Active Directory Basics

Shamaym Asim

12 min read

·

Jul 22, 2026

--

Listen

Share

What I Learned During My Cybersecurity Internship

A few weeks into my internship, my supervisor pulled up a company laptop, opened something called Active Directory Users and Computers, and asked me, “So, how would you find every user in the Finance department who hasn’t changed their password in 90 days?” I stared at the screen for a solid ten seconds before admitting I had no idea where to even click.

That moment is basically why this blog exists. Active Directory (AD) is one of those things that almost every mid-size to large company runs in the background, and if you’re going into cybersecurity, you will run into it constantly, whether you’re defending it or attacking it. So I sat down, took proper notes, and I’m putting them here in plain language, the way I wish someone had explained it to me before I got thrown in front of that laptop.

Let’s break it down piece by piece.

1. What Is Active Directory, Actually?

Active Directory is Microsoft’s system for managing everything on a company network from one central place, users, computers, printers, security policies, all of it. Instead of an IT admin walking to every single computer to create an account or apply a password rule, they do it once in AD, and it applies across the whole network.

Think of it like a school’s main office. The main office keeps one master list of every student, every teacher, every classroom, and every rule (like “you must be in your seat by 8 AM”). Nobody has to ask each classroom individually, the main office is the single source of truth. AD works the same way for a company’s digital environment.

At its core, AD is really just a big, organized database plus a set of services that let that database control login, permissions, and policies across every device that’s joined to it.

Key Takeaways

• Active Directory is a centralized system for managing users, devices, and permissions across a network.
• It removes the need to configure every single computer manually.
• If you’re doing IT or security work in a company environment, you will almost certainly touch AD at some point.

2. The Structure: Domains, Trees, and Forests

This part confused me the most at first because the terminology sounds unnecessarily fancy. But once I pictured it as a family tree, it clicked.

Domain

A domain is the basic unit of AD. It’s a group of objects (users, computers, printers) that share the same database and security rules. Example: company.local could be a domain where every employee's account lives.

Tree

A tree is a group of one or more domains that share a common naming structure and trust each other. Example: company.local might have a child domain like sales.company.local, and together they form a tree.

Forest

A forest is the biggest container, it’s a collection of one or more trees that trust each other and share a common structure at the top level (called the schema). Most companies actually only have one forest with one domain, but larger companies with multiple business units or countries might have more complex forests.

Simple way to remember it: domain = one branch, tree = a group of connected branches, forest = the whole tree collection sharing the same root system.

Press enter or click to view image in full size

Key Takeaways

• A domain is the basic building block; a tree groups related domains; a forest groups related trees.
• Most small-to-medium companies only need a single domain.
• Understanding this hierarchy matters because permissions and trust flow along these boundaries.

3. Domain Controllers and FSMO Roles

What Is a Domain Controller?

A Domain Controller (DC) is the actual server running Active Directory. It’s the “brain” that handles login requests, stores the AD database, and enforces security policies. When you log into your work laptop and it checks your username and password against the company directory, that request goes to a Domain Controller.

Bigger companies usually run multiple DCs for two reasons: redundancy (if one goes down, others keep the network running) and load balancing (spreading out login requests so no single server gets overwhelmed).

FSMO Roles (Flexible Single Master Operations)

Here’s something that tripped me up: even though you can have many Domain Controllers, a handful of specific jobs can only be handled by exactly one DC at a time. These are called FSMO roles. There are five of them, split across the forest and domain level, and they exist to prevent conflicts, like two DCs both trying to be the one authoritative source for the same setting at the same time.

You don’t need to memorize each FSMO role’s job title for a basics-level understanding, just know this: even in a network with multiple Domain Controllers, certain critical decisions still need one clear “final say” server, and FSMO roles are how AD assigns that.

Key Takeaways

• A Domain Controller is the actual server that runs and enforces Active Directory.
• Companies often use multiple DCs for backup and to share the login workload.
• FSMO roles make sure certain critical operations always have exactly one authoritative source, even across many DCs.

4. AD Objects: Users, Groups, Computers, and OUs

Everything inside Active Directory is called an “object.” Here are the ones you’ll deal with constantly:

• User Objects: Represent actual people, with their username, password, and account settings attached.
• Computer Objects: Represent devices joined to the domain, like employee laptops or servers.
• Group Objects: A way of bundling users together so you can assign permissions once instead of user-by-user. Example: a group called Finance-Team that includes every finance employee.
• Organizational Units (OUs): Containers used to organize objects logically, almost like folders. Example: you might have an OU called Marketing that contains all marketing department users and computers.

