FFoundationalActiveDirectory
Active Directory is the identity and access backbone of most enterprise Windows networks. This lesson explains how AD organizes users, computers, groups, and policies into a hierarchical structure, why that structure matters for both administrators and attackers, and how to explain it clearly in interviews.
Active Directory Domain Services (AD DS) is a directory service that stores information about every object in a Windows network environment — users, computers, groups, policies, and their relationships — and makes that information available for authentication, authorization, and management. It is organized as a hierarchical tree: a forest at the top, containing one or more domains, which contain organizational units, which contain objects.
The forest is the outermost security boundary. The domain is the primary administrative boundary. Organizational units are containers for grouping objects and applying policies. Every domain has at least one domain controller, a server that hosts the AD database and handles authentication requests.
Think of Active Directory as a corporate org chart combined with a security system. The forest is the entire company. Domains are divisions or subsidiaries. Organizational units are departments within those divisions. Objects (users, computers, groups) are the people and assets that live inside those departments. Group Policy Objects are the corporate policies that get applied to departments and flow downward.
The critical insight for security work is that AD is simultaneously the authentication system, the authorization system, and the configuration management system for the entire network. Anything that can read the directory can learn the structure of the organization, and anything that can modify the directory can change who has access to what. This dual role is what makes AD both powerful and dangerous.
Microsoft · Official Microsoft reference for AD DS architecture, including schema, global catalog, and replication
Microsoft · Microsoft reference for the AD schema that defines object classes and attributes — the foundation for understanding what AD objects are
Microsoft · Microsoft reference for security principals (users, groups, computers) — the core object types that populate the AD hierarchy
Active Directory is the starting point for almost every internal assessment and the foundation for almost every AD attack technique. If you cannot explain how AD is structured, you cannot explain where attacks happen or why they work. Understanding the hierarchy of forests, domains, organizational units, and objects is not just background knowledge — it is the map that every technique, every enumeration step, and every privilege escalation path operates on.
In a real assessment, you will encounter AD environments ranging from small single-domain setups to complex multi-forest architectures with dozens of domains and trust relationships. Understanding the structure lets you answer critical questions early: how many domains are there? Are there trust relationships that cross into other environments? Where are the domain controllers? Which groups have administrative access?
The structure you discover during enumeration becomes the map for the rest of the engagement. When you identify a service account in a privileged group, you need to understand what domain it belongs to and what that domain trusts. When you find a misconfigured GPO, you need to understand which OUs it applies to. When you explain findings to a client, you need to be able to describe where in their hierarchy the problem exists and what it affects.
Active Directory is a directory service that acts as the identity, authentication, and configuration backbone for Windows enterprise networks. It is organized hierarchically: forests contain domains, domains contain organizational units, and OUs contain objects like users, computers, and groups. The forest is the outermost security boundary, and domains within a forest trust each other by default. Every domain has domain controllers that host the AD database and handle authentication.
From a security perspective, the key insight is that AD is not just an address book — any authenticated user can query most of the directory via LDAP, which is why even a low-privilege account enables extensive enumeration. The structure of AD directly determines where attacks are possible, because group memberships control access, GPOs control configuration, and trust relationships determine how far a compromise can spread.