -Minutes 30) `
    -LockoutObservationWindow (New-TimeSpan -Minutes 30) `
    -ReversibleEncryptionEnabled $false
Add-ADFineGrainedPasswordPolicySubject `
    -Identity "PSO-Admins" `
    -Subjects "Domain Admins", "Server Admins"

# Basic policy for users
New-ADFineGrainedPasswordPolicy `
    -Name "PSO-Users" `
    -Precedence 20 `
    -MinPasswordLength 10 `
    -PasswordHistoryCount 12 `
    -MaxPasswordAge (New-TimeSpan -Days 90) `
    -ComplexityEnabled $true `
    -LockoutThreshold 5
Add-ADFineGrainedPasswordPolicySubject `
    -Identity "PSO-Users" `
    -Subjects "Domain Users"

How to Delegate Rights Without Domain Admin?

A typical problem: helpdesk engineers get Domain Admin rights 'because they need to reset passwords'. This is excessive and insecure. AD allows delegating only the needed rights. We use dsacls — more flexible than the Delegation of Control Wizard:

# Delegate password reset in OU Moscow/Users for Helpdesk group
dsacls "OU=Moscow,OU=Users,DC=company,DC=local" /I:S /G `
"COMPANY\Helpdesk:CA;Reset Password;user"
dsacls "OU=Moscow,OU=Users,DC=company,DC=local" /I:S /G `
"COMPANY\Helpdesk:CA;Change Password;user"
# Allow account unlock
dsacls "OU=Moscow,OU=Users,DC=company,DC=local" /I:S /G `
"COMPANY\Helpdesk:WP;lockoutTime;user"

Thus, helpdesk gets exactly the rights needed, without access to other objects. This approach is 10 times more secure than granting Domain Admin.

Service Integration via LDAP/Kerberos

Enterprise applications (GitLab, Jira, VPN) connect to AD via LDAP or Kerberos. For LDAP integration, a service account with minimal privileges is needed. We create a read-only account and restrict interactive logon via GPO:

# Create read-only account for LDAP bind
New-ADUser `
  -Name "svc-ldap-readonly" `
  -SamAccountName "svc-ldap-readonly" `
  -Path "OU=_ServiceAccounts,DC=company,DC=local" `
  -AccountPassword (ConvertTo-SecureString "..." -AsPlainText -Force) `
  -Enabled $true `
  -PasswordNeverExpires $true `
  -CannotChangePassword $true `
  -Description "LDAP read-only bind account"
Set-ADUser "svc-ldap-readonly" `
  -SmartcardLogonRequired $false
# + via GPO: User Rights Assignment → Deny log on locally

Monitoring and Audit of AD

We configure advanced auditing of all critical events. This helps identify anomalies and stale accounts. For example, weekly reports on locked accounts and accounts inactive for 90 days. Auditing is recommended quarterly, as new employees are hired and old ones leave within that timeframe.

# Enable advanced auditing
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Changes" /success:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# Find locked accounts
Search-ADAccount -LockedOut | Select-Object Name, SamAccountName, LockedOut

# Find accounts with expired passwords
Search-ADAccount -PasswordExpired | Select-Object Name, SamAccountName

# Accounts inactive for 90+ days
$cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} `
    -Properties LastLogonDate | Select-Object Name, SamAccountName, LastLogonDate

What's Included (Deliverables)

After completing the project, you receive:

• OU structure diagram with descriptions.
• Access to domain controllers (RDP, WinRM) and service accounts.
• Documentation on GPO, PSO, delegation.
• Instructions for helpdesk and administrators.
• 1-month warranty on correct authentication functionality.
• Support on request — adjustments and consultations.

Order an AD audit before deployment or migration — we will identify vulnerabilities and prepare an action plan. Typical cost: small setups from $800, medium from $3000, enterprise from $10000. Get a consultation from a certified AD engineer.

Comparison of Password Management Approaches

Timeline and Cost Estimates

Cost is calculated individually after an infrastructure audit. Contact us for a preliminary estimate — we will analyze your current configuration and propose an optimal plan. Get a consultation from a certified engineer.

Learn more about Active Directory in the official Microsoft documentation.