Migrator Pro for Active Directory 20.11.4 - Security Guide

• All computation is performed on server(s) provided by the customer.
• All data and application logs are stored in a SQL server provided by the customer.

The most sensitive customer data collected and stored by Migrator Pro for Active Directory is the Active Directory data including users, password hashes, groups, contacts, and devices.

• SQL Server Transparent Data Encryption (TDE) can be enabled to encrypt all data at rest.  For more information see https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver15.
• LDAP account passwords and NTLM password hashes (while already encrypted at-rest by TDE) are additionally encrypted by the application with AES-256.

• All communication from the Migrator Pro for Active Directory user interface is secured with HTTPS TLS 1.2.
• The directory sync service communicates with Active Directory using LDAP.
• Device agents communicate securely with the Migrator Pro for Active Directory web service using HTTPS TLS 1.2 to retrieve job details.
• When the optional password change propagation feature is enabled, password changes are relayed between on-premises servers doubly-encrypted, first using AES256 and a key derived from a customer-selected passphrase, then using HTTPS over TLS 1.2. Target passwords are updated using LDAPS, with optional SSL certificate pinning to verify the identity of the target domain controller.

Migrator Pro for Active Directory relies on the following network ports to enable full functionality:

The following ports need to be opened between workstations/servers and writable domain controllers for a successful domain join operation:

• Migrator Pro for Active Directory relies upon Windows Authentication and Active Directory group membership to authenticate users.