Table of Contents
Introduction............................................................................................................................. 2
Domain Security Overview........................................................................................................ 2
Protect Privileged Accounts (Daily)............................................................................................ 3
Compromised Password...................................................................................................... 3
Password Never Expires...................................................................................................... 6
Duplicated Password........................................................................................................... 7
Poorly Protected Account with SPN...................................................................................... 9
Minimize Risk of Unauthorized Privileged Escalation (Weekly)..................................................... 9
Attack Path to Privileged Accounts......................................................................................10
Duplicated Local Administrator............................................................................................ 11
Usage of endpoints that have Non-Privileged Local Administrator..........................................12
Stealthy Privileges............................................................................................................. 13
Reduce Attack Surface (Bi-weekly)...........................................................................................14
Inadequate Password Policy............................................................................................... 14
Insufficient Password Rotation............................................................................................ 15
GPO Exposed Password......................................................................................................17
SMB Signing Disabled.........................................................................................................17
Inactive Account................................................................................................................18
Stale Account.................................................................................................................... 19
Disabling Risk Factors..............................................................................................................19
Additional Resources.............................................................................................................. 20
2
Identity Protection
Risk Remediation Guide
Introduction
The Risk Remediation Guide is one of the 5 available documents to guide you in the implementation and
operationalization of the Falcon Identity Protection Module.
This guide is intended for the IAM Teams, SOC Analysts or CrowdStrike Identity Protection SMEs in your organization
who are responsible for reviewing, managing and remediating the risks and misconfigurations in your environment.
The Identity Protection Monitor pages give you the visibility that you need to better evaluate the risks and threats to
which your network is exposed.
This document provides the general guidelines and recommended frequency to review and remediate some of the
common risks to protect your privileged identities, reduce your attack surface, and enhance your organization’s
security posture.
To see the full list of risks covered by the Identity Protection module, refer Identity-based Incidents, Detections, and
Risks.
Domain Security Overview
The Domain Security Overview dashboard provides an immediate insight into the overall domain risks based on a
specific objective.
There are 4 different goals, each characterized by the specific risks. Whether you are preparing for pen testing,
working on an Active Directory Hygiene project, or focusing on managing your privileged identities, you can select the
corresponding option from the Goal list to align the overview page to the specific requirements.
It is recommended to select and review the risks under the “Reduce Attack Surface” goal as it highlights the majority
of the risks in the domain. This goal warns about the different attack vectors that can be exploited in an attempt to
enter data to or extract data from your network environment.
The risks contributing to the overview risk score are listed in the order of severity to assist you in prioritizing your
remediation efforts.
3
Identity Protection
Risk Remediation Guide
The next section covers some of the common risks and the recommended actions that you can take to remediate the
risks.
Protect Privileged Accounts (Daily)
Focus on remediating these common risks daily to protect your privileged identities in your environment.
• Compromised Password
• Password Never Expires
• Duplicated Password
• Poorly Protected Account with SPN
Compromised Password
Description & Explanation
An end user’s password is seen in the Have I Been Pwned (HIBP) dictionary or in a customer’s Custom Passphrase
(Configure > Risk Configuration > Compromised Password Detection) list. Reusing passwords that have been exposed
in a data breach makes accounts vulnerable to dictionary attacks such as brute force, credential scanning,
kerberoasting, and so on.
Recommended Actions
• Direct users to change passwords that Identity Protection flags as compromised, and educate users about the
risk of using passwords that are prone to dictionary-based attacks.
• Use custom insights to prioritize changing of passwords for privileged accounts with this risk:
4
Identity Protection
Risk Remediation Guide
• Setup fusion workflow to force a password reset when the user logs in the next time when a new
compromised password is flagged. See fusion workflow playbook example – “Reset detected compromised
password and send email to the user”. You can customize the playbook to include an additional condition to
target “Privileged” users as a priority.
5
Identity Protection
Risk Remediation Guide
• Setup a scheduled workflow to identify users with compromised passwords and force a password reset when
the user logs in the next time. See fusion workflow playbook example “Identify Compromised Passwords,
Reset, and Notify Users”
• Use the on-demand workflow if you would like to initiate a password reset from the falcon console instead.
See “Manual AD password reset request” playbook.
6
Identity Protection
Risk Remediation Guide
• KB References:
o How Does IDP Determine a Compromised Password?
o Identity Protection | Compromised Password Risk Factor
• How-To Videos:
o Blocking Privileged Users with Compromised Passwords
o Remediating compromised passwords using Fusion SOAR workflows
Password Never Expires
Description & Explanation
The end user’s password is configured to never expire. If a password that never expires is compromised, the risk to
the network is severe and might never be mitigated.
