Identity · Directories
Active Directory
Microsoft's on premises directory service, providing authentication, authorisation, policy and object management for Windows environments.
Overview
Active Directory Domain Services stores users, groups, computers and service objects in a hierarchical database replicated between domain controllers. It authenticates with Kerberos, is queried over LDAP, and depends absolutely on DNS for locating services.
Despite a decade of cloud migration, AD remains the authoritative source for most enterprise on premises access, and it is frequently synchronised to a cloud identity provider rather than replaced. That makes it both essential and one of the highest value targets in any estate.
How it works
- 01The forest is the security boundary. Domains inside a forest share schema and configuration, and trusts define relationships between domains and forests.
- 02Organisational units organise objects for delegation and Group Policy targeting. Group Policy Objects deliver configuration to users and computers at each refresh interval.
- 03Domain controllers replicate using multi master replication over sites and site links, with certain single master roles (FSMO) held by specific controllers.
- 04Clients locate controllers via DNS SRV records, obtain Kerberos tickets from the Key Distribution Center, and present those tickets to services.
Why it matters
- Compromise of AD is effectively compromise of every Windows joined system and often of hybrid cloud identity too.
- Group Policy remains the fastest way to configure large numbers of domain joined machines, and the most common source of unexplained behaviour.
- Hybrid identity design, what synchronises, in which direction, with which authentication method, determines cloud security posture.
Sequence
- 1User enters credentials
- 2DNS SRV lookup for a domain controller
- 3Kerberos AS REQ to KDC
- 4Ticket Granting Ticket issued
- 5TGS request for the target service
- 6Service ticket presented to the resource
Where it is used
- Single sign on to file services, print, internal web applications and line of business systems.
- Centralised device configuration and security baselines via Group Policy.
- Certificate issuance through Active Directory Certificate Services.
- Source of authority for identity lifecycle feeding cloud identity providers.
Security considerations
- Tier administrative access: separate accounts for domain, server and workstation administration, used only from privileged access workstations.
- Protect and monitor Domain Admins, Enterprise Admins, DnsAdmins, backup operators and any group with delegated write on sensitive objects.
- Remove unconstrained delegation, disable legacy protocols, require LDAP signing and channel binding.
- Watch for Kerberoasting, AS REP roasting, DCSync, golden and silver ticket activity, and ACL abuse paths; run attack path tooling regularly.
- Keep tested offline backups of system state and rehearse forest recovery, ransomware operators specifically target domain controllers and backups.
Common misconfigurations
- Service accounts with weak passwords and SPNs set, enabling offline ticket cracking.
- Users granted local administrator rights on their own workstations by default.
- Nested group sprawl that hides effective privilege.
- Stale accounts and computers left enabled for years.
- Domain controllers with unnecessary roles, internet access or additional software installed.
IT vs OT
Many OT environments are domain joined to a dedicated plant domain or intentionally isolated with local accounts. Never extend an enterprise AD forest into a process control network without an explicit trust and DMZ design.
IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.
Notes
Treat AD as a Tier 0 asset alongside PKI, virtualization management and backup systems. Anything that can administer Tier 0 belongs to Tier 0.