Understanding What is Active Directory (AD)
Understanding Active Directory (AD) from Scratch Introduction If you want to learn: Cybersecurity Red Teaming Windows Security Enterprise Infrastructure Active Directory Security then understanding Active Directory (AD) is extremely important. Almost every medium and large organization uses Active Directory to manage: Employees Computers Servers Authentication Permissions Security Policies Access Control Because Active Directory controls authentication and access across the environment, it becomes one of the most heavily targeted technologies during real-world attacks. Many beginners become confused when learning Active Directory because they immediately encounter terms like: Domain Forest Tree OU Kerberos LDAP Trust Relationships Domain Controller GPOs without first understanding the bigger picture. The goal of this article is to explain Active Directory in a simple and beginner-friendly way so that even someone completely new to AD can understand: What Active Directory is Why organizations use it How it works internally What components it contains Why attackers target it How enterprise AD environments are structured This article focuses on building a strong foundational understanding before moving into Active Directory attacks. --- Why Active Directory Matters Active Directory is one of the most important technologies inside enterprise Windows environments because it controls: Authentication Permissions Systems Policies User access Administrative control In many real-world breaches, compromising Active Directory often means compromising the organization itself. This is why Active Directory knowledge is extremely important for: Security Engineers SOC Analysts Pentesters Red Teamers Windows Administrators System Engineers --- What is Active Directory? Imagine a company with: 10,000 employees 5,000 computers Hundreds of servers VPN systems Shared folders Internal applications Printers Multiple departments Now imagine managing everything manually. For every employee: Create accounts manually Reset passwords manually Configure permissions manually Manage every computer individually Apply security settings separately This quickly becomes impossible. Organizations needed a centralized system capable of managing everything from one location. This is where Active Directory comes in. --- Active Directory Definition Active Directory (AD) is a Microsoft directory service used for centralized management inside Windows environments. In simple words: Active Directory is a system that stores information about users, computers, permissions, and network resources so organizations can manage everything centrally. Instead of configuring systems one by one, administrators manage the entire environment through Active Directory. --- Real World Analogy Think of Active Directory like a school management system. A school contains: Students Teachers Departments Rules Permissions Administrative staff Not every student can: Access exam papers Enter staff rooms Modify records Similarly, in Active Directory: Different users have different permissions Administrators control systems centrally Security rules are enforced across the environment --- What Does Active Directory Store? Active Directory stores information about many objects. An object is simply anything stored inside Active Directory. Examples include: | Object | Description | |---|---| | Users | Employee accounts | | Computers | Systems joined to the domain | | Groups | Collections of users/computers | | Servers | File/application servers | | Printers | Shared printers | | Policies | Security configurations | | Shared folders | Network resources | --- Why Organizations Use Active Directory The primary purpose of Active Directory is: Centralized Management This allows administrators to: Create users Reset passwords Apply security policies Deploy software Restrict access Configure permissions Control systems from one central location. Without Active Directory, managing enterprise environments would become extremely difficult. --- Authentication vs Authorization This is one of the most important concepts in Active Directory. Many beginners confuse these two terms. --- What is Authentication? Whenever users attempt to access systems, the organization first needs a way to verify identity. Authentication is the process of verifying whether a user, computer, or system is genuinely who they claim to be. In simple words: Authentication answers: "Who are you?" Example: The Domain Controller verifies whether: the user exists the password is correct the account is allowed to log in If everything is valid: --- Real World Authentication Example Think of authentication like unlocking your phone. When you use: Face ID Fingerprint PIN Password your device first verifies: --- What is Authorization? After authentication succeeds, the next question becomes: Authorization determines what an authenticated user is permitted to do. In simple words: Authorization answers: "What can you access?" Examples: Can the user access HR files? Can the user install software? Is the user an administrator? Can the user log into servers? --- Easy Way to Remember | Term | Meaning | |---|---| | Authentication | Who are you? | | Authorization | What can you access? | --- How Active Directory Works When a user logs into a domain-joined computer, the following process happens: This entire process usually happens within seconds. --- Domain Controller (DC) Managing authentication individually on every computer would quickly become chaotic. Organizations needed a central server responsible for: authentication policies permissions user management This server is called the Domain Controller. --- Domain Controller Definition A Domain Controller (DC) is a Windows server responsible for authentication, authorization, policies, and Active Directory management inside a domain. Think of the Domain Controller as: The brain of Active Directory --- What Does the Domain Controller Do? The Domain