ASD ISM 1928Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups
Official control statement
Backups of Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are encrypted using ASD-approved cryptography, stored securely and only accessible to backup administrator accounts.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Backups of domain controllers, AD CS, AD FS and Entra Connect servers must be encrypted with ASD-approved cryptography, kept in secure storage, and readable only by backup administrator accounts.
What this means in practice
A backup of a domain controller, an Active Directory Certificate Services (AD CS) server, an Active Directory Federation Services (AD FS) server or a Microsoft Entra Connect server is not just a copy of a machine. It contains the most sensitive secrets in the organisation: the password hashes for every account in the domain (including the KRBTGT account used to mint Kerberos tickets), the private keys of the internal certificate authority, the token-signing keys that federated cloud services trust, and the credentials Entra Connect uses to synchronise identities to the cloud. Whoever holds an unencrypted copy of one of these backups can extract those secrets offline, at leisure, without ever touching the live server. That is enough to forge Kerberos tickets, issue trusted certificates, sign fraudulent federation tokens or pivot into Microsoft 365. Backups are often the weakest link because they sit on file shares, tape, or cloud storage that many people can reach, long after the live server has been locked down. This control closes that gap in three ways. The backup data must be encrypted using cryptography approved by the Australian Signals Directorate (ASD), so a stolen or misplaced backup is useless without the key. The backups must be stored securely, so the encrypted files cannot be casually copied, altered or deleted. And only backup administrator accounts may access them, so the number of identities that could ever read or restore these backups is small, known and separate from everyday accounts.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Server application hardeningTopic
Microsoft Active Directory services
Why it matters
If these backups are unencrypted, stored loosely, or readable by general accounts, an attacker (or a curious insider) who obtains a single backup file can extract every domain password hash, the enterprise CA private key, the AD FS token-signing key and the Entra Connect sync credentials. That enables golden ticket forgery, fraudulent certificate issuance, forged cloud sign-in tokens and silent persistence that survives password resets. The compromise is effectively a full identity-plane breach, typically requiring a domain-wide credential reset, CA and federation key rollover and prolonged incident response, all without any alert from the live systems.
Operational notes
Day to day, this control lives in the backup platform and the identity of the accounts that run it. Backup jobs for domain controllers, AD CS, AD FS and Entra Connect servers should run with ASD-approved encryption switched on by default, so no operator has to remember to enable it per job. Encryption keys or passphrases for those backups need their own custodianship, separate from the backups themselves, so that a compromise of the storage does not also hand over the key.
The backup repository (disk, tape, object storage or immutable vault) should be treated as a Tier 0 asset with the same care as the servers it protects. Access is limited to dedicated backup administrator accounts; day-to-day administrator, help desk and service accounts should have no read, write or restore rights to these backup sets. When staff join or leave the backup team, the membership of the backup administrator group should be updated promptly.
Restores of these servers should be performed only by backup administrator accounts and recorded, because every restore is also a decryption event. Periodic checks that the encryption is actually applied (not just configured), that the storage location remains locked down, and that the access list has not drifted keep the control effective between audits.
Implementation tips
- The backup platform owner enables backup encryption using an ASD-approved algorithm (for example AES-256 as listed in the ISM cryptographic guidelines) as a mandatory, non-overridable setting on every backup job that targets domain controllers, AD CS servers, AD FS servers and Entra Connect servers.
- The identity or Tier 0 administrator creates a dedicated backup administrator group and accounts (separate from domain admin and everyday admin accounts), then grants that group, and only that group, read, write and restore permissions on the backup jobs and the repository holding these server backups.
- The infrastructure or storage team places these backups in a hardened repository (an isolated backup server, immutable or write-once storage, or an encrypted vault) with network access limited to the backup servers, and removes any general file-share or open bucket access to the location.
- The security team or key custodian stores the backup encryption keys or passphrases in an approved key management system or password vault under a separate access list, so that the keys are never kept alongside the backup files or in the backup job configuration in clear text.
- The backup platform owner enables audit logging on the backup software and repository, and reviews the logs of backup access and restore operations for these servers on a set schedule to confirm that only backup administrator accounts are touching them.
Audit / evidence tips
- AskAsk for the backup job configuration for the domain controllers, AD CS, AD FS and Entra Connect servers, including the encryption settings.Look atConfirm that every one of those server types is actually covered by a job and that encryption is enabled with an algorithm and key length that the ISM lists as ASD-approved.GoodAll four server types are in scope, encryption is on for each job as an enforced setting, and the algorithm named matches ASD-approved cryptography rather than a vendor default or legacy cipher.
- AskAsk for the list of accounts and groups that have permissions on the backup repository and on the backup jobs for these servers.Look atCheck whether the permitted identities are dedicated backup administrator accounts, and whether domain admins, help desk staff, service accounts or broad groups such as Everyone or Authenticated Users also have access.GoodOnly a small, named set of backup administrator accounts holds read, write and restore rights, and there is a clear separation from everyday and privileged administrator accounts.
- AskAsk where the encrypted backups are physically or logically stored and what protects that location.Look atReview the storage configuration (share permissions, bucket policies, immutability or write-once settings, network restrictions, physical controls for tape or removable media).GoodThe repository is isolated from general user access, protected against modification or deletion, and reachable only from backup infrastructure and by backup administrator accounts.
- AskAsk how the backup encryption keys or passphrases are generated, stored and who can retrieve them.Look atCheck that the key is held in a key management system or vault with its own access list, not stored in clear text in the backup job or beside the backup files.GoodKeys are kept separately from the backups under restricted custodianship, and the people who can obtain the key are documented and limited.
- AskAsk for backup and restore audit logs for these servers covering a recent period.Look atCompare the accounts that performed backup, read and restore actions against the approved backup administrator list, and look for any access by other accounts.GoodEvery recorded access and restore is attributable to an approved backup administrator account, and the organisation can show it reviews these logs periodically.
Cross-framework mappings
How ISM-1928 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.15 | ISM-1928 requires strict logical access control for AD/Entra Connect server backups, limiting access to backup administrator accounts and... | |
| Annex A 8.13 | ISM-1928 requires a specific set of backup protection measures for Microsoft identity infrastructure servers, including ASD-approved encr... | |
extensionDepends on(1)expand_less | ||
| Annex A 8.24 | ISM-1928 requires backups of AD DS/AD CS/AD FS/Entra Connect servers to be encrypted using ASD-approved cryptography and stored securely ... | |
E8
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(1)expand_less | ||
sync_altPartially overlaps(6)expand_less | ||
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.