Active Directory Domain Controller Hardening for Hybrid Environments

# Requires: ActiveDirectory module, domain admin or equivalent
Import-Module ActiveDirectory

$domainDN = (Get-ADDomain).DistinguishedName
$acl = Get-Acl "AD:\$domainDN"

# DCSync uses DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights
$dcSyncRights = $acl.Access | Where-Object {
    $_.ActiveDirectoryRights -match "ExtendedRight" -and
    $_.ObjectType -in @(
        "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", # DS-Replication-Get-Changes
        "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"  # DS-Replication-Get-Changes-All
    )
}

$dcSyncRights | Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType |
    Format-Table -AutoSize
$dcSyncRights | Export-Csv "C:\Logs\Intune\DCSync-Audit-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

IdentityReference                   ActiveDirectoryRights    AccessControlType
-----------------                   ---------------------    -----------------
CONTOSO\Domain Controllers          ExtendedRight            Allow
CONTOSO\Domain Admins               ExtendedRight            Allow
CONTOSO\Enterprise Admins           ExtendedRight            Allow
NT AUTHORITY\ENTERPRISE DOMAIN C... ExtendedRight            Allow

# Add your Domain Admins and Enterprise Admins to the Protected Users group
# Replace the samAccountNames with your actual admin accounts
$adminAccounts = @("da-awan", "da-smith", "krbtgt")

foreach ($acct in $adminAccounts) {
    Add-ADGroupMember -Identity "Protected Users" -Members $acct
    Write-Host "Added $acct to Protected Users" -ForegroundColor Green
}

# Verify membership
Get-ADGroupMember -Identity "Protected Users" | Select-Object Name, SamAccountName, ObjectClass

# Run on each Domain Controller — requires RSAT AD tools
$dc = $env:COMPUTERNAME
$results = @()

# Check 1: SMBv1 disabled
$smb1 = (Get-SmbServerConfiguration).EnableSMB1Protocol
$results += [PSCustomObject]@{ Check = "SMBv1 disabled"; Pass = -not $smb1; Detail = if($smb1){"ENABLED — disable immediately"}else{"OK"} }

# Check 2: NTLMv1 disabled
$ntlmv1 = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa").LmCompatibilityLevel
$results += [PSCustomObject]@{ Check = "NTLMv1 disabled (LmCompatLevel=5)"; Pass = $ntlmv1 -ge 5; Detail = "Level: $ntlmv1" }

# Check 3: Protected Users group has members
$pu = (Get-ADGroupMember "Protected Users" -ErrorAction SilentlyContinue).Count
$results += [PSCustomObject]@{ Check = "Protected Users populated"; Pass = $pu -gt 0; Detail = "$pu members" }

# Check 4: SYSVOL/NETLOGON using DFS-R (not FRS)
$dfsr = Get-WmiObject -Namespace "root\microsoftdfs" -Class DfsrReplicatedFolderInfo -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{ Check = "SYSVOL using DFS-R"; Pass = $null -ne $dfsr; Detail = if($dfsr){"DFS-R OK"}else{"May still be on FRS"} }

$results | Format-Table -AutoSize
$results | Export-Csv "C:\Logs\Intune\DC-HealthCheck-$dc-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

Check                              Pass  Detail
-----                              ----  ------
SMBv1 disabled                     True  OK
NTLMv1 disabled (LmCompatLevel=5)  True  Level: 5
Protected Users populated          True  8 members
SYSVOL using DFS-R                 True  DFS-R OK

# Run on the PDC Emulator DC — searches last 24 hours of Security log
$since = (Get-Date).AddHours(-24)

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4769
    StartTime = $since
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Properties[6].Value -eq "0x17"  # 0x17 = RC4-HMAC encryption type
} | Select-Object TimeCreated,
    @{N='Account';E={$_.Properties[0].Value}},
    @{N='ServiceName';E={$_.Properties[2].Value}},
    @{N='ClientIP';E={$_.Properties[9].Value}} |
    Format-Table -AutoSize