PlatformMicrosoftMature
Active Directory
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
Technology explained
What is Active Directory?
Active Directory is Microsoft's directory service for centrally managing Windows identities, computers, groups, policy and access within an organisation.
Active Directory Domain Services stores directory objects and uses DNS, Kerberos, LDAP and multi-master replication to provide authentication and authorisation across domain-joined environments. Its forests, domains, organisational units and trust relationships form the administrative and security boundary.
Primary purpose
Provide central identity, authentication, policy and resource access for Windows-centric estates.
Typical environments
Windows ServerCorporate NetworksHybrid Cloud
Typical use cases
- Centralized identity management
- Domain-joined device management
- Access control via Group Policy
Technology map
Explore related technologies
Sub-technologies
Related technologies
Connected knowledge
20+ resources for Active Directory
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Technology journey
Learn and operate with Active Directory
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(2)
Learn the architecture, concepts and engineering context.
- Preventing DNS Split-Brain in Hybrid Azure/ADA technical guide to eliminating DNS split-brain in hybrid Azure/AD environments using NRPT, GPO policy and Azure Private DNS Resolver architecture. Open
- Visualising AD Replication Latency & TombstonesCharting AD replication latency against tombstoneLifetime, using USN vectors and repadmin data to catch lingering objects before they reanimate. Open
Graduate Learning(1)
Build practical knowledge and hands-on skills.
Config Traps(12+)
Recognise and avoid known failure modes.
- A WMI Filter That Fails to Evaluate Silently Skips GPO EnforcementWhen a WMI filter can't be evaluated on a client, Group Policy quietly skips the linked GPO instead of applying it — and nothing in the standard GPMC view shows the difference. Open
- Kerberos Delegation Set to 'Kerberos Only' Blocks TransitionSelecting 'Use Kerberos only' for AD constrained delegation feels like the safer choice, but it quietly disables protocol transition and breaks non-Kerberos client authentication. Open
- AdminSDHolder Silently Reverts Privileged AD DelegationA privileged Active Directory permission grant that vanishes within an hour is usually AdminSDHolder's SDProp process overwriting the object - not a broken delegation. Here is how to diagnose, correct and validate it safely. Open
- Unconstrained Delegation Hiding on Service AccountsA service account flagged TRUSTED_FOR_DELEGATION forwards a full copy of any caller's TGT into the hosting process's memory, not just an impersonation token. On Active Directory, when a privileged account authenticates to a scheduled task, IIS pool, or SQL service running under that identity, the ticket sits extractable in LSASS on every host the credential touches, and standard delegation reviews rarely check user accounts at all. Open
- Legacy AXFR Flags Survive Windows DNS UpgradesAn in-place upgraded Windows DNS Server can retain a zone-level TransferAnyServer flag from a decommissioned Windows Server 2008 secondary, letting any host on the internal network pull a full AXFR of the AD-integrated zone. Firewall rules and Kerberos authentication never see the query, because zone transfer authorisation is checked entirely inside the DNS service. Open
- SDProp Silently Reverts Direct Group ACL EditsA helpdesk delegation added directly to the Domain Admins security descriptor disappears without warning inside an hour, while a stray ACE placed on AdminSDHolder itself propagates unchanged to every protected account domain-wide. Active Directory's SDProp cycle overwrites rather than merges ACLs, so standard change logs point at the wrong actor and break-glass access fails exactly when it's needed. Open
- No LAPS Deployed: One Password Owns Every WorkstationA single local administrator credential, baked into a golden image or set once via Group Policy Preferences, sits identically on every domain-joined workstation. Dumping one SAM database with mimikatz gives an attacker the key to the entire fleet, and neither firewalls nor EDR baselines are configured to notice lateral movement that looks like normal admin logon. Open
- adminCount Drift Grants Ghost Tier-0 RightsA helpdesk account added to Domain Admins for a migration keeps adminCount=1 after removal, so its ACL stays protected and inheritance from the OU stays blocked. Group membership reviews find nothing because the account left the group weeks ago, yet the elevated Active Directory ACL template stays put on every domain controller. Open
- SYSVOL Scripts Folder: Authenticated Users Write TrapA single Modify ACE for Authenticated Users on the SYSVOL scripts subfolder means any domain-joined computer or low-privilege account can overwrite logon.bat or startup scripts. DFSR replicates the tampered file to every domain controller before Group Policy processing runs, and the payload executes under each logging-on user's own security context, including administrators. Open
- msDS-SupportedEncryptionTypes: RC4 Still Wins KerberosWhen a service account's msDS-SupportedEncryptionTypes attribute is left unset or still includes RC4, any domain-authenticated user can request a TGS ticket for its SPN and crack the account's password offline. Domain-wide AES enforcement does not override this per-account gap, so the weakest cipher the KDC will negotiate still wins. Open
- Domain Controller Print Spooler: PrintNightmare's Way InOn Windows Server Domain Controllers, the Print Spooler service stays active by default, leaving MS-RPRN and MS-PAR RPC interfaces reachable by any authenticated domain account. A single RpcAddPrinterDriverEx call can load an arbitrary SYSTEM-context DLL, and because SYSTEM on a DC owns NTDS.dit and krbtgt material, network segmentation and endpoint tooling rarely intercept the exploit before it reaches the domain's trust anchor. Open
- Print Server Unconstrained Delegation: The PetitPotam PathA file or print server left with the legacy Trust this computer for delegation to any service flag caches every Domain Controller TGT that authenticates to it, and PetitPotam or the Print Spooler bug can force that authentication on demand, turning a single forgotten server into a domain compromise vector that certificate audits and firewall rules never catch. Open
Incident Runbooks(4)
Stabilise, recover and validate during incidents.
- Active Directory krbtgt account password not rotated after suspected compromise, leaving golden tickets valid indefinitelyAfter a suspected DCSync or ntds.dit extraction, responders reset the krbtgt password only once. Because krbtgt retains two valid key versions for replication continuity, the compromised hash remains usable as the n-1 key, letting previously forged golden tickets continue authenticating across the domain until a second rotation is completed. Open
- Active Directory unconstrained Kerberos delegation enabled on domain controllers or service accounts, enabling golden ticket lateral movementA server or service account carries the TrustedForDelegation flag with no resource restriction, so its LSASS cache retains full TGTs from every account that authenticates to it. When that server is coerced into authenticating a domain controller's machine account, the captured DC ticket is replayed for DCSync, exposing the krbtgt hash and enabling forged golden tickets domain-wide. Open
- Active Directory AdminSDHolder ACL drift allowing shadow persistence via SDProp inheritance bypassAn ACE injected directly onto CN=AdminSDHolder,CN=System propagates to every adminCount=1 principal on the next SDProp cycle, and removing it from the downstream object achieves nothing because inheritance stays disabled there — SDProp simply re-copies the drifted ACL from the master object sixty minutes later, giving an attacker a self-healing backdoor across Domain Admins, Enterprise Admins and every nested privileged account. Open
- GPP cpassword Survives in Client-Side Group Policy CacheDeleting or unlinking a legacy Group Policy Preferences item removes the XML from SYSVOL but leaves a cached copy under each endpoint's Group Policy History folder. That cache retains the cpassword attribute indefinitely, so the AES-256 key Microsoft published in MS14-025 still decrypts a live credential on every machine that ever applied the policy. Open