Securing Active Directory
Active Directory (AD) is the identity backbone of most enterprise networks — and therefore the ultimate prize for an attacker. It decides who can authenticate and what they can access across every Windows system in the domain. Compromise AD, particularly its Domain Admins, and you often compromise everything. Securing it is one of the most consequential jobs in enterprise defense.
Why is AD the crown jewel?#
Because control of AD is control of the domain. An attacker who breaches a single workstation rarely stops there — they pursue AD, because owning it means owning authentication itself. Common AD attacks include:
| Attack | What it abuses |
|---|---|
| Pass-the-hash / pass-the-ticket | Reusable authentication material |
| Kerberoasting | Crackable service-account tickets |
| DCSync | Replicating password hashes from a DC |
| Golden ticket | Forged Kerberos tickets after full compromise |
Each is a step toward, or a consequence of, gaining domain dominance — often via lateral movement and privilege escalation.
What are the key defenses?#
The most important is tiered administration: privileged credentials are strictly separated so that domain admin accounts never log on to ordinary workstations, where they could be stolen. Alongside it:
- Minimize privileged group membership — few Domain Admins, tightly controlled.
- Protect and monitor privileged accounts — PAM, MFA, alerting.
- Harden and patch domain controllers relentlessly.
- Detect AD-specific attacks in your SIEM.
Active Directory security is central to enterprise defense. More at the Defense & Hardening hub.
Frequently asked questions#
Why is Active Directory such a high-value target?
Because Active Directory controls authentication and authorization across an entire Windows environment. Compromising it — especially the Domain Admins group — often means controlling every system and account in the domain. Attackers who breach a single workstation frequently make AD their goal, since owning it means owning everything.
What are the most important Active Directory defenses?
Tiered administration (separating privileged accounts so domain admin credentials never touch ordinary workstations), strong protection of privileged accounts, minimizing membership in powerful groups, monitoring for attacks like Kerberoasting and pass-the-hash, and keeping domain controllers hardened and patched. Least privilege applied rigorously is the throughline.