Active Directory (AD) is Microsoft’s directory service that stores users, computers and groups and controls authentication and access in Windows networks.
How Active Directory works
Active Directory Domain Services (AD DS) was introduced with Windows 2000 Server. Its database runs on domain controllers and is organised into forests, domains and organisational units (OUs). AD combines several standard protocols:
- Kerberos (and the older NTLM) for authentication and single sign-on;
- LDAP for directory queries;
- DNS for locating domain controllers;
- Group Policy for pushing security settings to thousands of machines.
Microsoft Entra ID (formerly Azure AD) is a separate cloud identity service; many companies run both in a hybrid setup.
Why Active Directory matters for security
Whoever controls AD controls the whole company network, so it is a central target in ransomware and APT attacks. Common techniques include Kerberoasting (cracking service account passwords offline), pass-the-hash, DCSync (copying password hashes from a domain controller) and Golden Ticket attacks with the stolen krbtgt key. Tools such as BloodHound map hidden paths from a normal user to Domain Admin through nested groups and misconfigured permissions.
Best practices
- Use separate, tiered administrator accounts and never log in to workstations as Domain Admin.
- Deploy Windows LAPS for unique local admin passwords and use long passwords or gMSA for service accounts.
- Restrict or disable NTLM, enable LDAP signing and patch domain controllers first.
- Monitor changes to privileged groups and audit AD regularly with tools like PingCastle or BloodHound.
