What Is Active Directory?

Active Directory is the dominant enterprise directory service and the centre of gravity in most corporate networks. It holds the accounts, enforces the policies and issues the tickets that grant access to nearly everything.

That centrality makes it the primary objective in almost every internal intrusion. Compromising it is not a step toward the goal — in most estates it is the goal, because domain control means control of everything the domain touches.

Why attackers target it so consistently

The path is well documented and reliably available. A foothold on any domain-joined machine yields credential material. That material enables movement to another machine. Repeated, this reaches an account with elevated rights, and from there the domain.

The techniques have names, tooling and extensive public documentation. They work because they abuse legitimate protocol behaviour rather than exploiting vulnerabilities, which is why patching alone does not address them.

The controls that actually reduce exposure

Tiered administration is the most effective and the least commonly implemented. Domain administrator credentials should never be used on ordinary workstations, because a credential used on a compromised machine is a credential the attacker now has.

Unique local administrator passwords per machine prevent one compromise yielding access to hundreds. Privileged access workstations give administrators a hardened machine for administrative work. Service account hygiene matters because over-privileged service accounts with weak passwords are a recurring escalation path.

And monitoring the directory itself — changes to privileged groups, unusual ticket requests, replication from unexpected sources — is where compromise becomes visible.

Group nesting hides effective privilege

Groups can contain groups, and in a mature domain the nesting runs several levels deep. The result is that membership of an innocuous-looking group can confer administrative rights through a chain nobody has traced.

This is why point-in-time membership lists mislead. The question that matters is effective privilege — what can this account actually do, through every path — and answering it requires tooling that resolves the nesting rather than reading the direct members of a group.

Attack path analysis tools do this and are worth running periodically. They routinely reveal that an ordinary user account has a short path to domain administrator through relationships nobody intended to create.

Backup and recovery of the directory itself

A domain compromise raises a question most organisations have never considered: how would you rebuild the directory if you could no longer trust it?

Restoring from backup is not straightforward when the attacker has had privileged access for weeks and the backups contain their changes. Forest recovery is a documented but genuinely difficult procedure, and organisations that have not rehearsed it discover its complexity during the worst week of their year.

Having offline copies of the directory, documented recovery procedures and a tested understanding of the sequence turns a catastrophic scenario into a difficult but survivable one.

The thing most worth getting right

Where to start

Establish whether domain administrator accounts are ever used to log into ordinary workstations. If they are, that single practice undermines most other identity controls you operate.

See privileged access management. GuardsArm runs security risk assessments.