Stop 03 · Linux & Windows FundamentalsTopics · 5/10

Windows Active Directory Basics

In short

In most companies, one system decides who can log in to every PC, file share and printer. That system is Active Directory, and taking it over is often an attacker's main goal.

The centralized identity and access management system used by most enterprises — understanding domains, users, groups and group policy is essential, since AD compromise is a common goal in real attacks.

The blob at a college office hands a student an ID card on a lanyard.

Think of it like this

The college ID card office

One office issues your ID card, and that single card gets you into the library, hostel and lab. If someone gets hold of that office's stamp, they can make cards for any door on campus. Active Directory is that office for a company.

Watch it happen

How an AD domain is organised

college.local

Domain Controller

OU: Staff

OU: Lab PCs

user: priya

group: Faculty

GPO: lock screen

1/5A domain is one AD world, like college.local. Every user and computer in it is managed centrally.

The big ideas

What you need to know

Domain controllers are crown jewels

Protect them like nothing else: few admins, no web browsing, heavy monitoring.

Groups grant access

Permissions go to groups, not individuals. Check group membership often, especially Domain Admins.

Kerberos handles logins

Users get tickets from the DC and show them to services. Many AD attacks abuse these tickets.

Group Policy enforces settings

GPOs set password rules, firewall settings and more across thousands of machines at once.

See it in code

Walk through the code

powershell

1# PowerShell on a domain-joined lab machine (RSAT tools installed)2Get-ADUser -Filter * | Select-Object Name, Enabled3Get-ADGroupMember "Domain Admins" | Select-Object Name4Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select-Object Name5gpresult /r

1/3Lists every user and whether the account is enabled. Old, enabled accounts are a risk.

Defenders run checks like these regularly. Unexpected Domain Admins or accounts whose passwords never expire are common audit findings.

Save yourself the pain

Common mistakes

Oops

Using a Domain Admin account for daily email and browsing.

Do this instead

Admins should have a separate everyday account. Use the admin account only for admin tasks.

Oops

Never removing accounts of people who left.

Do this instead

Disable accounts on the leaving day. Old accounts with valid passwords are an easy way in.

Your mission

Build a tiny domain

~45 min

Quick check

An attacker adds their account to the Domain Admins group. What can they now do?

Go deeper

1Set up a basic Active Directory lab environment to explore hands-on.
2Learn the concepts of domain controllers, organizational units, and group policy.
3Research why Active Directory compromise (e.g. via Kerberos attacks) is such a common attacker goal.