What is Active Directory?

Overview

Active Directory is the central identity/policy database for Windows networks. A domain is a security boundary; the domain controller (DC) authenticates everyone and holds NTDS.dit; a forest groups domains. Owning the DC / Domain Admin = owning everything joined.

Why it matters

AD centralises authentication and management across an organisation, so compromising it compromises every joined machine and user at once. It's the universal high-value target of internal engagements, and most AD attacks abuse configuration, not exploits.

Core concepts

Domain. Security boundary of users/computers/groups. Domain controller. Runs AD, stores NTDS.dit, authenticates all — DC compromise = domain compromise. Forest & trusts. Top boundary; cross-domain access. Domain Admin. Control of everything joined.

Lesson

Active Directory (AD) is Microsoft's directory service — the central database of identities and policy that runs almost every corporate Windows network.

The model

• A domain is a security boundary grouping users, computers, and groups under one authority.
• A domain controller (DC) is a server running AD; it authenticates everyone and stores the directory database (NTDS.dit). Compromising a DC = owning the domain.
• A forest is one or more domains sharing a schema and trust — the top-level boundary.
• Trusts let one domain's users access another's resources.

Why it's the prize

In a domain, you don't log into each machine separately — AD centralises authentication (single sign-on via Kerberos) and management (Group Policy pushes settings to every host). That centralisation is exactly why AD is the universal target: Domain Admin (or DC compromise) means control of every joined machine, user, and resource at once.

What testing AD looks like

Enumerate the directory (users, groups, computers, policies, trusts), find misconfigurations and credential-exposure, and chain them into a path to Domain Admin — usually with far less "exploitation" than configuration abuse. The next lessons cover the pieces.

Summary

AD is the centralised directory that authenticates and manages a Windows estate; the domain controller and Domain Admin are the crown jewels because they confer control over every joined resource. AD attacks chain misconfigurations toward that goal.