Active Directory

Active Directory works as a central phone book and gatekeeper for a Windows network. Microsoft introduced it with Windows 2000 Server, and it remains the standard directory for Windows environments. Every user, computer and group is stored as an object in the AD database, which lives on servers called domain controllers. AD relies on DNS so computers can find their nearest domain controller.

When an employee logs in to a company laptop, this is what happens:

1. The laptop sends the user's credentials to a domain controller.

2. The domain controller checks them against the AD database, usually using the Kerberos protocol (older systems may fall back to NTLM).

3. If they are valid, it issues a ticket that proves the user's identity.

4. Each time the user opens a file share, printer or application, that ticket and the user's group memberships decide whether access is allowed.

Applications and network devices can also query Active Directory directly using LDAP to look up users and check passwords. This single source of truth is why AD sits at the centre of most corporate networks.

Active Directory has a logical structure (how objects are organised) and a physical structure (the servers and network sites that run it).

Logical components

• Objects: every user, computer, group, printer and shared folder is an object with attributes, such as name, email and department.

• Schema: the rulebook that defines which object types and attributes can exist. Plan changes carefully, because schema changes are permanent across the forest.

• Domain: a group of objects managed together under one set of policies, for example netnxt.local.

• Organisational units (OUs): folders inside a domain that group users and computers, for example by department or location, so policies and admin rights can be applied to each group.

• Tree and forest: a tree is a set of related domains; a forest is the top-level container of one or more trees and is the true security boundary. Trusts let users in one domain or forest access resources in another.

• Groups: collections of users that permissions are assigned to, following role-based access control.

Physical components

• Domain controller (DC): a Windows Server that stores a copy of the AD database and handles logins. Most organisations run at least two for resilience.

• Global catalog: a domain controller that holds a searchable summary of every object in the forest, so users can find resources across domains.

• Replication and sites: changes made on one domain controller are copied to the others; sites map AD to physical office locations to keep replication and logins efficient.

• Operations master (FSMO) roles: five special roles held by specific domain controllers to handle tasks that can't run on every DC at once, such as schema changes.

• Read-only domain controller (RODC): a DC with a read-only copy of the database, used in branch offices with weaker physical security.

Active Directory services

• Central management: create, change and remove users, computers and permissions from one place.

• Single sign-on: one company login gives access to file shares, printers and internal apps.

• Consistent security policies: Group Policy enforces password rules, screen locks and software restrictions on every machine.

• Delegated administration: OUs let local IT teams manage their own users without full admin rights.

• Scales with the business: from a single office to global forests with many domains and sites.

Whoever controls Active Directory controls the network. Once attackers reach a domain administrator account, they can log in to any server, read any file share and push changes to every computer. Ransomware groups often use Group Policy to deploy encryption across hundreds of machines at once.

Common Active Directory attacks include:

• Kerberoasting: requesting service tickets and cracking them offline to recover service account passwords.

• Pass-the-hash and relay attacks: reusing or forwarding captured NTLM credentials to impersonate users.

• DCSync: pretending to be a domain controller to pull password hashes for every account.

• Golden Ticket: using a stolen KRBTGT key to forge Kerberos tickets and keep long-term access.

• Excessive privileges: misconfigured accounts and groups with far more access than they need, giving attackers easy paths to admin rights.

Attackers map these weaknesses with freely available tools such as BloodHound, which charts the shortest path to domain admin, and Mimikatz, which extracts passwords and Kerberos tickets from memory.

This is why protecting AD is a core part of any identity and access management programme, and why detecting misuse of identities, known as ITDR, has become its own discipline.

Microsoft's own guidance for securing AD DS focuses on a handful of controls (source):

1. Limit admin rights: apply least privilege, separate admin accounts into tiers and give admin access just in time rather than permanently.

2. Protect admin logins with MFA.

3. Patch domain controllers quickly: unpatched systems remain a leading way in.

4. Retire weak authentication: reduce NTLM, disable RC4 for Kerberos and enforce SMB signing and LDAP channel binding.

5. Secure service accounts: move to group managed service accounts and remove unused service principal names.

6. Rotate the KRBTGT password at least every 180 days, resetting it twice to invalidate forged tickets.

7. Monitor continuously: send domain controller logs to a SIEM and watch for unusual logins, new admin accounts and Group Policy changes.

Active Directory on its own is not a privileged access management (PAM) tool. A PAM solution adds password vaulting, session recording and time-limited admin access on top of it.

Yes. Securing AD well needs specialist skills and round-the-clock monitoring that many mid-sized companies can't staff in-house. A managed security service provider (MSSP) can take on:

• An AD security assessment to find risky permissions, stale accounts and weak settings

• Hardening based on Microsoft and CIS guidance

• 24x7 monitoring of domain controllers and identity activity through a SOC

• Incident response if an account or domain controller is compromised

• Ongoing patching and periodic access reviews

When choosing a provider, check their response times, who has admin access to your environment and how they report on findings.