Recommended Actions
• The “Password Never Expires” attribute is typically configured for service accounts and not human accounts.
Define a password expiry for all end users in GPO. For those service accounts for which this is not practical,
there is no alternative but to assume the risk. However, you should closely and frequently monitor the use of
these accounts.
• Alternatively, define a policy to force human users that Identity Protection determines have compromised
passwords to change their passwords.
7
Identity Protection
Risk Remediation Guide
• Use custom insights to identify and prioritize remediation of privileged accounts with the Compromised
Password risk and Password Never Expires attribute:
Duplicated Password
Description & Explanation
Two or more user accounts share the same password. Using duplicated passwords across multiple accounts can lead
to lateral movement and credential stuffing attacks if one account is compromised, resulting in a breach.
Recommended Actions
• Ensure each account has a unique password.
• Identify which users are sharing the same passwords by navigating to the affected user’s business card to
see the additional details.
8
Identity Protection
Risk Remediation Guide
• Prioritize remediating privileged accounts with this risk followed by other users.
• Use API to find all users with duplicated passwords. Sample query:
{
entities(first: 1000, domains: ["[Link]"], riskFactorTypes: [DUPLICATE_PASSWORD],
archived: false) {
edges {
node {
primaryDisplayName
... on UserEntity{
emailAddresses
}
riskFactors(types: DUPLICATE_PASSWORD) {
... on DuplicatePasswordRiskEntityFactor {
groupId
}
}
9
Identity Protection
Risk Remediation Guide
}
}
}
}
Note: Use the groupID information to identify users sharing the same passwords.
• Video:
o Duplicate Password Risk with Identity Protection
Poorly Protected Account with SPN
Description & Explanation
A user account is defined with a Service Principal Name (SPN). Usually, only computer accounts and service accounts
are defined with SPNs. An account with SPNs is at risk of password cracking with a technique called Kerberoasting
when the account has a weak password or when its password policy does not enforce strong passwords.
Recommended Actions
• Remove the SPNs from the user account.
• Make sure the account has a strong password.
• Make sure the password policy enforces strong passwords. Check if the user has the Inadequate Password
Policy risk. To remediate this risk, ensure that password policy is set to a minimum of 14 characters.
• Identify the effective password group policy for the user by navigating to the impacted user’s business card >
under the About tab > Password policy strength:
• KB references:
o Identity Protection Password Policy Strength (Inadequate Password Policy)
o Identity Protection | How to mitigate the risk of accounts with SPNs?
Minimize Risk of Unauthorized Privileged Escalation (Weekly)
Address these risks on a weekly basis to reduce the risk of unauthorized privileged escalation in your organization.
• Attack Path to Privileged Accounts
10
Identity Protection
Risk Remediation Guide
• Duplicated Local Administrator
• Usage of endpoints that have Non-Privileged Local Administrator
• Stealthy Privileges
Attack Path to Privileged Accounts
Description & Explanation
An attacker with access to an account, user, or endpoint, can move laterally between endpoints in the network to
access an account and eventually acquire permissions to function as a domain administrator. If an account is
compromised in this way the entire domain is compromised.
Steps in a path
For example: A user, StartUserName, has one or more attack paths available to the Privileged account of another user,
EndUserName. Possible steps that an attack might take include:
• Being a local administrator on an endpoint.
• Having a path or being a local administrator on an endpoint that was recently accessed by a privileged
account.
• Being a local administrator on an endpoint that has another local administrator with the same password as
that which belongs to a local administrator of a different endpoint.
• Being a user who is a direct or indirect member of a Group.
Recommended Actions
• Review the attack path and examine which steps can be resolved and removed.
• Ensure that privileged accounts only log into protected endpoints.
• Remove unwanted local administrator privileges.
• Depending on the path that is resolved, it can take between 24 hours – 7 days for the changes to reflect in the
console.
• See the attack path details by navigating to the impacted user’s business card > under the Risk tab:
• Prioritize resolving the Duplicated Local Administrator & Usage of endpoints that have Non-Privileged
Local Administrator risks as this would significantly lower the possibility of new attack paths.
• Use API to List entities with Attack Path to a Privileged Account risk, and
show this path. Sample query:
{
entities(
archived: false
first: 5
riskFactorTypes: [HAS_ATTACK_PATH]
sortKey: RISK_SCORE
11
Identity Protection
Risk Remediation Guide
sortOrder: DESCENDING
)
{
nodes {
primaryDisplayName
secondaryDisplayName
riskScoreSeverity
riskFactors {
type
... on AttackPathBasedRiskFactor {
attackPath {
entity {
primaryDisplayName
type
riskScoreSeverity
}
relation
nextEntity {
primaryDisplayName
type
riskScoreSeverity
}
}
}
}
}
}
}
• KB reference:
o How can I resolve an attack path risk in Identity Protection?
