Active Directory Resource Center

Active Directory is the foundation for a majority of enterprise networks, and cybersecurity professionals need to have a solid understanding of it to protect and secure sensitive data.

Most any cyberattack will affect Active Directory (AD) in some way, whether it’s a compromised user or service account, a hacked authentication ticket, or a stolen authentication token.

If some of those terms are unfamiliar, you are in the right place. This guide is going to cover the basics of AD and serve as a gateway to more detailed information.

Additional Chapters on Active Directory

The remaining chapters of this guide cover various Active Directory topics. See the articles and resources listed below by category.

Basics

1. Learn Active Directory: The Basics 
2. Active Directory Users and Computers 
3. Active Directory Domain Services
4. Domain Controller
5. Risks Renaming Your Domain in Active Directory
6. Active Directory Domain Controller (AD DC) Could Not Be Contacted
7. How to Get Started with PowerShell and Active Directory Scripting 

Group Management and Auditing

8. Difference Between Active Directory and LDAP
9. Group Policy
10. Difference Between Organizational Units and Active Directory Groups
11. How to Find Active Directory Group Member
12. Active Directory Audits 

Advanced Tutorials for IT Pros

13. Active Directory Forest 
14. Windows vs Azure Active Directory
15. FSMO Roles
16. Active Directory has a Privacy Problem 
17. Azure Active Directory Best Practices
18. Top 10 Active Directory Tutorials 
19. Active Directory Migration Tool
20. Active Directory Security

What is Active Directory?

Let’s start with the basics. Active Directory (AD) is Microsoft’s directory service that stores data about objects on your local network. It records information on users, devices, applications, and groups. AD organizes this data in a hierarchical structure so that you can easily find details of how your network is operating from a central location.

AD was first introduced back in 2000, as part of Windows 2000 Server. Many system admins started using AD at that time to manage users on the networks, but since then the system has expanded to include a number of additional directory services and third-party tools.

Essentially, AD acts as a phone book in which you can look up data about your network, and manage devices and users from a centralized hub.

What does Active Directory do?

There is one major advantage of using directory services like AD: convenience.

AD allows you to monitor and manage a huge variety of entities from one location. These include users, devices, applications, and groups. It brings authentication for access to these entities into one place, so you can manage them without having to enter separate account details for each.

This is extremely useful for a variety of tasks:

6. 6. • Adding, removing, and managing users.
      • Creating and removing user groups.
      • Monitoring usage and activity on devices.
      • Reporting on application usage.

All of these tasks can be accomplished from other, discrete systems, but by using AD you can do all of them from one place. That’s why AD has become such an important tool for system admins.

Active Directory Services

Active Directory is a collection of several different services that function together as Active Directory Domain Services. We just say AD instead of AD DS to save time and characters.

6. 6. • Domain Services: Domain services are the core of the AD infrastructure. This is where all of the usernames, passwords, computers, and devices that can connect to the network are stored. The computer that runs domain services is called a Domain Controller. To log onto the network users need to contact the domain controller.
      • Lightweight Directory Services: Lightweight directory services is the Microsoft implementation of the LDAP protocol. LDAP is the core technology that allows for authentication to access resources on the network. LDAP also creates a local data store to track authentication tokens, so users don’t have to provide credentials every time they need to access a server.
      • Certificate Services: Certificate services provide a public-key infrastructure to AD. It can create, revoke, or validate public key certificates that are used to encrypt user data on the network.
      • Federation Services: Federation services are the backbone for a single-sign-on (SSO) infrastructure. SSO allows users to have a single set of credentials that authenticate to several different resources.
      • Rights Management Services: Rights Management Services (RMS) implement encryption and selective functionality denial capability to documents like emails, Word files, and web pages. RMS allows for specific rights on a single document depending on group membership, environment, or time. For example, one could say that only people on the network can print a document, and anyone not on the network can’t.

Active Directory Features

Here are a few reasons that organizations choose to setup AD to manage users and devices.

6. 6. • Hierarchical organizational structure: AD is expandable to grow with the organization with the creation of multiple Organizational units that all roll up to one domain. This structure makes it possible to distribute domain administration responsibilities, so no single person is responsible for the entire domain.
      • Multimaster authentication and Multimaster replication: Modern enterprises are spread across the world, and AD supports multiple DCs that all have identical configurations to provide faster responses to users and back each other up in case of failure.
      • Support for Internet Standards: AD conforms to standards like Domain Name Services (DNS) and Lightweight Directory Access Protocol (LDAP), which facilitates communication with other non-Windows systems.
      • PowerShell cmdlets: Microsoft PowerShell supports cmdlets that can make changes to AD to streamline administrative processes.
      • Application integration: Multiple applications support AD, like Exchange and Azure, or can use SSO from AD with little configuration.

