Active Directory

Introduction

Active Directory is one of the most important technologies to understand if you want to work in corporate IT, infrastructure, cybersecurity, identity and access management, technical support, systems administration, or security operations.

Although many organisations are moving applications and identities into cloud platforms, Active Directory Domain Services (AD DS) remains deeply embedded in enterprise infrastructure. A multinational company may have tens or hundreds of thousands of employees, thousands of Windows computers, hundreds or thousands of servers, offices across multiple countries, multiple data centres, Azure and AWS environments, Microsoft 365, legacy internal applications, file servers, SQL servers, manufacturing systems, VPN infrastructure, VDI, security appliances, service accounts, and privileged administrator accounts.

Managing all of these systems individually would be extremely difficult. Active Directory provides a central directory through which organisations can manage users, computers, servers, passwords, groups, authentication, permissions, security policies, administrative privileges, applications, devices, certificates, service accounts, and access to corporate resources.

For example, when an employee starts working for a company, an administrator might create one Active Directory account: john.smith. That identity could then give John access to his corporate Windows laptop, network drives, printers, internal web applications, Microsoft SQL Server, Remote Desktop environments, VPN services, Wi-Fi, internal applications, and file servers.

In a hybrid organisation, the same identity may also be synchronized to Microsoft Entra ID and used for Microsoft 365, Exchange Online, Teams, SharePoint, Azure, SaaS applications, Conditional Access, and cloud MFA. Understanding the relationship between traditional Active Directory and modern cloud identity is therefore extremely important.

1📁 What Is Active Directory?

Active Directory is Microsoft's directory service for Windows enterprise environments. The server role that provides traditional Active Directory functionality is called Active Directory Domain Services – AD DS.

AD DS stores information about objects such as users, computers, groups, servers, printers, service accounts, Organisational Units, and Group Policy Objects. The Active Directory database is stored on servers called Domain Controllers – DCs.

A company normally deploys multiple domain controllers so that the entire organisation does not depend on one server. Active Directory is a multi-master directory, meaning most directory changes can be made against multiple domain controllers and then replicated between them.

2⌛ Why Companies Still Use Active Directory

Cloud identity has grown enormously, but Active Directory continues to exist because enterprise environments contain decades of technology. A modern company might simultaneously operate 1980s/1990s legacy manufacturing systems, 2000s-era AD, Windows file servers, SQL Server and internal applications, 2010s VMware/Microsoft 365/SaaS, and 2020s Azure/AWS/Entra ID/Intune/Zero Trust/passwordless authentication — all at once.

Replacing everything at once would be extremely expensive and risky. Many enterprise applications still expect Windows authentication, LDAP, Kerberos, NTLM, domain accounts, Windows security groups, Group Policy, and domain-joined computers. Therefore, large organisations often operate hybrid environments:

Microsoft currently provides both Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync for hybrid identity scenarios. Microsoft describes Cloud Sync as its strategic direction for synchronising users, groups and contacts between AD and Entra ID, although organisations may continue using Connect Sync where they depend on functionality Cloud Sync does not yet provide.

3📄 Active Directory Objects

An object is an item stored within Active Directory — a user, computer, group, Organisational Unit, printer, service account, or contact. Every object contains attributes. A user object might contain:

Name: John Smith
Username: jsmith
Email: john.smith@example.com
Department: Finance
Employee ID: 48372
Manager: Sarah Jones
Office: London
Account Enabled: Yes

Applications and automation systems can query these attributes, which becomes particularly useful in large companies:

This is known as identity lifecycle management.

4🌐 Domains

A domain is a logical administrative and security structure inside Active Directory, for example corp.example.com. A domain contains users, groups, computers, servers, service accounts, and Organisational Units.

Users normally sign into the domain using either a traditional Windows logon name such as CORP\jsmith or a User Principal Name such as jsmith@example.com — the second format looks like an email address and is increasingly common.

