Active › Module 9 › Lesson 2
Remediation Recs
Remediation recommendations for AD findings — tiering, ACL cleanup, gMSA, Guard, detection tuning; verify on $LAB_AD.
Visual · t25_remediation_recs
Remediation recs = specific fixes before fame. Original Cyberlium.
Opening
The finding blue merges is the one with a verified fix on your lab forest — not a Twitter thread of hashes.
Remediation-first for AD: each finding maps to Module 7 controls — remove dangerous ACE, migrate SPN to gMSA, move DA to PAW/tier split, enable Credential Guard on jump hosts, tune 4769/4662 alerts, deploy honeytoken from Module 8. Report order: impact → root cause class → remediation steps → verification → purple retest stub. On $LAB_AD: apply one fix from paths or defense lab, document before/after (graph edge removed, Guard enabled, SPN migrated), retest detection alert. Refused: recommend disabling logging/AV, 'accept risk' without sign-off, public exploit before patch, remediation that weakens tier model. Link ATT&CK mitigation IDs where brief provides.
1. Fix categories
Identity: tier split, Protected Users, gMSA. ACL: remove GenericAll/WriteDACL. Endpoint: Guard/PPL. Detect: rule tune + honeytoken.
Verify each fix on $LAB_AD snapshot branch — document hash or config export.
Command guide
Try these commands — Fix categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Remediation — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model (tiering fixes) CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices Microsoft gMSA — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
recs = [
('T1558.003', 'Use gMSA; 25+ char service passwords; alert 4769'),
('T1558.004', 'Clear DONT_REQ_PREAUTH; enforce pre-auth'),
('T1550.002', 'Credential Guard; unique local admin; LAPS'),
('T1003.006', 'Tier 0 ACL audit; protect replication rights'),
]
path = __import__('os').path.join(__import__('os').environ.get('LAB_AD', __import__('os').path.expanduser('~/cyberlium-lab/t25-ad')), 'notes', 'remediation-recs.txt')
open(path, 'w').write('
'.join(f'{t}: {r}' for t, r in recs))
print('Remediation recs written — lab report literacy')
PYCommand — copy this
curl -sS https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices | head -5
Primary tools to practice this lesson: python3, curl. Reference sites: Remediation (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); Microsoft gMSA (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Report ordering
Remediation before optional disclosure timeline — always fix-first culture.
Include detection validation — alert fired after purple touch on lab.
3. Refused
Disable NX equivalent for AD — not a thing; don't disable Kerberos logging as 'fix.'
Weaponized PoC is not remediation.
4. What you ship: remediation-first template
Fix categories + verify steps + one lab before/after row.
5. What you record before the next lesson
Remediation-first template path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Recommend disable 4662 auditing so DCSync 'won't alert.'
Right
Remediation template with verified lab fix. Next: Purple Loop.
Mission: remediation-first template
1) List four fix categories. 2) Verify-after-fix steps. 3) Apply one fix on $LAB_AD. 4) Before/after evidence row.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum before/after for ACL fix?”
Knowledge Check
APPLY: Remediation first means:
Multiple choice
Knowledge Check
APPLY: True or False: Disable logging as remediation.
True or False
Knowledge Check
APPLY: gMSA migration fixes:
Multiple choice