Active Directory Fundamentals
Learn the AD hierarchy, GPOs, LDAP, and the Kerberos/NTLM authentication protocols that the next lesson's attacks (Kerberoasting, DCSync, Golden Ticket) all build on.
Learning Objectives
- → Explain the core AD hierarchy: forest, domain, organizational unit, domain controller
- → Describe how Group Policy Objects (GPOs) enforce configuration across a domain
- → Explain LDAP's role as the protocol AD is queried and administered through
- → Distinguish Kerberos from NTLM as AD's two authentication protocols
- → Describe trust relationships between domains and forests
What Is Active Directory?
Active Directory (AD) is Microsoft's directory service — a centralized database of users, computers, groups, and policies for a Windows network. It answers one question at massive scale: "who is allowed to do what, on which machine, right now?" Understanding AD's structure is the prerequisite for understanding how it gets attacked (see "Active Directory Attacks," the next lesson).
The AD Hierarchy
| Level | What it is |
|---|---|
| Forest | The top-level security boundary; one or more domains that trust each other automatically |
| Domain | An administrative/security boundary within a forest; has its own domain controllers, users, policy |
| Organizational Unit (OU) | A folder-like container inside a domain used to group users/computers/GPOs logically |
| Domain Controller (DC) | The server that holds the AD database (NTDS.dit) and answers authentication requests |
A small company might have one forest, one domain. A large enterprise might have a forest with dozens of domains, each with its own DCs, connected by trust relationships.
Domain Controllers and SYSVOL
Every domain controller holds a copy of the domain's database. SYSVOL is a shared folder replicated across every DC in a domain, holding Group Policy templates and login scripts — this is why SYSVOL access control matters enormously from a security standpoint.
Group Policy Objects (GPOs)
A GPO is a bundle of configuration settings — password policy, software restrictions, firewall rules, login scripts — linked to a domain, site, or OU and applied to every computer/user underneath it. GPOs are how "every laptop in the Finance OU must have BitLocker enabled" gets enforced centrally without touching each machine by hand.
LDAP: The Query Protocol
The Lightweight Directory Access Protocol (LDAP) is how AD is actually queried and administered — every "find all users in this OU" or "what groups does this account belong to" operation is an LDAP query underneath the GUI tools. LDAP typically runs on port 389 (plaintext) or 636 (LDAPS, encrypted).
Authentication: Kerberos and NTLM
| Protocol | How it works (simplified) | Status |
|---|---|---|
| Kerberos | Ticket-based: a client gets a Ticket Granting Ticket (TGT) from the DC, then trades it for service tickets (TGS) to access specific resources | Modern default |
| NTLM | Challenge-response hash-based authentication, no tickets | Legacy, still enabled for compatibility |
Kerberos is the modern default and generally more secure, but NTLM remains enabled in most environments for backward compatibility — and that coexistence is exactly what many AD attacks exploit.
Trust Relationships
A trust lets users in one domain authenticate to resources in another. Trusts can be one-way or two-way, transitive or non-transitive. Within a single forest, domains trust each other automatically and transitively; trusts between separate forests must be configured explicitly.
Why This Matters Before Attacking AD
Every technique in the next lesson maps directly back to a concept here: Kerberoasting targets the Kerberos TGS exchange described above; Golden/Silver Ticket attacks forge Kerberos tickets using stolen key material; DCSync abuses a domain controller's replication permissions; lateral movement across trusts depends on understanding which domains trust which.
Common Pitfalls
- Treating "domain" and "forest" as interchangeable — the forest is the actual security boundary, not the domain
- Assuming NTLM is disabled just because Kerberos is the default — it almost never is, for compatibility reasons
- Underestimating SYSVOL and GPO access as "just configuration," when they are a direct path to compromising every machine that applies them
Domains within the same forest trust each other automatically — the forest, not the domain, is where the real security boundary sits.
Which AD construct is the actual top-level security boundary?
Kerberos issues a Ticket Granting Ticket (TGT), then trades it for per-resource service tickets (TGS). NTLM has no tickets at all.
Which AD authentication protocol is ticket-based, using a TGT traded for service tickets?
One shared folder is replicated across every domain controller specifically to keep Group Policy and login scripts consistent domain-wide.
Which shared folder, replicated across all domain controllers, holds Group Policy templates and login scripts?
💪 Exercises & Challenges
Active Directory Fundamentals MCQ
Test your understanding of Active Directory Fundamentals.
Map an Organization's AD Hierarchy
A company has a single forest with two domains: corp.local (HQ) and eu.corp.local (European subsidiary). Describe the hierarchy including at least 3 OUs per domain (e.g. Finance, IT, Sales), and state
Scope the Trust Boundary
During a Windows domain assessment briefing, you're told: 'This environment has one forest, three domains, and Kerberos is the primary auth protocol — but NTLM is also enabled for a legacy finance app