What is Active Directory?

Active Directory in plain English

Picture a large office building. At the front desk sits a security guard with a thick directory listing every employee, every room, and every key. The guard checks each ID badge and hands out only the keys that person is entitled to. Active Directory plays this role in the corporate network – hence the term directory service.

When you sign in to your computer in the morning, AD checks your password in the background. It determines which network drives, printers, and programs you’re allowed to use. For the IT team, this is convenient: it can manage everything centrally instead of setting up each computer individually.

The flip side: whoever controls AD holds the master key to the entire company – a high-value target for attackers.

How Active Directory works

Microsoft introduced Active Directory with Windows 2000 Server; today it is widely used in corporate networks. Its key components:

1. Domain controllers: servers that store the AD database and verify every sign-in. There are usually several, in case one fails.
2. Domain: the shared administrative scope, for example covering all of a company’s accounts and computers.
3. Users and groups: accounts are organized into groups such as “Accounting.” Ideally, IT assigns permissions to groups rather than to individual people. Besides personal accounts, there are service accounts: technical accounts that programs run under.
4. Group Policy: IT uses it to roll out settings and software to all computers automatically, such as screen locks or security requirements.
5. Authentication protocols: AD relies primarily on Kerberos. After signing in, users receive digital “admission tickets” that let them prove their identity to other services without entering their password again. The older NTLM protocol is often still enabled as well.
6. Privileged accounts: members of the “Domain Admins” group can do practically anything – create accounts, reset passwords, change policies.

Classic AD should not be confused with Entra ID, Microsoft’s cloud identity service, which was called Azure Active Directory until 2023. Many companies use both and synchronize their accounts. Weaknesses in one system can then affect the other.

A practical example

A mid-sized machinery manufacturer commissions an assessment of its Active Directory, which has grown over many years. The testing team starts out the way an attacker would after a successful phishing email: with the ordinary account of an office clerk. An old service account for backups quickly stands out. It has Domain Admin rights “just to avoid problems,” and its password hasn’t been changed in years.

Any regular account may request a Kerberos ticket for a service account that has a network service registered to it. Part of this ticket is – simply put – encrypted with the service account’s password. That’s why the password can be cracked offline, meaning on the attacker’s own computer, without any failed attempts being noticed. The technique is called Kerberoasting. Because the password is short and simple, this succeeds quickly – and the testing team gains control of the entire domain. The fix is straightforward: the service account now gets only the rights it needs, plus a long, automatically managed password.

Why does this matter for businesses?

Active Directory is the heart of your IT. Anyone who gains Domain Admin rights there can read data on every server, switch off security software, and use Group Policy to push malware to every computer. That’s why, in attacks involving ransomware – extortion malware that encrypts data – taking over AD is often the decisive step.

The insidious part: weaknesses usually creep in gradually. Responsibilities change, service accounts are left in place, and permissions are granted “temporarily” and never revoked. Each setting seems harmless on its own; only in combination does an attack path emerge.

Regulations address the issue as well. The NIS2 Directive, for example, lists access control policies and multi-factor authentication solutions among its minimum measures. And the IT-Grundschutz Compendium – the catalog of baseline security requirements published by the BSI (Germany’s Federal Office for Information Security) – contains a dedicated module on Active Directory.

How to protect your organization

• Separate admin accounts: Administrators use a regular account for email and the internet and their privileged account only for administrative tasks – ideally on dedicated admin workstations.
• Clean up permissions: Regularly review the members of privileged groups and remove old accounts and unnecessary permissions.
• Secure service accounts: Assign long, random passwords or use group Managed Service Accounts (gMSA), whose passwords AD changes automatically.
• Make local admin passwords unique: The administrator account on every single computer needs its own password. LAPS, the solution built into Windows, assigns and rotates these passwords automatically. This makes techniques like pass-the-hash harder.
• Disable outdated protocols: Turn off legacy authentication and encryption methods such as NTLMv1 or RC4 wherever possible.
• Add a second layer of protection: Use MFA – signing in with a second factor – for remote access, cloud services, and, where possible, administrative access.
• Monitor and test: Log critical changes, for example to admin groups, and have your AD regularly assessed from an attacker’s perspective.

How Rootsektor can help

In our Active Directory security assessment, we uncover attack paths, risky permissions, and outdated settings from an attacker’s perspective and show you where to close them most effectively. We carry out internal tests either on-site or remotely, as you prefer. You’ll receive a fixed-price quote within 24 hours (on business days) after scoping – you can request it via our Pentest Quote page.