Duplicated Local Administrator
Description & Explanation
Two or more machines were created from the same image and still have the same local administrator username and
password. By compromising one of these machines, an attacker can extract the credentials from the local Security
Account Manager (SAM) database and move laterally to other machines by using pass-the-hash or privilege
escalation.
Recommended Actions
• Change the passwords of the cloned local administrators. To easily manage local administrator passwords,
consider using Microsoft LAPS or another password management solution.
• Identify endpoints with this risk by using custom insights:
12
Identity Protection
Risk Remediation Guide
• Prioritize those duplicated administrators that share the most endpoints.
• Resolving this risk would significantly lower the possibility of new attack paths for the Attack Path to
Privileged Account risk as well.
Usage of endpoints that have Non-Privileged Local Administrator
Description & Explanation
The risk identifies when a privileged account accesses an endpoint that has a non-privileged local administrator. The
privileged account logged into an endpoint that has a nonprivileged local administrator, which can be used to
compromise this account's credentials.
Recommended Actions
• Make sure that privileged accounts only use protected machines. For example, PAW.
• Remove any domain non-privileged or local users from the local administrators’ group on specific endpoints.
• Identify users with this risk by using custom insights:
13
Identity Protection
Risk Remediation Guide
• Resolving this risk would significantly lower the possibility of new attack paths for the Attack Path to
Privileged Account risk as well.
Stealthy Privileges
Description & Explanation
An account that has special permissions and could be used to elevate a user to have AD protected group privileges.
• In many cases, stealthy privileges are a byproduct and are therefore not fully understood or managed.
• User accounts with stealthy privileges are typically easier to compromise and give the attacker an easy way
to escalate the privileges.
• Stealthy admins don’t have AdminSDHolder protection.
Recommended Actions
• Review the privileges that the user account currently has. If they are required, add the user to an AD
protected group. If the privileges are not required, remove them.
• See the user’s stealthy privileges by navigating to the user’s business card > About tab > Privileges:
14
Identity Protection
Risk Remediation Guide
• Use API to find all users with stealthy privileges. Sample query:
{
entities(riskFactorTypes: [STEALTHY_PRIVILEGES]
archived: false
first: 5)
{
nodes {
primaryDisplayName
secondaryDisplayName
roles {
type
}
... on UserEntity {
riskFactors {
type
severity
}
}
}
}
}
• KB references:
o How to remove Effective Replicator privileges?
o How to remove Administrator Password Controller privileges?
o How to remove Permissions On Account Controller privileges?
o How to remove Administrative Group Controllers privileges?
o How to remove Constrained/Unconstrained Account Service Delegation privileges?
o How to remove Object-SID History Takeover privileges?
o How to remove Privileged Application Controller privileges?
Reduce Attack Surface (Bi-weekly)
Review and remediate your Active Directory hygiene and some potential Active Directory mis-configurations bi-weekly
to improve the overall security posture of your environment.
• Inadequate Password Policy
• Insufficient Password Rotation
• GPO Exposed Password
• SMB Signing Disabled
• Stale/Inactive Account
Inadequate Password Policy
Description & Explanation
The password policy for the account allows setting a password that is too short and/or lacks complexity. Short
passwords have relatively low entropy and can be cracked by specialized hardware or even through the use of plain
modern CPUs if the password is short enough.
Recommended Actions
• Make sure the password policy is set to a minimum of 14 characters (as per CIS standards).
• Identify the effective password group policy for the user by navigating to the impacted user’s business card >
under the About tab > Password policy strength:
15
Identity Protection
Risk Remediation Guide
• KB reference:
o Identity Protection Password Policy Strength (Inadequate Password Policy)
Insufficient Password Rotation
Description & Explanation
The end user is configured with a password that never expires and the password was not rotated for more than 6
months. If a password that never expires is compromised, the risk to the network is severe.
Recommended Actions
• Define a password expiration period in the GPO for all end users.
• For those service accounts for which this is not practical, there is no alternative but to assume the associated
risk. However, you should closely and frequently monitor the use of these accounts.
