Securing Active Directory Against Ransomware in Public Sector | IS Decisions

Securing Active Directory Against Ransomware in Public Sector

This article was originally published by LOGON’s partner IS Decisions. Click here to view the original article.

Ransomware isn’t just a private-sector problem. Government and public sector organizations face the same threat actors, often with tighter budgets and older infrastructure. Strong Active Directory (AD) security is where government IT teams should start.

Why Ransomware Targets Government

Since 2020, ransomware has hit government organizations across the US and UK, including state governments and local councils.

Factor	Why It Matters
Disruption	Commercial ransomware gangs have merged with nation-state actors bent on disruption for its own sake
Budgetary constraints	Government cybersecurity budgets are often tight, making security gaps more likely
Legacy systems	Government relies on older technology with widely known vulnerabilities

For ransomware groups, the public sector has become a consistent, attractive target. No organization is exempt.

Why Active Directory Is Targeted During Ransomware Attacks

Stage	What Happens
1. Point of compromise	Attackers find a weak account credential
2. Foothold established	Attackers move invisibly behind defenses
3. AD Domain Controllers targeted	AD is the foundation of network identity and access. Compromise a DC, and attackers can see and control almost everything.

The challenge: AD lacks built-in monitoring. Security teams often only realize a compromise has happened when it’s too late.

Securing Active Directory with UserLock

Defending AD requires two things:

Defend the vulnerable credentials used to gain an initial foothold
Build a deeper internal defense around AD itself

Challenge	UserLock Solution
Implementing MFA in on-prem AD requires complex middleware or cloud migration	Runs on-premises on a single server; no migration required
Standard MFA doesn’t protect AD if breached	Applies MFA directly on top of existing AD policies
MFA alone isn’t enough	Adds session-based and contextual access controls

Key capability: UserLock’s MFA can be applied by session and connection type, including UAC prompts to protect against lateral movement.

Protecting AD with Session and Contextual Controls

Control	What It Does
Concurrent session limits	Restricts multiple connections opened by a single user
Workstation/device restriction	Limits which devices a user can access
IP range restriction	Controls access by location
Connection type restriction	Limits access by workstation, terminal, Wi-Fi, VPN, IIS, SaaS
Time-based access	Restricts access by time of day

Monitoring AD Account Behavior

AD has no built-in account monitoring. UserLock addresses this with customizable alerts:

Alert Criteria	What It Monitors
Connection type	Blocked connections or MFA rejections
User, group, OU	Unusual access patterns
Time or IP range	Suspicious activity outside normal patterns

Administrators are immediately alerted to unusual access, helping detect threats before they reach AD.

Bottom Line

Challenge	How UserLock Helps
Prevent initial compromise	MFA for all credentials
Limit attacker access	Session and contextual controls
Detect suspicious activity	Real-time monitoring and alerts
Avoid complexity	Single on-prem server, no migration required

The result: IT teams can better prevent ransomware attacks, limit what attackers can access if an account is compromised, and detect suspicious activity before it reaches AD.

Ready to secure your Active Directory against ransomware?

LOGON Software Asia – the trusted IS Decisions partner across Asia – offers:

✅ Free Proof of Concept (POC)
✅ Preferred pricing
✅ Priority support
✅ Local expertise

User Logon Security for Windows Active Directory

Enable customized, two-factor authentication (2FA) on Windows logon, Remote Desktop (RDP & RD Gateway), IIS, VPN and Cloud Applications. Apply customized login restrictions by user, group or organizational unit (OU).

Solution Highlight

Get started with UserLock

Start a free trial with UserLock, with 30-day full version, no user limit, and free technical support.

Start Your Free Trial

Blog, ISDecision Blog, UserLock