Active Directory Fundamentals
Learn why owning one AD domain often means owning the whole company.
What you will learn
- -Explain domains, forests, trees, and OUs in plain terms
- -Describe how Group Policy pushes control across a network
- -Understand why Domain Admin is the crown jewel of an engagement
Almost every mid-size and large company runs on (AD). It is Microsoft's service: the central database of users, computers, groups, and the rules that bind them. When you compromise the right account in AD, you do not own one machine, you own thousands. That is why it is the single most valuable target in most enterprise engagements.
The building blocks
AD is a hierarchy. Learn the four and how they nest:
- A is the core unit: a like
corp.localholding users, computers, and groups that one security boundary and one set. - A tree is one or more domains sharing a contiguous namespace, such as
corp.localandeu.corp.local. - A forest is the top of the food chain: one or more trees that trust each other. The forest is the real security boundary. Compromise it and every domain inside is reachable.
- An Organizational Unit (OU) is a folder inside a domain used to group objects so admins can apply policy and delegate .
Domain Controllers hold the keys
A (DC) is a running the AD database (NTDS.dit)
and the service. Every login, every group check, every
policy pull goes through a DC. Getting code execution or the NTDS.dit file off
a DC is effectively game over for that domain.
Group Policy: control at scale
Group Policy Objects (GPOs) are the reason AD scales. An admin writes one policy, links it to a domain or OU, and every machine below inherits it: rules, settings, scheduled tasks, mapped drives, even scripts that run at startup. To an attacker, a you can edit is a way to push a to every machine it touches.
A single Domain Admin account can into any machine in the domain, read any share, and dump every . Real attackers do not chase one laptop. They chase the path from a low-privilege foothold to Domain Admin, because that one account unlocks the entire estate.
The mental model that matters
Think of AD as a graph, not a list. Users belong to groups, groups grant rights over computers and other groups, and those relationships chain together. Your job on an engagement is to find a path of edges from where you land to where the power lives. The tooling in the next lessons exists to draw that graph for you.
What is the true security boundary in Active Directory?
In one sentence, why is a GPO you can modify dangerous to the whole network?
Think about what "link once, apply everywhere" means when the thing being applied is a startup script you control.