Active Directory
termStands for: Active Directory Domain Services (AD DS)
Microsoft's directory service: the domain's phone book and security authority - users, groups, machines, and the permissions binding them.
The crown jewels of most corporate networks, which is why attackers head straight for it. Microsoft's own overview of Active Directory Domain Services describes a directory service as one that "provides the methods for storing directory data and making this data available to network users and administrators", storing user accounts with names, passwords and phone numbers, shared resources such as servers, volumes and printers, and computer accounts, with security "integrated with AD DS through sign-in authentication and access control to objects in the directory" so that one network username and password reach everything. Its components, in the same document, are the schema that defines the object classes and attributes, the global catalog that holds information about every object, the query and index mechanism, and the replication service: "all domain controllers in a domain participate in replication and contain a complete copy of all directory information for their domain". It speaks LDAP to applications, Kerberos for authentication with NTLM as the fallback, and it is the password store behind most RADIUS, 802.1X and VPN logins in a Windows estate, which is why the AAA designs on this site keep returning to it.
Active Directory is the identity and policy backbone of most enterprises, combining directory services, Kerberos authentication and Group Policy. Its centrality is the point and also the risk: compromising a domain controller does not compromise a server, it compromises every identity in the organization at once. Microsoft's overview of Active Directory Domain Services describes the service in plain terms: "A directory service, such as Active Directory Domain Services (AD DS), provides the methods for storing directory data and making this data available to network users and administrators." The data it names is the inventory of an organisation: user accounts with names, passwords and phone numbers, shared resources such as servers, volumes and printers, and the computer accounts of the machines joined to the domain.
The security model is the reason it matters more than any other directory. The overview says that "security is integrated with AD DS through sign-in authentication and access control to objects in the directory", and that a single network sign-in lets an administrator manage directory data and lets a user reach the resources on the network. The protocols under that sentence are the ones with entries of their own: Kerberos issues the tickets that make the single sign-in silent, NTLM remains as the fallback for everything that cannot do Kerberos, LDAP is how applications read the directory and verify passwords, and Group Policy pushes configuration to the machines. Microsoft lists the components as the schema, which defines the classes of objects and attributes the directory can hold and the constraints on them; the global catalog, which holds information about every object so that a search can find anything regardless of which domain holds it; the query and index mechanism, so that objects can be published and found; and the replication service, which distributes the data: "all domain controllers in a domain participate in replication and contain a complete copy of all directory information for their domain", so that a change made on one controller reaches the others.
That replication model is why domain controllers warrant a different class of treatment from other servers, with their own patching urgency, tiered administration so a workstation compromise cannot reach them, and monitoring of the specific behaviours that precede escalation. Every controller holds the whole domain, including the material from which every password-derived key is made, and every controller can originate a change that all the others will accept. Most published attack chains against enterprises are, in the end, chains toward Active Directory, and an environment that treats its domain controllers as ordinary infrastructure has misjudged where its actual perimeter is.
In the AAA designs described across this glossary the directory is the back end of almost everything. A RADIUS server checking a PEAP-MSCHAPv2 login verifies the response against the NT hash the domain holds; a policy engine deciding a VLAN reads group membership over LDAP; a TACACS+ server authenticating an administrator binds to the domain; a web-authentication portal does the same for a visitor with a sponsored account. The directory's groups are therefore the roles of a role-based model whether or not anyone called them that, and the privilege creep and separation of duties entries describe what happens to those groups over time if nobody reviews them. The Kerberos and SPNEGO article and the LDAP fundamentals article carry the protocol detail.
Also known as: ad ds, ad, domain controller, domain services, global catalog