What is Active Directory (AD)? A Security-Focused Guide

Picture a manufacturing plant running three shifts. Hundreds of workers rotate through shared terminals, logging in and out dozens of times a day to access production systems, quality dashboards, and inventory tools. Behind every one of those sessions, one system decides who gets in, what they can see, and where they can go. That system is Active Directory.

Most organizations treat it as infrastructure plumbing, something that just works in the background. But attackers treat it as the primary target.

According to Semperis' 2024 Ransomware Risk Report, 9 out of 10  organizations reported that their Active Directory environment had been targeted in a ransomware attack. That number stops most security teams cold.

What is Active Directory?

[[content-box]]

This guide covers how Active Directory works, how attackers exploit it, the specific techniques they use, what a real breach costs the business, and the security controls that actually reduce risk.

How Active Directory Handles Authentication and Authorization

Active Directory (AD) functions as the enterprise identity control plane. When a user signs in to a domain-joined device, AD DS works with authentication protocols such as Kerberos to verify the user's identity and provide access to domain resources based on their permissions and group memberships. 

Authentication in AD runs primarily through Kerberos, a ticket-based protocol that verifies both the user and the server without transmitting passwords across the network. LDAP handles directory queries and lookups. NTLM still exists in many environments for legacy compatibility, but its security limitations make it a known liability.

How Active Directory is Structured

Domains, Trees, and Forests

Active Directory uses a hierarchical structure built around domains, trees, and forests. A domain groups users, computers, and devices under a shared policy and database. Multiple domains with a common root form a tree. Multiple trees sharing a schema and trust relationships form a forest, which is the highest-level security boundary in Active Directory.

Critically, a domain is a management boundary. A forest is a security boundary. Objects in different forests cannot interact unless administrators explicitly establish trust relationships between them.

Organizational Units and Group Policy Objects

Within each domain, administrators organize objects into Organizational Units (OUs). OUs let teams delegate administration and apply targeted configurations without touching the entire domain. Group Policy Objects (GPOs) attach to OUs and enforce security settings at scale: password requirements, account lockout thresholds, software restrictions, and more. GPOs are also a common attacker target, because whoever controls GPO creation controls behavior across every machine in scope.

Core Components of Active Directory

Logical Components

The logical layer defines the administrative structure: domains, trees, forests, OUs, and groups. These determine how objects are organized and how policies flow through the directory.

Physical Components: Domain Controllers and Global Catalog Servers

Domain Controllers (DCs) are the servers that host the AD database and process every authentication request. They replicate changes across each other automatically, which means a malicious change on one DC propagates to all others. Because AD changes replicate between domain controllers, unauthorized changes can spread across the environment and complicate recovery from an attack.

Global Catalog Servers store complete copies of objects from their own domain and partial copies from all other domains in the forest. They enable fast resource lookups across the entire environment and are critical for SSO functionality.

Organizations should deploy a minimum of two DCs for redundancy. But redundancy alone does not protect against ransomware. Malicious changes can replicate across domain controllers, allowing attackers to maintain control even when individual systems are restored.

Active Directory Services Beyond AD DS

AD DS is the foundation, but Active Directory includes several additional services that extend its capabilities:

AD FS (Federation Services) enables single sign-on across organizational boundaries, including cloud applications, using claims-based authentication. Critical in hybrid environments.

AD CS (Certificate Services) manages digital certificates for encryption and server identity verification, establishing trust relationships across the network.

AD RMS (Rights Management Services) applies usage restrictions directly to documents and emails, limiting access to authorized recipients regardless of where the file travels.

AD LDS (Lightweight Directory Services) provides directory capabilities for applications that need them without requiring a full domain deployment.

Why Active Directory is a Prime Attack Target

AD concentrates identity and access control for the entire enterprise in one place. Compromise it, and you control everything connected to it. Attackers pursue what security teams call "domain dominance" because it enables them to impersonate any user, modify any permission, disable any security control, and deploy ransomware at scale through trusted identity paths.

