Active Directory Fundamentals: Windows Network Domains
A comprehensive introduction to Microsoft Active Directory covering domain services, LDAP, Group Policy, authentication protocols, and security fundamentals for Windows enterprise environments.
Understanding Active Directory
Microsoft Active Directory (AD) is the directory service used in Windows enterprise environments to manage users, computers, groups, and network resources. First introduced with Windows 2000 Server, AD has become the backbone of identity and access management for the majority of organizations worldwide. Understanding AD is essential for any security professional because it represents both the central authentication authority and a prime target for attackers.
Active Directory stores information about network objects in a hierarchical database and makes this information available to administrators and users. It provides authentication, authorization, and accounting services through a centralized, policy-based infrastructure.
Prerequisites
Before diving into Active Directory security, you should have a solid understanding of:
Core Components of Active Directory
Domain Controllers
Domain Controllers (DCs) are servers that host Active Directory Domain Services (AD DS). They store the directory database, authenticate users and computers, and replicate changes across the domain. Every domain should have at least two DCs for redundancy. The DC is the most critical server in a Windows network and the highest-value target for attackers.
The AD Database (NTDS.dit)
The heart of Active Directory is the NTDS.dit file, typically located at C:\Windows\NTDS\NTDS.dit. This database file stores all directory data including user objects, computer accounts, group memberships, password hashes, and security policies. If an attacker gains access to this file, they effectively own the entire domain.
LDAP Protocol
Active Directory uses Lightweight Directory Access Protocol (LDAP) for querying and modifying the directory. LDAP is an open, vendor-neutral protocol for accessing directory services over TCP port 389 (or 636 for LDAPS). Understanding LDAP queries is crucial for security analysis.
# Query AD for all enabled users
Get-ADUser -Filter {Enabled -eq $true} -Properties *
# LDAP query using ADSI
$searcher = [ADSISearcher]"(objectCategory=user)"
$searcher.FindAll()
Domain, Trees, and Forests
AD organizes resources hierarchically. A domain is the core administrative unit, identified by its DNS name (like corp.example.com). A tree is a collection of domains sharing a contiguous DNS namespace. A forest is the highest-level container, grouping multiple trees that share a common schema and global catalog.
Trust relationships connect domains and forests. Trusts allow users in one domain to access resources in another. Attackers frequently exploit trust relationships during lateral movement.
Authentication Protocols in Active Directory
Kerberos
Kerberos is the default authentication protocol in modern Active Directory environments. It uses tickets and a trusted third-party (the Key Distribution Center on the Domain Controller) to authenticate users without transmitting passwords over the network. We cover Kerberos in depth in our dedicated article.
NTLM
NT LAN Manager (NTLM) is a legacy authentication protocol that remains enabled in most environments for backward compatibility. NTLM uses a challenge-response mechanism and is vulnerable to several attack types, including pass-the-hash and relay attacks. Disabling NTLM is a recommended security hardening step.
Group Policy
Group Policy is a feature that allows administrators to define and enforce configuration settings for users and computers across the domain. Group Policies are applied hierarchically at the site, domain, and organizational unit (OU) levels.
# Backup all Group Policies
Backup-GPO -All -Path C:\GPOBackup
# Get resulting policy for a specific user
gpresult /user targetuser /scope computer /v
From a security perspective, Group Policy is significant because misconfigured policies can introduce vulnerabilities, and attackers who gain sufficient privileges can modify policies to deploy malware or disable security controls.
Security Principles in Active Directory
The Active Directory Attack Surface
AD is a high-value target for several reasons:
Common Misconfigurations
The most common AD security issues include overly permissive ACLs, service accounts with excessive privileges, legacy protocol support (NTLM, SMB1), unpatched domain controllers, weak password policies, and excessive group memberships (especially Domain Admin).
Real-World Example: Initial Compromise to Domain Admin
Consider a realistic attack chain:
This chain illustrates why AD security requires defense in depth. Each step could have been blocked with proper security controls.
Common Mistakes
Best Practices
Related Tools
Related Articles
Summary
Active Directory is the central authentication and management system for Windows enterprise environments. Understanding its components — domain controllers, LDAP, Kerberos, NTLM, Group Policy, and trust relationships — is essential for security professionals. The AD attack surface is broad, but proper security controls, monitoring, and hygiene can significantly reduce risk.
Related SMB Tool Recommendations
Knowledge Check
References
{@ref mitre-attack-enterprise}
{@ref mitre-attack-credential-access}