Pragmat1c_0n3@cyb3r-s3c:~/active-directory-fundamentals# Active Directory Fundamentals

(Part One: Demystifying AD DS and its Components)

Published by: Pragmat1c_0n3 | Series: AD Fundamentals (1/6) | Classification: [UNCLASSIFIED]

[MISSION BRIEFING] Welcome to the first installment of the Active Directory Domain Services reconnaissance series. In the enterprise battlefield, understanding Active Directory is not optional, it's survival. With over 95% of Fortune 1000 companies relying on AD infrastructure, this knowledge separates novice from true cyber operatives.

This deep dive will provide foundational intelligence on AD DS architecture, from forest hierarchies to service account exploitation vectors. Whether for hardening blue team defenses or planning red team operations, mastering AD is a tactical advantage.

[RECONNAISSANCE] The AD Ecosystem

Active Directory isn't just a directory service, it's the central nervous system of Windows enterprise networks. Every authentication, authorization, and resource access flows through this critical infrastructure. Understanding its architecture is like having the network blueprints during a penetration test.

Core AD Functions:

• Centralized Authentication: Single point of user/computer verification.
• Authorization Management: Granular access control via security principals.
• Policy Enforcement: Group Policy Objects (GPOs) for configuration management.
• Certificate Services: PKI infrastructure for encryption and digital signatures.
• DNS Integration: Service location and name resolution.

[INTEL] Logical Architecture Components

AD's logical structure forms a hierarchical framework that determines trust boundaries, replication scope, and administrative delegation. Each component serves specific operational purposes:

Component Function & Tactical Significance Forest Ultimate security boundary. Contains one or more domain trees with shared schema and configuration. Forest compromise = total domain compromise across all child domains. Domain Administrative and replication boundary. Houses security principals (users, computers, groups). Each domain maintains its own security policies and trust relationships. Domain Controller Critical infrastructure server storing writable AD database. Handles authentication, authorization, and replication. High-value targets for attackers. Organizational Unit Container for administrative delegation and GPO application. Enables granular permission assignment and policy enforcement. Schema Defines object classes and attributes. Schema modifications replicate forest-wide. Schema Master role controls all schema changes. Global Catalog Distributed index containing partial replica of all forest objects. Enables cross-domain searches and universal group membership validation.

[DATASTORE] The Ntds.dit Database

The AD database (Ntds.dit) is the crown jewel of Windows networks. Located in C:\Windows\NTDS\ by default, this Extensible Storage Engine (ESE) database contains:

                        Schema Partition: Object class definitions and attribute schemas.
                        Configuration Partition: Forest-wide configuration data.
                        Domain Partition: Domain-specific objects (users, groups, computers).
                        Application Partitions: DNS zones and custom application data.
					

[OPSEC WARNING]: The Ntds.dit file contains password hashes for all domain accounts. Unauthorized access to this file enables complete domain compromise through hash extraction and cracking operations.  

[TARGET ANALYSIS] Security Principals

User Objects

User accounts are security principals with unique Security Identifiers (SIDs). Each user object contains:

• • Authentication data: Password hashes, Kerberos keys.
  • Authorization attributes: Group memberships, privilege assignments.
  • Profile information: Home directories, login scripts.
  • Security settings: Account policies, lockout thresholds.

Computer Objects

Domain-joined computers are security principals with machine accounts ending in '$'. These accounts:

• • Authenticate to domain services.
  • Receive and apply Group Policy settings.
  • Participate in Kerberos authentication.
  • Maintain computer-specific security policies.

Service Accounts

Managed Service Accounts (MSAs)

Automated password management for service authentication. Two types:

• Standalone MSA: Single computer scope.
• Group MSA (gMSA): Multiple computer scope for server farms.

                            # Create KDS Root Key (required for gMSAs)
                            Add-KdsRootKey -EffectiveImmediately
                            
                            # Create Group Managed Service Account
                            New-ADServiceAccount -Name "SQL-ServiceAccount" `
                                -PrincipalsAllowedToRetrieveManagedPassword "SQL-Servers"
						

[GROUP TACTICS] Security Group Analysis

Group Scope Membership Rules Permission Assignment Tactical Use Domain Local Forest-wide members Local domain resources only Resource access control Global Same domain only Forest-wide permissions User organization Universal Forest-wide members Forest-wide permissions Cross-domain access   [PRIVILEGE ESCALATION VECTOR]: Universal groups replicate to all Global Catalog servers. Excessive universal group membership creates replication overhead and potential attack surfaces.  

[INFRASTRUCTURE] Specialized Domain Controllers

Read-Only Domain Controllers (RODCs)

Deployed in low-security environments (branch offices, DMZ). Key characteristics:

• • No password storage (except cached credentials).
  • Unidirectional replication from writable DCs.
  • Local administrative restrictions.
  • Reduced attack surface for remote locations.

Global Catalog Servers

Contain partial replica of all forest objects for cross-domain operations:

• Universal group membership resolution.
• Cross-domain authentication support.
• Forest-wide object searches.
• Exchange Server integration.

[OPERATIONAL TOOLS] AD Management Arsenal

                        # PowerShell Active Directory Module Commands
                        Get-ADUser -Filter * -Properties *
                        Get-ADComputer -Filter * -Properties OperatingSystem
                        Get-ADGroup -Filter * -Properties Members
                        Get-ADOrganizationalUnit -Filter * -Properties *
                        
                        # Create new user with PowerShell
                        New-ADUser -Name "John.Doe" -SamAccountName "jdoe" `
                            -UserPrincipalName "[email protected]" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) `
                            -Enabled $true -Path "OU=Users,DC=domain,DC=com"
					

Administrative Tools:

• Active Directory Users and Computers (ADUC): GUI management console.
• Active Directory Administrative Center (ADAC): Modern PowerShell-based GUI.
• Windows Admin Center: Web-based management interface.
• PowerShell AD Module: Command-line automation and scripting.
• dsadd/dsmod/dsget: Legacy command-line tools.

[MISSION SUMMARY]

Active Directory forms the backbone of Windows enterprise security. Understanding its logical components, such as forests, domains, OUs, and security principals is essential for both defensive hardening and offensive operations.

Key takeaways from this reconnaissance:

• Forests represent the ultimate security boundary.
• Domain controllers are high-value targets requiring protection.
• Service accounts offer automation but require secure configuration.
• Group strategy affects both security and operational efficiency.
• Specialized DC roles serve specific organizational needs.

[NEXT OPERATION]: Part Two will cover Forest and Domain architecture, trust relationships, and organizational unit design strategies. Stay vigilant and keep your knowledge current.

// End of transmission

/Signing Off

Pragmat1c_0n3

© Cyb3r-S3c | Keep learning, the only way to improve is to keep learning!

Subscribe to Cyb3r_0verWatch on YouTube for video content