From a risk standpoint, AD is a single point of systemic failure. Misconfigurations, weak privilege boundaries, stale accounts, and poor credential hygiene can each create enterprise-wide exposure. The organization does not need to be directly breached. One compromised endpoint with cached credentials is often enough to begin the chain.

How Attackers Move Through Active Directory

Attackers rarely compromise AD in one move. They follow a predictable sequence.

Enumeration

After gaining an initial foothold (typically a workstation or phishing victim), attackers map the environment. They identify privileged groups like Domain Admins, enumerate domain trusts and GPOs, and locate service accounts with elevated permissions. The goal is building a map of "who can access what" before escalating.

Privilege Escalation: Pass-the-Hash and Kerberoasting

Two techniques dominate this stage. In Pass-the-Hash attacks, attackers capture the hashed credential from memory on a compromised machine and use it to authenticate elsewhere on the network without knowing the actual password. In Kerberoasting, attackers request Kerberos service tickets for service accounts and crack them offline. Service accounts often hold excessive privileges and are rarely monitored, making them high-value targets.

Persistence: Golden Tickets, DCSync, GPO Tampering

Once attackers gain privileged access, they establish persistence that survives password resets and endpoint reimaging. Golden Ticket attacks forge Kerberos tickets by compromising the KRBTGT account, which grants unlimited, long-lived access to any resource in the domain. DCSync attacks impersonate a domain controller to pull credential hashes for all accounts in the directory. GPO tampering lets attackers deploy persistent configurations or malicious scripts across every machine in scope, quietly.

Domain Controller Compromise

The endgame is Tier 0: the domain controllers themselves. With DC-level access, attackers can create accounts, modify permissions at scale, disable defenses, access any system through trusted identity paths, and trigger ransomware deployment across the entire network through AD's own replication.

The Business Impact of an AD Breach

A compromised Active Directory does not just disrupt IT. It halts operations. In healthcare, clinicians lose access to patient systems. In manufacturing, production lines stop. In logistics, shipping and inventory systems go offline. The Semperis 2024 report found that 87% of AD attacks caused significant disruption, including data loss and downtime, even in organizations that had recovery processes in place.

Recovery compounds the damage. Restoring an AD forest involves over 40 documented steps and can take days or weeks in complex environments. Only 27% of organizations have dedicated recovery solutions for identity infrastructure. The rest rely on general backup tools that were never designed for AD-specific restoration.

In environments like healthcare and critical infrastructure, where frontline workers depend on shared terminals to do time-sensitive work, that downtime has direct operational and safety consequences. This is precisely why identity-aware access controls built for these environments, like the kind OLOID offers for shared-device workplaces, matter beyond conventional IT security conversations.

Active Directory Security Best Practices

Enforce Least Privilege and a Tiered Admin Model

Separate administrative accounts from standard user accounts. No admin should use their privileged account for daily tasks. Implement a Tiered Administrative Model: Tier 0 covers domain controllers and AD infrastructure; Tier 1 covers servers; Tier 2 covers workstations. Credentials from lower tiers must never touch higher-tier systems. This containment model limits lateral movement paths significantly.

Harden Domain Controllers

Restrict who can log on to DCs. Limit tools and services running on them. Audit privileged group changes, DC logon events, and replication activity. DCs are not general-purpose servers and should not be treated as such.

Monitor for the Right Signals

Monitoring AD without knowing which events matter produces noise, not intelligence. High-signal events include: additions to Domain Admins or other privileged groups (Event ID 4728, 4732), new service account creation, GPO creation and linking changes, DC replication anomalies, and KRBTGT password access. These are the indicators that appear in the early stages of almost every major AD attack chain.

Account Hygiene and Patch Cadence

Audit and remove stale accounts on a defined schedule. Rotate service account credentials. Enforce MFA for all administrator accounts. Patch AD infrastructure on a monthly cycle at minimum, and prioritize vulnerabilities tied to Kerberos, NTLM, and LDAP.