Controller is responsible for: Authenticating users Verifying passwords Applying policies Managing permissions Creating Kerberos tickets Storing Active Directory data --- Why Attackers Target Domain Controllers If attackers compromise the Domain Controller, they may gain access to: User credentials Password hashes Administrator accounts Entire domain infrastructure This is why Domain Controllers are considered high-value targets. --- What is a Domain? A domain is a logical grouping of users, computers, servers, groups, and policies inside Active Directory. Example: All systems inside the domain trust the Domain Controller. --- Real World Analogy for Domains Think of a domain like a department inside a company. Example: Each department contains: Employees Systems Permissions Rules Similarly, a domain organizes resources inside Active Directory. --- What is a Forest? As organizations grow larger, they often use multiple domains. A forest is the highest-level structure inside Active Directory that contains one or more domains. Think of a forest as: The complete Active Directory environment Example: --- What is a Tree? When multiple domains share a common namespace and are connected hierarchically, they form a tree. Example: All domains are connected in a parent-child relationship. --- Forest vs Tree vs Domain | Component | Meaning | |---|---| | Domain | Logical container holding users and systems | | Tree | Multiple connected domains | | Forest | Entire top-level AD structure | --- Organizational Units (OUs) Organizational Units (OUs) are containers used to organize objects inside a domain. Administrators use OUs to separate: Departments Teams Locations Servers Workstations Example: --- Users in Active Directory Users are accounts used by: Employees Administrators Applications Services Examples: --- Service Accounts Service accounts are used by applications and services. Examples: These accounts are important from a security perspective because: they often have elevated privileges passwords rarely change weak passwords are common Many attacks like Kerberoasting target service accounts. --- Groups in Active Directory Groups are collections of users or computers used for easier permission management. Instead of assigning permissions individually to hundreds of users, administrators assign permissions to groups. Example: --- Group Policy Objects (GPOs) Group Policy Objects (GPOs) are centralized configurations used to apply security rules and settings across systems. Examples: Force password complexity Disable USB devices Configure firewall rules Deploy software Restrict Control Panel access --- Trust Relationships Trust relationships allow domains or forests to trust each other so users can access resources across environments. One-Way Trust Two-Way Trust --- Kerberos Kerberos is the default authentication protocol used in modern Active Directory environments. Instead of repeatedly sending passwords, Kerberos uses tickets for authentication. Kerberos Authentication Flow --- LDAP LDAP (Lightweight Directory Access Protocol) is used to query and manage information stored inside Active Directory. Attackers commonly use LDAP for: User enumeration Group enumeration Service discovery Domain information gathering --- SMB SMB (Server Message Block) is a protocol used for: File sharing Printer sharing Remote administration Authentication SMB is heavily used inside Windows environments and is commonly targeted during internal attacks. --- DNS in Active Directory DNS is extremely important inside Active Directory environments. Without DNS: systems cannot locate Domain Controllers authentication may fail AD services may break DNS translates domain names into IP addresses so systems can communicate properly. --- Why Attackers Love Active Directory Active Directory controls: Authentication Permissions Servers Policies User access Administrative control Compromising Active Directory often means compromising the organization itself. --- Common Active Directory Attacks Password Spraying Trying common passwords against many users. Kerberoasting Extracting Kerberos service tickets and cracking them offline. AS-REP Roasting Abusing accounts without Kerberos pre-authentication. Pass-the-Hash Using NTLM hashes instead of plaintext passwords. SMB Relay Relaying authentication requests to another system. BloodHound Enumeration Mapping relationships and attack paths inside Active Directory. --- Typical Active Directory Attack Path --- Common Beginner Confusions Forest vs Domain Authentication vs Authorization User vs Service Account Domain Controller vs Domain --- Why Active Directory Environments Become Misconfigured Active Directory environments are often: Large Complex Old Difficult to manage Common issues include: Weak passwords Excessive permissions Misconfigured trusts Weak ACLs Poor GPO management Legacy protocols --- Why Pentesters Focus on Active Directory During internal penetration testing, compromising Active Directory is often the primary objective because it provides: Administrative access Sensitive data access Persistence Infrastructure control --- Conclusion Active Directory is the backbone of most enterprise Windows environments. It manages users, authentication, permissions, policies, computers, and security across organizations. Understanding: Domains Forests Trees OUs Trusts Kerberos LDAP Groups GPOs Authentication is extremely important before learning advanced Active Directory attacks. Once you understand the structure of Active Directory, learning enumeration and attacks becomes significantly easier. --- What to Learn Next After understanding Active Directory basics, the next topics to study are: Kerberos Authentication LDAP Enumeration SMB Enumeration BloodHound Kerberoasting AS-REP Roasting Pass-the-Hash ACL Abuse Delegation Attacks Active Directory Certificate Services (AD CS) Understanding these topics will help you move from basic Active Directory knowledge into offensive Active Directory security and enterp