Password Rotation
Account can be set to have their password rotated on fixed interval, e.g. every 6 months.
This can be done with Local Administrator Password Solution.
Password Complexity Policies + Passphrases + 2FA
Passphrases or randomly generated passwords with a certain length are harder to crack.
One might at least require a certain length and blacklist certain commonly used words in passwords.
Two-factor authentication (2FA) can also help mitigate cracking passwords.
Audit Policy Setting
Effective logging and monitoring can be used to detect an attacker or unauthorised employee adding a user or computer, modifying an object in AD, changing an account password, accessing a system in an unauthorised or non-standard manner, performing an attack such as password spraying, or more advanced attacks such as modern Kerberos attacks.
Group Policy Security Setting
The Group Policy Object (GPO) can be used to apply certain policies at the Organisational Unit (OU) level.
The following are some of these policies:
Account Policies: Manage how user accounts interact with the domain. These include the password policy, account lockout policy, and Kerberos-related settings such as the lifetime of Kerberos ticketsLocal Policies: These apply to a specific computer and include the security event audit policy, user rights assignments (user privileges on a host), and specific security settings such as the ability to install drivers, whether the administrator and guest accounts are enabled, renaming the guest and administrator accounts, preventing users from installing printers or using removable media, and a variety of network access and network security controls.Software Restriction Policies: Settings to control what software can be run on a host.Application Control Policies: Settings to control which applications can be run by certain users/groups. This may include blocking certain users from running all executables, Windows Installer files, scripts, etc. Administrators use AppLocker to restrict access to certain types of applications and files.Advanced Audit Policy Configuration: A variety of settings that can be adjusted to audit activities such as file access or modification, account logon/logoff, policy changes, privilege usage, and more.
Update Management
Managing how often updates are run a critical to patch fixed vulnerabilities.
This can be done with Windows Server Update Service (WSUS) to make the task less manual. Another paid solution is System Centre Configuration Manager (SCCM).
Security Groups
Use Groups for assigning Rights instead of doing it directly to the User.
This makes it easier to ensure that no user has rights that they should not have and could be exploited.
Account Separation
Administrators should have separate account for their administrator duties and their day-to-day task. That way if their account is compromised, e.g. by phishing, during day-to-day tasks, then the attacker have not gained access to the administrator account.
Limiting Domain Admin Account Usage
Administrator accounts should only log into Domain Controllers and not personal workstations. This ensures that the administrator password is not left in memory in more places than necessary.
Periodically Auditing and Removing Stale Users and Objects
If old high-privileged users remain they might be compromised, e.g. if they have weak passwords before a stronger password policy was activated.