Directory Services: LDAP and Active Directory

A directory service is a centralized repository that stores and organizes information about network resources — users, groups, computers, printers, and policies. Rather than maintaining separate user databases on every system, organizations use a directory service as the single source of truth for identity information. All authentication requests are validated against the directory, and access policies are enforced consistently across the enterprise.

LDAP (Lightweight Directory Access Protocol) is the industry-standard protocol for querying and modifying directory services. LDAP organizes entries in a hierarchical tree called the Directory Information Tree (DIT), with entries identified by a Distinguished Name (DN). LDAP runs on port 389 (cleartext) and port 636 (LDAPS — LDAP over TLS). LDAP is the protocol; the directory itself is a separate product.

Active Directory (AD) is Microsoft's enterprise directory service, built on LDAP and Kerberos. It organizes resources into Domains, which group into Trees, which group into Forests. A domain controller (DC) hosts the AD database (NTDS.dit) and handles authentication. AD is the backbone of identity management in most Windows enterprise environments.

Active Directory uses Kerberos as its default authentication protocol. The process works through ticket-granting: the client authenticates to the Key Distribution Center (KDC) and receives a Ticket-Granting Ticket (TGT). When the user needs to access a resource, they present the TGT to get a Service Ticket for that specific resource. Passwords are never sent over the network — only encrypted tickets. This design is central to understanding attacks like Kerberoasting.

Group Policy Objects (GPOs) are AD's mechanism for enforcing security settings across thousands of machines simultaneously. GPOs can configure password complexity requirements, screen lock timeouts, software installation, firewall rules, and registry settings. GPOs are linked to AD containers (sites, domains, OUs) and apply to all users and computers within that container. GPO settings are refreshed every 90 minutes by default, ensuring compliance is maintained even on machines that drift from policy.

Active Directory uses Security Groups to manage access permissions collectively. Instead of assigning permissions to individual users, administrators grant permissions to groups and add users to appropriate groups. Key built-in groups to understand for Security+: Domain Admins (full domain control), Enterprise Admins (forest-wide control), Schema Admins (modify AD schema), and Administrators (local machine admin). Membership in these high-privilege groups must be tightly controlled.

LDAP injection is the directory services equivalent of SQL injection. An attacker manipulates an LDAP query by inserting special characters (*, (, ), \, NUL) into user input that is concatenated directly into an LDAP filter. A successful attack can bypass authentication, extract all directory entries, or modify directory objects. Prevention requires input validation and using parameterized LDAP APIs rather than string concatenation.

Enterprises deploy multiple domain controllers for redundancy and geographic distribution. AD replication keeps all DCs synchronized using the Directory Replication Service (DRS). Attackers exploit replication for the DCSync attack — using replication permissions to request all password hashes from a DC without actually logging on to it. Protecting replication permissions is a critical AD hardening step.

Plain LDAP on port 389 transmits data — including bind credentials — in cleartext, making it vulnerable to interception. Organizations should enforce LDAPS (LDAP over TLS) on port 636 to encrypt all directory traffic. Additionally, LDAP signing and channel binding should be required to prevent relay attacks where an attacker intercepts and replays LDAP authentication messages to gain unauthorized access.

Active Directory environments accumulate misconfigurations over years of operation. Common AD security weaknesses include: unconstrained delegation (allows impersonation of any user), Kerberoastable service accounts with weak passwords, AS-REP roasting targets (accounts with pre-authentication disabled), excessive Domain Admin membership, and AdminSDHolder misconfigurations that grant hidden elevated permissions. Regular AD security assessments using tools like BloodHound help identify these paths.

To clarify the relationship: LDAP is the protocol used to communicate with directories (like HTTP is used to communicate with web servers). Active Directory is Microsoft's directory service product that uses LDAP as its access protocol. Other LDAP-compatible directories include OpenLDAP (open source), Oracle Directory Server, and Red Hat Directory Server. All use LDAP queries but have different management interfaces and additional proprietary features.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: LDAP is the protocol for querying directory services using Distinguished Names in a hierarchical tree, Active Directory uses Kerberos for authentication and GPOs to enforce security settings across domains, and LDAPS on port 636 and LDAP signing should be required to prevent interception and relay attacks. Next up we explore Privileged Access Management (PAM).