Best Practice for Securing SharePoint Service Accounts from AD Login Brute Force Attack

Question

Hello everyone,

Especially for internet facing sharepoint sites, what is the best solution to prevent bad login attempts for sp service accounts. The solution could be hardware solution (firewall or waf) or software solution (scripting).

Thanks.

Accepted Answer

For SharePoint service accounts, you should be adding them to the deny logon security policy (secpol.msc) on each SharePoint server. For SQL, you should be using a gMSA rather than a domain user account.

Place a pre-authenticating reverse proxy in front of SharePoint and don't allow it to be bypassed to each web application. But there is nothing stopping an internal user from brute forcing or locking the accounts out -- this is typically why service accounts bypass lockout policies as you don't want your service to fail.

Best defense is to use monitoring tools that will alert you of these types of attacks against users.

Answer

Unfortunately there isn't any proper way, I would say create them with a proper naming convention and explain the AD team to not to touch those service accounts.

Below articles explains you to configure service accounts with proper naming convention.

https://www.sharepointdiary.com/2014/09/sharepoint-2013-service-accounts-list-permissions-best-practices.html

https://vladtalkstech.com/2013/01/sharepoint-2013-service-accounts-best-practices-explained.html

Thanks & Regards,

Share via

Best Practice for Securing SharePoint Service Accounts from AD Login Brute Force Attack

1 additional answer

Your answer