Active Directory: recommendations and things to avoid

As you probably know, Active Directory is a proprietary service developed by Microsoft that makes it easier to manage users, permissions and security settings centrally. It also extends the functionality of a regular file server.

In this article, we’ll give you some recommendations, as well as things you should avoid. We updated them in November 2026, because some best practices have changed since 2021, when we wrote the article.

Recommended: Set up your security policy so that passwords are changed when there are signs they’ve been compromised, not every 30 days.

When we talk about security, we’re also talking about passwords. In 2021, a fairly common practice was to implement an AD policy that required passwords to be changed every 30 days.

Back then, we recommended it as a simple and effective way to keep your passwords secure. Since then, the recommendation has changed: since 2019, Microsoft no longer includes periodic password expiration in its security baselines, and NIST’s authentication guidelines say passwords shouldn’t be changed periodically, only when there’s evidence they’ve been compromised. Forced changes every 30 days push users to choose predictable passwords, for example the same password with a different digit at the end. Long passwords, checking them against lists of compromised passwords and two-step verification (MFA) are more effective.

Avoid: Don’t allow low-complexity passwords.

A secure password must be at least 12 characters long and contain uppercase and lowercase letters, digits and symbols. Length matters more than the mix of characters, though: the 2025 NIST guidelines require at least 15 characters for passwords used without a second authentication factor, and a passphrase of four or five words is harder to crack than a short password with symbols. Also, don’t allow passwords that contain part of the user’s AD name, and block commonly used passwords and those that have appeared in data breaches. Microsoft Entra Password Protection does this for Active Directory installed on the company’s own servers too.

Recommended: Publish the multifunction printers and apps each department needs in AD.

Integrating the multifunction printers and apps needed for day-to-day work with Active Directory, by department, provides a level of standardization that will prevent certain problems. This approach is also very useful for companies with high employee turnover, because onboarding and offboarding procedures (preparing computers and accounts for people who join, closing access for people who leave) become very easy to carry out.

Avoid: Don’t leave workstations outside Active Directory.

They say an infrastructure is only as secure as its most vulnerable element. Leaving some workstations out of Active Directory can be a major security gap, because the rules configured at company level aren’t applied to those workstations in real time. Laptops that are used mostly from home can be enrolled in Microsoft Entra ID and managed with Intune, so the company’s rules apply to them even without a VPN connection.

Recommended: Set up SSO (single sign-on) for your entire infrastructure.

SSO lets users use a single password to access all the internal services and platforms your company uses. This prevents situations where users forget their passwords and, in turn, strengthens security across the company. Because a single password then opens every service, combine SSO with two-step verification (MFA).

Recommended: Use groups to define permissions.

To make permissions easier to manage, we recommend configuring them at group level rather than adding users individually. A group usually represents an entire department or a division of a department.

This way, the whole department will have the same rights.

What is the difference between Active Directory and Microsoft Entra ID?

Active Directory runs on the company’s servers, while Microsoft Entra ID, as Azure Active Directory has been called since 2023, is Microsoft’s cloud identity service, used by Microsoft 365. Many companies use them together: accounts are created in Active Directory and synchronized to Entra ID with Microsoft Entra Connect, so employees use the same password on their computer, in email and in Teams. Companies without a local server can work with Entra ID and Intune alone.

What else should you check in Active Directory in 2026?

In addition to the recommendations above, check six things: two-step verification, administrator accounts, local administrator passwords, old accounts, server versions and backup.

• Two-step verification (MFA) for remote access (VPN, email, Microsoft 365) and for all administrator accounts. The NIS2 Directive lists it among the security measures required of the companies it covers (in Romania, GEO 155/2024).
• Separate accounts for administrators: administrators work day to day with a regular account and use their administrator account only for administration.
• Different passwords for the local administrator of each computer, with Windows LAPS, built into Windows since April 2023. This way, a password an attacker finds on one computer doesn’t open the others too.
• Inactive accounts and those of people who have left are disabled immediately, not at the end of the year.
• The version of your domain controllers: Windows Server 2012 and 2012 R2 haven’t received updates since October 10, 2023, and Windows Server 2016 goes out of support on January 12, 2027. Details in the article on the problem with end-of-life (EOL) technology.
• Backup of your domain controllers, with tested restores. Without it, an error or ransomware can block logins across the whole company. See also Backup as a Service.

RezolvIT is an IT outsourcing company that does an excellent job of supporting the companies it works with, whether that means IT security and securing work laptops used at home, or making it easy for employees to work remotely. We prepare computers and accounts for new employees and close access for those who leave. If you’d like us to check your company’s Active Directory, request a free IT audit.