Security Groups vs Distribution Groups

This is a distinction I kept mixing up early on:

• Security Groups: Used to assign actual permissions, like access to a shared folder or a printer.
• Distribution Groups: Used purely for email distribution lists, they don’t carry any security permissions at all.

If someone accidentally uses a distribution group to try to grant folder access, it simply won’t work, because distribution groups were never meant to carry permissions in the first place.

Key Takeaways

• Users, computers, and groups are the core “objects” inside AD.
• OUs are used to organize objects logically, similar to folders.
• Security groups control access; distribution groups are for email only, never mix them up.

5. Group Policy Objects (GPOs)

Group Policy is one of the most powerful features in AD, and also one of the most underrated from a security point of view.

A Group Policy Object (GPO) lets an admin apply settings to a whole group of users or computers at once, automatically. Instead of manually configuring 500 laptops one by one, you create a GPO and link it to the right OU, and every device inside that OU picks up the settings the next time it checks in.

Some real examples of what GPOs control:

• Forcing a minimum password length and complexity.
• Locking a screen automatically after a period of inactivity.
• Blocking USB drives on company machines.
• Pushing out a specific desktop wallpaper or blocking access to Control Panel.

From a security angle, GPOs are basically how companies enforce their password policy, account lockout rules, and a lot of baseline hardening settings across the entire organization in one shot.

Key Takeaways

• GPOs let admins push settings and restrictions to many users/computers at once.
• They’re one of the main tools used to actually enforce a company’s security policy.
• A single GPO change can affect hundreds of machines instantly, so they need to be handled carefully.

6. Authentication: Kerberos vs NTLM

This is the part that ties directly into a lot of real-world attacks, so pay attention here.

Kerberos

Kerberos is the default, modern authentication protocol AD uses. Here’s the simplified version of how it works:

1. You log in, and your computer sends your credentials to a Domain Controller.
2. If they’re correct, the DC gives you back a “ticket” (called a Ticket Granting Ticket, or TGT), think of it like a wristband you get at a concert after showing your ID once.
3. Whenever you want to access another resource (a shared drive, an email server), you show that wristband instead of your actual password again. The resource trusts the wristband because it trusts the DC that issued it.

This is smarter than repeatedly sending your password around the network, since the actual password only gets used once at login.

NTLM

NTLM is the older authentication method that Kerberos was designed to replace. It works differently, using a challenge-response system instead of tickets, and it’s considered weaker and more vulnerable to certain attacks (like relay attacks, where an attacker intercepts and reuses the authentication exchange).

Most modern networks still keep NTLM around for backward compatibility with older systems, but security teams generally try to minimize or disable it wherever possible.

Press enter or click to view image in full size

Key Takeaways

• Kerberos uses tickets so your actual password isn’t repeatedly transmitted across the network.
• NTLM is older, weaker, and mainly kept around for compatibility with legacy systems.
• A lot of AD attacks specifically target weaknesses in how these authentication protocols work.

7. LDAP and Its Role in Active Directory

LDAP (Lightweight Directory Access Protocol) is the protocol used to actually read and query the AD database. If AD is the filing cabinet, LDAP is the language you use to ask, “give me every file in the Finance folder.”

Whenever an application needs to check if a user exists, verify their department, or pull a list of group members, it’s usually talking to AD using LDAP under the hood. It typically runs on port 389, or port 636 for its encrypted version (LDAPS).

A practical example: when you log into a company Wi-Fi portal and it somehow already knows your name and department, there’s a very good chance that system just queried AD over LDAP behind the scenes.

Key Takeaways

• LDAP is the protocol used to query and communicate with the AD database.
• Plain LDAP (port 389) is unencrypted; LDAPS (port 636) is the secure version.
• Most systems that “know who you are” inside a company network are quietly querying AD via LDAP.

8. DNS and Active Directory

Here’s something that genuinely surprised me: Active Directory cannot function properly without DNS. AD relies on DNS to help computers actually locate Domain Controllers and other AD services on the network.

When a computer wants to log a user in, it doesn’t magically know where the Domain Controller is sitting. It queries DNS first, asking essentially, “where do I find a Domain Controller for this domain?” Only after DNS answers that question can the login process even begin.

This is exactly why, when a company’s internal DNS server has issues, half the office suddenly can’t log in, it’s not a coincidence, it’s DNS breaking the chain that AD depends on.

Press enter or click to view image in full size

Key Takeaways

• AD depends heavily on DNS to help devices locate Domain Controllers.
• If internal DNS breaks, AD-related logins and services usually break right along with it.
• DNS problems are one of the first things to check when troubleshooting AD login issues.

9. Trust Relationships

A trust is basically an agreement between two domains (or forests) that lets users in one domain access resources in the other, without needing a completely separate account.

