AD Fundamentals

Active Directory (AD) is Microsoft's directory service for managing users, computers, and resources in a Windows network. It provides centralized authentication and authorization.

Almost every enterprise runs AD, which makes it a prime target. Compromising AD often means compromising the entire organization.

A domain is the core administrative boundary in AD. It groups objects (users, groups, computers) under a shared database and security policy.

Each domain has a name like corp.example.com. All authentication within the domain is handled by domain controllers.

A Domain Controller (DC) is a server that runs AD Domain Services. It stores the directory database, authenticates logins, and enforces policy.

The directory database lives in the file NTDS.dit. Stealing this file (along with the boot key) lets an attacker extract every password hash in the domain.

A tree is one or more domains sharing a contiguous namespace. A forest is the top-level container holding one or more trees.

The forest is the real security boundary in AD. Within a forest, domains can be reached through trust relationships.

A trust is a relationship that lets users in one domain access resources in another. Trusts can be:

• One-way or two-way: defines direction of access.
• Transitive or non-transitive: whether trust flows through to other domains.

Misconfigured trusts allow attackers to pivot across domains and forests.

Organizational Units (OUs) are containers used to organize objects and delegate administration.

Group Policy Objects (GPOs) apply configuration and security settings to OUs, domains, or sites. Attackers who can edit a GPO can push malicious settings or scripts to many machines at once.

AD uses Kerberos as its primary authentication protocol. Instead of sending passwords, clients exchange tickets issued by the Key Distribution Center (KDC) running on the DC.

A user first gets a Ticket Granting Ticket (TGT), then uses it to request service tickets. Many AD attacks abuse this ticketing system.

AD exposes its directory over LDAP (Lightweight Directory Access Protocol). Authenticated users can query enormous amounts of information: users, groups, computers, and their attributes.

This is why even a low-privileged domain account is valuable. It can enumerate the entire directory to find paths to higher privileges.

Certain groups are the crown jewels of any domain:

• Domain Admins: full control of the domain.
• Enterprise Admins: control across the entire forest.
• Schema Admins: can modify the AD schema.

Privilege escalation in AD usually means finding a path into one of these groups.

A Service Principal Name (SPN) uniquely identifies a service instance tied to an account. Kerberos uses SPNs to issue service tickets.

Accounts with SPNs are interesting targets because their service tickets can be requested and cracked offline, a technique called Kerberoasting that you will study next.

AD centralizes identity for the whole organization, so a single foothold can cascade into total control. Attackers chain low-privilege access, enumeration, and credential theft to reach Domain Admin.

Understanding the structure (domains, trusts, Kerberos, LDAP, privileged groups) lets you spot these paths before an adversary does.

Test your understanding of AD structure.

You now know the building blocks of Active Directory:

• Domains group objects; domain controllers authenticate and store the NTDS.dit database.
• Forests are the security boundary; trusts enable cross-domain access.
• Kerberos and LDAP drive authentication and enumeration.
• Domain Admins and SPNs are high-value targets.

Next you will attack Kerberos directly with Kerberoasting.