Active Directory for Shared-Device and Frontline Environments

Standard AD identity models assume one person per device. Shared-device environments break that assumption entirely. In manufacturing plants, distribution centers, and hospital floors, multiple workers authenticate on the same terminal across shifts. Without additional controls, AD cannot reliably tie each session back to a specific individual, creating accountability gaps and audit failures.

This is where legacy AD configurations become a liability. When workers share credentials because logging in and out is slow or cumbersome, the accountability trail disappears. It also creates a larger attack surface: one compromised shared credential exposes every user who depends on that terminal. Organizations operating in these environments need identity solutions that enforce per-person authentication at the session level, without adding friction to high-throughput workflows.

AD and Zero Trust: Where They Meet

Active Directory was built on the assumption that users inside the network perimeter could be trusted. Zero Trust rejects that assumption entirely. The two are not incompatible, but connecting them requires deliberate work.

In a Zero Trust model, AD continues to serve as the identity source of truth. What changes is that access decisions no longer rely on domain membership alone. Every access request is validated against contextual signals: device posture, session risk, behavioral anomalies. OLOID's approach to passwordless authentication for frontline and shared-device environments maps directly to this model: each session is tied to a verified individual identity regardless of what device is being used.

Organizations moving toward Zero Trust should treat their AD hardening work as the foundation, not an optional step. A misconfigured AD in a Zero Trust architecture simply moves the vulnerability to a different layer.

Conclusion

Active Directory remains foundational enterprise infrastructure, but protecting it requires more than securing domain controllers and privileged accounts. Organizations also need to understand how identity is established, used, and maintained across every access point.

That becomes especially important in frontline environments where multiple workers share the same devices. Here, security teams need both a hardened AD environment and a reliable way to associate each session with the individual worker.

OLOID addresses this operational gap with passwordless authentication designed for shared-device and frontline environments, helping organizations connect individual identity to every session without slowing down the workflow.

FAQs

1. What is the difference between Active Directory and Azure Active Directory (Entra ID)?

Active Directory runs on-premises and manages authentication for Windows domain networks. Microsoft Entra ID (formerly Azure AD) is its cloud-based counterpart, designed for cloud and SaaS access. Organizations running hybrid environments use Microsoft Entra Connect to synchronize identities between both.

2. What is Kerberos and why does Active Directory use it?

Kerberos is AD's primary authentication protocol. It uses a ticket-based system where users receive encrypted session tickets after initial authentication, which they present to access resources without retransmitting passwords. It prevents common attacks like credential interception and replay.

3. How do attackers use Active Directory for lateral movement?

After compromising one endpoint, attackers use tools like Pass-the-Hash and Kerberoasting to steal or forge credentials, then authenticate to other systems across the domain using those credentials. AD's trust relationships make this movement fast and difficult to detect without dedicated monitoring.

4. What is a Domain Controller and why is it so important to protect?

A Domain Controller hosts the AD database and processes every authentication request in the domain. Compromising a DC gives attackers the ability to create accounts, modify permissions, and control access across the entire network. It is the highest-value target in any AD environment.

5. How does Active Directory work in environments with shared devices or multiple users per machine?

Standard AD assumes one user per device per session. In shared-device environments (manufacturing terminals, clinical workstations, retail POS systems), multiple users authenticate on the same machine across shifts. Without session-level identity controls, AD cannot reliably attribute each action to a specific individual, creating security and compliance gaps that require purpose-built solutions to address.

6. Can Active Directory be used on shared devices?

‍Yes. Active Directory can authenticate multiple users on the same domain-joined device. The operational challenge is ensuring that each worker can authenticate quickly and that every session can be reliably associated with the correct individual. This is particularly important in healthcare, manufacturing, logistics, and other shift-based environments where shared terminals are common.