• To view when the password was last changed, navigate to the impacted user’s business card > under the
About tab:
16
Identity Protection
Risk Remediation Guide
• To view the effective password policy for the impacted users, navigate to the impacted user’s business card >
under the About tab > Password policy strength:
• Use API to find all entities that have not changed password in the last year. Sample query:
{
entities(passwordLastChangeEndTime: "P-365d", archived: false, first: 100) {
nodes {
primaryDisplayName
secondaryDisplayName
... on Entity {
accounts {
... on ActiveDirectoryAccountDescriptor {
passwordAttributes {
lastChange
}
}
}
}
}
}
17
Identity Protection
Risk Remediation Guide
}
GPO Exposed Password
Description & Explanation
The account’s password can be extracted by any authenticated account in the domain. Any rogue end user or
malware can acquire and use the account password.
Recommended Actions
• Remove exposed passwords from the Group Policy and reset the respective account passwords.
• To view the group policy with the exposed password, navigate to the impacted user’s business card > under
the Risk tab > GPO Expose Password risk > Additional details:
SMB Signing Disabled
Description & Explanation
An endpoint is configured through GPO to allow unsecure SMB and DCE/RPC connections. When an endpoint is
configured to allow unsecure connections, it is vulnerable to NTLM relay and MiTM attacks that could result in remote
code execution.
Recommended Actions
• Edit the group policies that apply on the endpoint to enforce SMB signing.
o "Microsoft network server: Digitally sign communications (always)" must be enforced (Enabled) via
Group Policy (not Local Security Policies)
18
Identity Protection
Risk Remediation Guide
• KB reference:
o SMB Signing Disabled appears for affected endpoints in Falcon Identity Protection
Inactive Account
Description & Explanation
An account that has not generated any activity for a given time period of more than 21 days (inactive). The account is
not monitored and any suspicious activity conducted on the account can remain unnoticed. Prolonged inactivity is an
indication that the account should be deleted.
Recommended Actions
• Periodically monitor inactive accounts and disable the accounts if possible. If this is not possible, consider
adding an authorizer to the account and use a policy with email verification so that the authorizer is informed
of all activity in this account.
• Enable the Inactive User Usage policy and require MFA for accounts which had previously been inactive.
19
Identity Protection
Risk Remediation Guide
Stale Account
Description & Explanation
An account that has not generated any activity for a given time period of more than 3 months. The account is not
monitored and any suspicious activity conducted on the account can remain unnoticed. Prolonged inactivity is an
indication that the account should be deleted.
Recommended Actions
• Periodically monitor stale accounts and disable the accounts if possible. If this is not possible, consider
adding an authorizer to the account and use a policy with email verification so that the authorizer is informed
of all activity in this account.
• Enable the Stale User Usage policy and require MFA for accounts which had previously been stale.
• How-To Videos:
o Enforcing MFA on Stale Accounts
Disabling Risk Factors
Identity Protection detects a wide range of potential risks to your organization's security posture and uses them to
calculate the risk score for entities.
There is no option to create exceptions for specific entities. However, you can disable specific risk factors so that they
do not contribute to risk scores, and are no longer added to the risk factor lists. For example, if you are following NIST
recommendations and are enforcing strong passwords in your organization, you could potentially disable detection of
the Insufficient Password Rotation risk factor.
Disabling risk factors does not affect related attributes and privileges. For example, disabling the Stealthy Privilege risk
factor does not remove the Stealthy Administrators privilege from an entity, it only alters risk score calculations.
Similarly, insights that rely on attributes rather than risk factors, such as stale accounts, remain unchanged when
disabling a risk factor.
The effects of changing the risk configuration can take a long time to propagate. It could take several days for the
Falcon console to fully reflect the updated risk factor list and relevant risk scores.
To disable detection for specific risk factors:
20
Identity Protection
Risk Remediation Guide
Go to Identity protection > Configure > Risk configuration.
Additional Resources
● Identity Protection Implementation - How to Videos and Additional Information
▪ Identity Protection Getting Started Guide
▪ Identity Protection Risk Remediation Guide
▪ Identity Protection Detections Playbook
▪ Identity Protection Platform Maintenance Guide
▪ Identity Protection Policy Management & Use Cases Guide
21
Identity Protection
Risk Remediation Guide
About CrowdStrike
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern
security with the world’s most advanced cloud-native platform for protecting critical areas
of enterprise risk — endpoints and cloud workloads, identity and data.
Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon®
platform leverages real-time indicators of attack, threat intelligence, evolving adversary
tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate
detections, automated protection and remediation, elite threat hunting and prioritized
observability of vulnerabilities.
Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform
delivers rapid and scalable deployment, superior protection and performance, reduced
complexity and immediate time-to-value.
CrowdStrike. We stop breaches.
© 2025 CrowdStrike, Inc.