A simple example: imagine company.local merges with another business that has its own domain, partnerbiz.local. Instead of recreating every employee's account in both domains, the company sets up a trust relationship, so employees from one domain can be granted access to resources in the other domain, using their existing login.

Trusts can be one-way (Domain A trusts Domain B, but not the other way around) or two-way (both trust each other equally). They matter a lot in security because a poorly configured trust can accidentally open up access paths between environments that were never supposed to be connected.

Key Takeaways

• Trusts let users in one domain access resources in another domain without duplicate accounts.
• Trusts can be one-way or two-way.
• Misconfigured trusts are a common way attackers move between environments that should have stayed separate.

10. AD Replication

Since companies often run multiple Domain Controllers, every DC needs to stay in sync with the others. If you create a new user account on one DC, that change needs to show up on every other DC too, otherwise you’d get weird situations where a user can log in from one office but not another.

This syncing process is called replication. AD handles it automatically in the background, constantly comparing notes between DCs and pushing out any changes. It’s designed to be efficient, only sending the actual changes rather than re-copying the entire database every time.

Press enter or click to view image in full size

Key Takeaways

• Replication keeps every Domain Controller’s copy of the AD database in sync.
• It happens automatically and continuously in the background.
• Replication delays can occasionally cause temporary weirdness, like a new account not working immediately everywhere.

11. Common Active Directory Attacks

This is the section that made me actually appreciate why understanding AD’s internals matters so much for security work. Most AD attacks aren’t about breaking encryption, they’re about abusing how AD’s trust and authentication mechanisms are designed to work.

• Kerberoasting: An attacker requests service tickets for accounts and then tries to crack them offline to recover the account’s password. It specifically targets weak passwords on service accounts.
• Pass-the-Hash: Instead of stealing a plaintext password, the attacker steals the password’s hashed form and uses it directly to authenticate, without ever needing to crack it.
• Golden Ticket Attack: If an attacker compromises a specific key used by Kerberos, they can forge tickets that grant them access to basically anything in the domain, essentially creating a master key from thin air.
• LLMNR/NBT-NS Poisoning: The attacker responds to legacy name-resolution broadcast requests on the network, tricking a device into sending its credentials to the attacker instead of the real destination.
• Password Spraying: Instead of guessing many passwords for one account (which triggers lockouts), the attacker tries one common password across many accounts, staying under detection thresholds.

Basic Prevention Methods

• Enforce strong password policies through GPOs, and avoid weak, reused service account passwords.
• Disable legacy protocols like LLMNR and NBT-NS where they’re not needed.
• Limit and closely monitor privileged accounts (like Domain Admins).
• Apply the principle of least privilege, don’t give accounts more access than they actually need.
• Regularly audit and rotate credentials for service accounts, since these are prime Kerberoasting targets.
• Keep Domain Controllers patched and tightly restricted from unnecessary network exposure.

Key Takeaways

• Most AD attacks abuse legitimate features (tickets, trust, name resolution) rather than breaking cryptography outright.
• Service accounts with weak passwords are a very common weak point.
• Least privilege and disabling unnecessary legacy protocols go a long way in reducing AD attack surface.

12. Conclusion

Before this module, Active Directory felt like one of those “background” systems I didn’t need to think about, it just quietly worked. Now I actually get why every single cybersecurity course and certification spends so much time on it: AD sits at the center of how most companies manage identity, and identity is exactly what attackers go after first. Once you understand how domains, trusts, authentication, and replication all connect, a huge chunk of real-world attacks (and defenses) suddenly make a lot more sense.

If you’re just starting out with AD like I was, my honest advice is this: don’t try to memorize every FSMO role or every attack name right away. Focus first on understanding the big picture, how objects, domains, and authentication all fit together, and the specific details will click into place a lot faster once you have that mental map.

That’s Active Directory in a nutshell, from the basic structure all the way to how attackers actually break in. Hopefully this made it a little less intimidating for anyone else getting thrown in front of that same “AD Users and Computers” screen for the first time.

13. References

[1] Microsoft, “Active Directory Domain Services Overview,” Microsoft Learn, Microsoft Corp. [Online]. Available: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services

[2] Microsoft, “Kerberos Authentication Overview,” Microsoft Learn, Microsoft Corp. [Online]. Available: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview

[3] Cisco Networking Academy, “CCNA Certification Course Materials,” Cisco Systems, Inc., 2023. [Online]. Available: https://www.netacad.com

[4] [Your Name], “Active Directory Module — Lecture Notes and Lab Exercises,” BS Cyber Security Program, [Your University Name], 2026, unpublished.

[5] [Company/Organization Name], “Cybersecurity Internship — Mentorship and Training Sessions,” 2026, unpublished.