Active Directory (AD) is Microsoft’s directory service for managing users, computers, groups and permissions in Windows environments. It stores identity information and answers the question every system keeps asking: who is this, and what are they allowed to do?

What is Active Directory used for?

AD gives organisations one place to create accounts, group them, apply policies and control access to servers, applications and files. Users sign in once and their permissions follow them across the domain. Many other tools, from email to business applications, rely on it for identity.

How does Active Directory authenticate users?

Domain controllers, the servers that run AD, handle sign-in. Authentication relies mainly on Kerberos, which uses tickets, and NTLM remains active in many environments for older systems. Applications and tools read the directory through LDAP.

What is a domain controller?

A domain controller is a server that runs AD for a domain. It authenticates requests, applies policies and holds the directory database, including password hashes. Compromising one gives an attacker the credentials of the whole domain, so these servers are among the most sensitive assets in a Windows environment.

What are Domain Admins and other privileged groups?

Groups such as Domain Admins and Enterprise Admins hold broad rights across a domain or forest. Membership should be rare, temporary and reviewed. In practice these groups tend to grow, because adding someone is easier than removing them later.

Why do attackers target Active Directory?

Because it holds the keys. Whoever controls AD controls access to almost everything connected to it. A single foothold, such as a phished account, can become control of the whole domain if the attacker reaches a privileged group like Domain Admins.

Which attacks work against Active Directory?

• Pass-the-hash: using a stolen password hash to authenticate without the password.
• Kerberoasting: requesting service tickets for service accounts and cracking them offline.
• Privilege escalation: abusing misconfigured groups and permissions to gain more access.
• Lateral movement: using valid accounts and admin tools to move from machine to machine.

None of them needs malware. Each one uses the way AD is designed to work, which is why they are hard to tell from normal activity.

What is a golden ticket attack?

An attacker who obtains the credentials of the account that signs Kerberos tickets, called krbtgt, can forge tickets and impersonate any user for as long as that key stays unchanged. It is a way to keep access after the original foothold has been found.

Can Active Directory enforce MFA?

Kerberos and NTLM do not support MFA natively, so accounts that authenticate with them usually need additional controls. This is one reason valid credentials can be so useful to attackers inside a domain.

What are the warning signs of Active Directory abuse?

• New members added to privileged groups.
• Unusual volumes of directory or LDAP queries.
• Service ticket requests for many accounts in a short time.
• Logins by accounts to systems they never use.
• Changes to group policy outside normal change windows.

How is Active Directory different from Entra ID?

AD is mostly used in on-premises Windows environments. Entra ID, formerly Azure AD, is Microsoft’s cloud identity service. Many organisations run both and synchronise them, so a weakness on one side can carry over to the other. A compromised on-premises account can become a cloud problem, and the reverse.

Why is Active Directory hard to secure?

It grows for years. Over time it collects accounts, groups and nested permissions that nobody fully understands, and removing the wrong permission can break an application. This is why continuous visibility matters more than a one-off clean-up.

How do you reduce Active Directory risk?

Keep privileged groups small, retire dormant accounts, use long unique passwords or managed accounts for services, reduce legacy protocols and treat directory changes as security events.

Sharelock gives continuous visibility on identities, privileges and group membership, so excess access and dormant accounts surface early. Detection then watches for the behaviour that follows, such as privilege changes and unusual movement between systems.