Hardening your Microsoft networks from exploitation

A few resources one would want to use for this:

Mitigation guidance for active directory 

https://blogs.microsoft.com/cybertrust/2013/06/03/microsoft-releases-new-mitigation-guidance-for-active-directory/

Securing Privileged Access

https://technet.microsoft.com/en-us/library/mt631194.aspx

Privileged Access Workstations

https://technet.microsoft.com/en-US/library/mt634654.aspx

Securing Privileged Access Reference Material

https://technet.microsoft.com/en-US/library/mt631193.aspx#ADATM_BM

Tracking Lateral Movement Part One - Special Groups and Specific Service Accounts

http://blogs.technet.com/b/jepayne/archive/2015/11/27/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts.aspx

I could write a really.... really long blog about this. This reference material I posted above should get some ideas generated for you.

Don't forget. Set yourself up an isolated Security Compliance Management Box off your network.
https://technet.microsoft.com/en-us/solutionaccelerators/cc835245.aspx

Definitely do the Windows Server 2012R2 Domain Controller Security and Member Server Security compliance from the Solution Accelerator. 

Thanks,

Root :)