Active Directory
termIT supportsecurity
Microsoft's directory service: the domain's phone book and security authority - users, groups, machines, and the permissions binding them.
The crown jewels of most corporate networks, which is why attackers head straight for it.
Active Directory is the identity and policy backbone of most enterprises, combining directory services, Kerberos authentication and Group Policy. Its centrality is the point and also the risk: compromising a domain controller does not compromise a server, it compromises every identity in the organization at once.
That is why domain controllers warrant a different class of treatment from other servers, with their own patching urgency, tiered administration so a workstation compromise cannot reach them, and monitoring of the specific behaviours that precede escalation. Most published attack chains against enterprises are, in the end, chains toward Active Directory, and an environment that treats its domain controllers as ordinary infrastructure has misjudged where its actual perimeter is.