RE: Subdomain security

From: Devin Ganger (DevinG_at_3sharp.com)
Date: 12/16/04

  • Next message: Brady McClenon: "RE: services running in windows domain (winXP clients)" 
    Date: Thu, 16 Dec 2004 11:22:39 -0800
To: "Oren Held" <oren@held.org.il>, <focus-ms@securityfocus.com>

    If you are part of the same forest, you cannot enforce security
    boundaries effectively.

    The forest is the security boundary in AD, not the domain. The domain is
    an administrative and replication boundary.

    In order to get all of the intra-forest replciation, trust, and network
    traffic correctly working so that your domain is healthy, you have to
    open up too many ports and services to the surrounding insecure systems.
    They can (and will) then be used as launching points into your secure
    network.

    Tell your management in no uncertain terms that they can pick one of
    two: they secure everything, or they let you deploy a new forest for the
    secure domain. They can't have both. 

    -- 
Devin L. Ganger             Email: deving@3sharp.com
3Sharp LLC                  Phone: 425.882.1032 x 109
15311 NE 90th Street        Cell: 425.239.2575
Redmond, WA  98052          Fax: 425.702.8455
-----Original Message-----
From: Oren Held [mailto:oren@held.org.il] 
Sent: Wednesday, December 15, 2004 3:24 PM
To: focus-ms@securityfocus.com
Subject: Subdomain security
Hello,
I have to install a *secure* windows domain inside an insecure network.
This means that my domain will be behind a firewall ofcourse.
Now, I've got two possibilities for the domain configuration:
Option 1: My domain would actually be a subdomain inside the insecure
forest.
Option 2: Create a totally new forest.
So, surely option #2 is more secure, but the management pushes to
choosing option #1. so.. few questions about option #1:
a. Which ports should be opened by the firewall in order for the
subdomain to function well but be the most secure? Any references?
b. Does an admin (a member of the Enterprise Admin group) from the
root-domain have access to my subdomain? Can I prevent it at all?
c. Do you know any networks that implement option #1 with a firewall and
think they're quite secure from the other domains, or is it a totally
twisted idea?
Thanks a lot people,
 - Oren
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Brady McClenon: "RE: services running in windows domain (winXP clients)"

    Relevant Pages

    • Re: Reasons for Empty (headless root) Root
      ... I am very interested in learning more about how the security is between domain and domain vs forest. ... I quickly and easily compromised a root domain from a child domain for the first time in about May 2000 showing how simple it was and nothing has changed. ... Domains are sort of a replication boundary, the config and schema replicate across all DCs in a forest and also obviously GCs replicate across domain NC boundaries. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Reasons for Empty (headless root) Root
      ... I am very interested in learning more about how the security is between ... forest is a security boundary, ... across domain NC boundaries. ... normally have had free reign to do things in the root, ...
      (microsoft.public.windows.server.active_directory)
    • Re: Reasons for Empty (headless root) Root
      ... That is why MSFT says the forest is a security boundary, ... Domains are sort of a replication boundary, the config and schema replicate across all DCs in a forest and also obviously GCs replicate across domain NC boundaries. ... Do you disagree with me by saying a domain is also a security boundary in that the administrative control is cut off from other domains such that it cannot directly affect them? ...
      (microsoft.public.windows.server.active_directory)
    • RE: Subdomain security
      ... The empty root domain does not offer any additional security since the ... security boundary for Active Directory is at the Forest level. ... I think that Devin got it right when he said that either you secure the ... Subject: Subdomain security ...
      (Focus-Microsoft)
    • Re: Site or Domain
      ... Domain aren't security Boundaries, ... forest, and they are not themselves the ultimate security boundary. ... Each Active Directory domain is authoritative for the ... Domain controller hardware and security facilities Each Windows Server ...
      (microsoft.public.windows.server.active_directory)