Advantages of Active Directory

Active Directory provides several advantages to enterprises like:

6. 6. • Centralized security administration: AD is a hub for administrators to manage access to data across the enterprise.
      • SSO: SSO allows for a single user/pass combination to access multiple resources, which makes it easier to add or remove users, and change one password
      • Searchable resource listing: AD is a searchable database of resources that users can access, like printers or file servers
      • Trust relationships to other domains: AD supports logins to multiple domains in a “forest.” Admins create trust relationships with other domains that allow users from one domain to see the resources in the other.

Difference between Windows and Azure AD

Azure AD is the cloud version of directory services that Microsoft created for its cloud infrastructure. AD is the on-premise system that Microsoft released with Windows 2000.

While the two have several basic similarities, they are different systems with different configurations and permission sets. There is a native integration that will sync AD with Azure AD, so your on-premise users can also exist in Azure AD and visa versa.

Additional Resources:

6. 6. • Windows vs. Azure Active Directory

LDAP vs. AD

AD uses the internet standard LDAP to communicate with other authentication systems, like Samba, for example. But they are not the same thing at all. LDAP is a protocol that many different directory services and access management solutions can understand but should be thought of as a subset of overall AD functionality.

Additional Resources:

6. 6. • Difference Between Active Directory and LDAP

Main Competitors to Active Directory

Some organizations want to move away from AD to manage directory services, and these days there are plenty of options. Here are some of the more well known.

6. 6. • Okta: Okta is a cloud-based Identify Management solution.
      • OpenLDAP: OpenLDAP is an open-source LDAP implementation
      • Red Hat Directory Services: RH DS is an LDAP based directory services implementation on Unix and Linux.

How do you Secure Active Directory?

AD is critical to maintaining data security and compliance with data privacy regulations like GDPR, CCPA, and HIPAA. Attackers know how to infiltrate, escalate privileges, perform reconnaissance, and cover their tracks in AD. It is incumbent upon admins to know those same tricks and make their networks as hard to crack as possible.

Here are a few tips from the Active Directory Security Best Practices blog.

6. 6. • Document everything about AD: To keep a clean and secure AD, you must know everything about that AD – and I do mean everything. Document naming conventions and key security policies in addition to every user, service account, computer, and access group.
      • Enforce Safe Practices Among Users: Enforce strong passwords, train users to recognize phishing attacks, lock users out of making changes that can compromise security, limit access to make administrative changes to a few secured systems
      • Max security on DCs: Configure the network so admins only access DCs from a hardened terminal. If an attacker gains access to a DC they win.
      • Monitor AD: Track every change, every login, every group add.

There is much more to AD security than those four points, but they are a place to start so you can begin to manage the rest.

Basics of Active Directory

In this section, we will cover some of the very basics about AD, including some definitions and key terms you need to know. Feel free to jump around the additional resources as well.

Additional Resources:

6. 6. • Active Directory in Plain English 
      • Active Directory Tutorials 
      • Active Directory Users and Computers (ADUC): Installation and Uses
      • The Difference Between Active Directory and LDAP
      • Active Directory: Difference Between Windows and Azure AD
      • Active Directory Has a Privacy Problem

Getting Started

The best way to learn AD is to set up a domain and play around with it. It’s best to do this in a lab that isn’t connected to any other domains. It’s unlikely, but possible, that a novice with permissions can make changes to a production domain unintentionally.

Follow this guide to set up a domain controller and create your domain.

Domain, Tree, and Forests

Domains, trees, and forests are the major components of an AD system.

The domain is the container for a group of users and computers. Under each domain, you can have several different trees. Several domains make up a forest.

Additional Resources:

6. 6. • What is an Active Directory Forest?

Domain Controllers

A domain controller (DC) is a computer that hosts services that make AD work. Read all about DCs in this blog.

Active Directory Glossary

It is tough getting started with Active Directory. There are lots of reasons for this: the years of cruft, the inherent complexity, the intimidating raw power… and the fact that everything has about six different names.

To help make sense of this, we’ve translated AD terms back into something a human might use when conversing with another Active-Directory-using-human. We hope you find it useful.

Here is a table of AD terms that every beginner should know: