PAW - Revision history

Ledhed at 21:44, 11 October 2016

2016-10-11T21:44:37Z

Ledhed at 21:13, 11 October 2016

2016-10-11T21:13:36Z

Ledhed at 20:44, 11 October 2016

2016-10-11T20:44:21Z

Ledhed at 20:43, 11 October 2016

2016-10-11T20:43:58Z

Ledhed at 19:51, 11 October 2016

2016-10-11T19:51:17Z

Ledhed: Created page with "Privileged Access Workstations == Overview == Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [Pass-the-H..."

2016-10-11T19:50:13Z

Created page with "Privileged Access Workstations == Overview == Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [Pass-the-H..."

New page

Privileged Access Workstations

== Overview ==
Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [Pass-the-Hash] and other attacks.

== Reference ==
https://technet.microsoft.com/windows-server-docs/security/securing-privileged-access/privileged-access-workstations

[[Category:Security_(Windows)]][[Category:Windows]]

← Older revision		Revision as of 21:44, 11 October 2016
Line 30:		Line 30:
	* App Locker: Only MS Signed roles and features, or those validated and approved by the CAB.		* App Locker: Only MS Signed roles and features, or those validated and approved by the CAB.
	* Hardening: NTLMv2 only, Interactive Logons = 0, Server 2016 only (if at all possible)		* Hardening: NTLMv2 only, Interactive Logons = 0, Server 2016 only (if at all possible)
		+
		+	PAW workstations:
		+	Admins need to be able to administer the servers within Tier 0. To do this they need a dedicated device for that tier. According to the PAW model, Admins should also have standard accounts for email and internet access (another device), and if Tier 0 admins are to perform management on Tier 1, they need a dedicated device for that as well. As you can see the Tier 0 admin is going to need a lot of devices. Here are some options:
		+
		+	3x SFF PC's + KVM
		+	2x SFF PC's + Thin Client for Tier 2 + KVM
		+
		+	1x Desktop or Laptop running Hyper-V, with 2 VM's installed. The Host OS is Tier 0, Tier 1 is a dedicated VM, and Tier 2 is a dedicated VM.
		+	*Host OS: Server 2016 or Windows 10
		+	**Minimum Hardware: CPU: 4 cores w/ Virtualization and SLAT support, 16 GB RAM, TPM 1.2 or 2.0
		+	**Security Features: Device Guard, Credential Guard, BitLocker
		+	*Tier 1 VM
		+	**Host OS: Server 2016 or Windows 10
		+	**Security Features: Device Guard, Credential Guard
		+	*Tier 2 VM
		+	**Host OS: Any supported Operating System (Windows 7 - 10, Linux, Mac) assuming it can be virtualized without violating its EULA.
		+
		+
		+

← Older revision		Revision as of 21:13, 11 October 2016
Line 11:		Line 11:

	Note: Administration tasks for each tier should be isolated to that tier. Managing any server from a lower tier is violation of the PAW model. Interactive Logons are only permitted within the same tier, Network Logons are permitted across all tiers as necessary (Least Privilege).		Note: Administration tasks for each tier should be isolated to that tier. Managing any server from a lower tier is violation of the PAW model. Interactive Logons are only permitted within the same tier, Network Logons are permitted across all tiers as necessary (Least Privilege).
		+
		+
		+	== Examples ==
		+	=== Tier 0 ===
		+	Roles and Services:
		+	* Domain Controllers
		+	* Certificate Authorities
		+	* RADIUS Servers
		+	* Password Vaults (e.g. KeePass)
		+	* 2 Factor Authentication
		+	* System Center
		+	* Hardened Management Workstations
		+
		+	Restrictions:
		+	* Interactive Logon: Enterprise Admins (EA) and Domain Admins (DA) ONLY! (GPO Enforced)
		+	* Groups and Members: Members of the EA and DA groups are approved and reviewed regularly by the Change Advisory Board (CAB). Membership should be kept to a minimum.
		+	* Firewall: On, Least Privilege, Manageable only from Tier 0 PAWs. (GPO Enforced for common rules)
		+	* App Locker: Only MS Signed roles and features, or those validated and approved by the CAB.
		+	* Hardening: NTLMv2 only, Interactive Logons = 0, Server 2016 only (if at all possible)
		+

@@ Line 6: / Line 6: @@
 == Tiers ==
-Tier 0 = Highly sensitive servers such as: Domain Controllers, Certificate Authorities, RADIUS Servers, Management Servers (e.g. System Center)
+Tier 0 = Highly sensitive servers such as: Domain Controllers, Certificate Authorities, RADIUS Servers, Management Servers (e.g. System Center) <br>
-Tier 1 = Application servers such as: Database Servers (that don't contain highly sensitive information), DNS, DHCP, Skype, SharePoint.
+Tier 1 = Application servers such as: Database Servers (that don't contain highly sensitive information), DNS, DHCP, Skype, SharePoint. <br>
-Tier 2 = End user devices such as: Desktops/Laptops used by end users.
+Tier 2 = End user devices such as: Desktops/Laptops used by end users. <br>
 Note: Administration tasks for each tier should be isolated to that tier. Managing any server from a lower tier is violation of the PAW model. Interactive Logons are only permitted within the same tier, Network Logons are permitted across all tiers as necessary (Least Privilege).

← Older revision		Revision as of 19:51, 11 October 2016
Line 2:		Line 2:

	== Overview ==		== Overview ==
−	Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [Pass-the-Hash] and other attacks.	+	Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [[Pass-the-Hash]] and other attacks.

@@ Line 3: / Line 3: @@
 == Overview ==
 Privileged Access Workstations is a security model developed by Microsoft which helps protect a workstations against [[Pass-the-Hash]] and other attacks.
 == Reference ==
 https://technet.microsoft.com/windows-server-docs/security/securing-privileged-access/privileged-access-workstations
 [[Category:Security_(Windows)]][[Category:Windows]]