Active Directory Security: Act on NSA’s Latest Update

A compromised Active Directory environment can turn one stolen identity into access across systems, applications and sensitive data.

For federal contractors, that can mean more than a security incident. Identity compromise can disrupt contract operations, restrict access to critical systems, increase investigation and recovery costs and expose sensitive information.

On September 15, 2026, the National Security Agency (NSA) published the September 2026 update of the joint guidance Detecting and Mitigating Active Directory Compromises. The NSA guidance repository lists the document with a publication date of September 15. The updated guidance addresses mitigation and detection strategies for common Active Directory compromise techniques.

The practical takeaway is to use the updated guidance as a control validation exercise. Active Directory security best practices are useful only when organizations can demonstrate that access controls, monitoring and response procedures work as intended.

Start With Privileged Access

Active Directory security starts with understanding who can control identities, systems and permissions. The updated guidance emphasizes securing privileged access because attackers who obtain highly privileged accounts can significantly expand their control across an environment.

For federal contractors, review Domain Admins, Enterprise Admins, service accounts, backup administrators and other accounts with significant access. Confirm that administrative accounts have only the permissions they require and that privileged credentials are not unnecessarily exposed to lower trust systems. Service accounts deserve separate attention. They can have broad permissions while operating with limited human oversight. Review their ownership, privileges, authentication methods and where their credentials can be used. The goal is to reduce the number of paths an attacker could use to move from an ordinary account to privileged access.

Review Directory Permissions and AD CS

After reviewing who has access, examine what those identities can change. Active Directory depends on complex relationships between users, groups, permissions, configurations and other objects. The updated guidance stresses the importance of understanding these relationships because attackers can enumerate the environment to identify weaknesses and paths to greater access. Use the guidance to review delegated directory permissions and sensitive administrative changes. Then extend that review to Active Directory Certificate Services or AD CS. Certificate templates, permissions and certificate issuance can affect how identities authenticate and how trust is established across the environment.

For each high risk permission or configuration, identify who can make the change, where the activity is recorded and how an unauthorized change would be detected. This creates a direct connection between access control and Active Directory compromise detection.

Monitor the Events That Support Detection

Active Directory monitoring is only useful when the right activity is visible to the security team. The updated guidance includes an appendix covering recommended event IDs to log and monitor for detecting Active Directory compromises. It also notes that some events are not collected under the default Windows Audit Policy and may require additional configuration.

Examples of useful telemetry can include successful and failed authentication, Kerberos activity, directory object changes, audit log activity, PowerShell activity and certificate related events. The important point is not to treat an event ID as a standalone indicator.

A single failed authentication may be normal. A pattern involving unusual authentication, privileged activity and an unexpected directory or certificate change can provide a much stronger signal. This aligns with CISA guidance, which emphasizes centralized logging and monitoring to establish normal activity and identify suspicious behavior.

Validate Active Directory Compromise Detection

Collecting logs does not automatically create effective detection. Use the updated guidance to test whether important Active Directory activity follows a complete detection path:

Activity → Log → Ingestion → Detection → Alert → Investigation

For example, security teams can generate controlled authentication or directory change activity and confirm that the expected telemetry is created, forwarded to the SIEM or MDR platform, matched by the appropriate detection logic and routed to the correct personnel.

The guidance also highlights the difficulty of detecting Active Directory compromises because attackers often abuse legitimate functionality. This means some detections require correlation across multiple events or sources rather than a single alert. That makes validation particularly important. A control that is enabled but does not generate usable telemetry is not providing the same operational value as a control that has been tested end to end.

Use the Updated Guidance to Test High Risk Scenarios

The September update provides specific material that security teams can use to expand their detection testing. For example, the guidance adds a DCSync detection technique based on identifying abnormal directory replication activity. It recommends establishing a baseline of normal replication activity so that anomalous requests from unauthorized systems or users can be identified.

The update also includes new material on shadow credentials, including recommendations to restrict privileged group membership, minimize permissions that allow unauthorized key credentials to be added to accounts and regularly review accounts for unexpected authentication credentials. These additions make the update more than a general security reminder. They give contractor security teams specific areas to revisit in their access reviews, monitoring rules and detection tests.

Know When an Alert Requires Investigation

Not every Active Directory alert indicates a compromise. The response should depend on the account, system, activity, timing and surrounding evidence. An unusual authentication involving a privileged account may require investigation when it occurs alongside unexpected directory modifications. Likewise, an unexplained certificate related change may warrant additional review when it does not match an approved administrative action. Contractor security teams should define these decision points before an incident occurs. A practical response path is:

Detect → Validate → Investigate → Contain → Recover

The updated guidance can inform the detection and mitigation portions of this process. Organizations should then map those recommendations to their own escalation procedures, system owners and incident response plans.

Turn the Guidance Into an Assessment Worksheet

A practical way to act on the September update is to convert its recommendations into a repeatable assessment.

Area	What to Review	Monitoring Requirement	Owner	Verification
Privileged accounts	Membership, permissions and unnecessary access	Privileged authentication and account changes	Identity/Security	Access review
Service accounts	Privileges, authentication scope and credentials	Authentication and unusual account activity	Identity/Application	Account validation
Directory permissions	Delegated rights and sensitive changes	Directory modification events	Identity/Security	Permission review
AD CS	Templates, permissions and certificate issuance	Certificate and CA events	PKI/Security	Template testing
Domain Controllers	Logging, PowerShell and administrative activity	Authentication and audit events	Infrastructure/Security	Detection test
Monitoring	SIEM ingestion, rules and alert routing	Correlated Active Directory activity	SOC/MDR	Detection validation
Incident response	Escalation and containment procedures	High risk identity alerts	IR/Security	Response exercise

This worksheet gives each weakness a mitigation, monitoring requirement, responsible owner and verification step. It also makes it easier to track whether a finding has been addressed or simply documented.

Test the Controls, Not Just the Configuration

An Active Directory security review should end with evidence. For each control, document what was tested, what activity was generated, whether the monitoring platform detected it, who received the alert and what response followed. Retain that evidence so security leaders can determine whether the control works beyond its configuration. This matters for federal contractors because identity security supports the systems and services used to deliver contracts. A detection gap that remains unnoticed can become an operational problem when an attacker gains privileged access.

The September 2026 update provides a timely reason to revisit these controls. Rather than treating the guidance as another document to read, use it to identify weaknesses, validate monitoring coverage and test whether the organization can move from detection to investigation and containment.

What Contractor Security Teams Should Review Now

Start with the areas most likely to create broad identity exposure:

1. Review privileged and service accounts.
2. Verify directory and AD CS permissions.
3. Confirm relevant authentication and change events are collected.
4. Check that Active Directory telemetry reaches the appropriate monitoring platform.
5. Test detection rules against realistic activity.
6. Review the new DCSync and shadow credential guidance.
7. Define when suspicious identity activity requires investigation or containment.
8. Document the owner and verification method for each control.

The goal is straightforward: Active Directory security is not just about configuring controls. It is about proving that those controls can identify, investigate and contain suspicious activity.

Frequently Asked Questions

Strengthen Active Directory Monitoring and Response

XieTek LLC provides Cybersecurity Services designed to help organizations strengthen identity monitoring, security operations and incident response across complex IT environments.

From Active Directory monitoring and threat detection to investigation and coordinated containment, our team helps organizations improve visibility and respond to security events with greater consistency.

Need to strengthen Active Directory monitoring, detection coverage or incident response? Contact XieTek LLC to discuss your Cybersecurity needs.