DNS and Domains

Active Directory is heavily dependent on DNS. This is one of the most important concepts for new administrators to understand. A computer does not normally discover domain controllers by having administrators manually enter their IP addresses — instead, DNS advertises Active Directory services.

AD uses DNS SRV records to locate LDAP, Kerberos, domain controllers, and Global Catalog servers, for example:

_ldap._tcp.dc._msdcs.corp.example.com

Microsoft specifically requires SRV records for clients to locate Active Directory domain controllers. This explains why a common support situation is:

"The network works and I can ping the server, but I cannot join the domain."

The problem may not be connectivity. It might be DNS — for example, the client may incorrectly be using 8.8.8.8 instead of the organisation's Active Directory DNS server.

5🌳 Forests

A forest is the highest-level Active Directory structure. A forest can contain one or more domains, for example uk.example.com, us.example.com, germany.example.com, and singapore.example.com could all belong to the same example.com forest. Another organisation might use only one domain, corp.example.com, even though it operates globally.

Modern environments generally try to avoid creating unnecessary domains because every additional domain creates additional management complexity.

Forest Security

A forest is extremely important from a cybersecurity perspective. Forest-level administrators possess enormous authority — compromise of highly privileged forest infrastructure can potentially compromise identities and systems throughout that forest. Microsoft's Active Directory documentation makes clear that forest service administrators effectively have authority over resources throughout the forest.

Domain Admin compromise      = Critical
Enterprise Admin compromise  = Critical
Domain Controller compromise = Critical
Forest compromise            = Potential enterprise compromise

This is why identity systems are among the highest-value targets during cyberattacks.

6🖥️ Domain Controllers

A Domain Controller (DC) is a Windows Server running Active Directory Domain Services, for example DC01, Windows Server 2025, IP: 10.10.1.10, Domain: corp.example.com. Domain controllers provide authentication, Kerberos, LDAP, Active Directory database access, Group Policy, DNS in many environments, and directory replication.

Companies normally deploy several domain controllers across sites:

corp.example.com — London Datacentre
  DC-LON-01, DC-LON-02
        |
   AD Replication
        |
  New York: DC-NYC-01, DC-NYC-02
  Singapore: DC-SIN-01, DC-SIN-02

If the Singapore office authenticates every employee against a London domain controller, authentication may become slow and dependent on WAN connectivity. Placing domain controllers strategically improves availability, authentication speed, resilience, and disaster recovery.

7📍 Active Directory Sites

Large enterprises use Active Directory Sites and Services to represent network locations, for example London (10.10.0.0/16), New York (10.20.0.0/16), Singapore (10.30.0.0/16). Active Directory can then direct clients toward appropriate domain controllers:

rather than routing all the way to a London DC. Site design also helps Active Directory control replication over slower WAN links. This becomes particularly important when companies have hundreds of offices, retail locations, warehouses, factories, branch offices, and international networks.

8👤 Users

A user object represents an identity, for example alice.brown in HR, Manchester, reporting to David Smith. Administrators may create accounts using Active Directory Users and Computers, or PowerShell:

New-ADUser `
-Name "Alice Brown" `
-GivenName "Alice" `
-Surname "Brown" `
-SamAccountName "alice.brown" `
-UserPrincipalName "alice.brown@example.com" `
-Enabled $true

In real organisations, accounts are increasingly created automatically through identity management workflows:

The HR system may therefore become the authoritative source for employee information.

9🏷️ Important User Attributes

Support engineers should recognise common Active Directory attributes:

sAMAccountName      userPrincipalName    displayName
givenName           sn                   mail
memberOf            manager              department
employeeID          userAccountControl   pwdLastSet
lastLogonTimestamp  objectGUID           objectSid

These attributes frequently appear in PowerShell scripts, IAM platforms, LDAP integrations, Microsoft Entra synchronisation, troubleshooting, and provisioning systems.

10🚫 Disabled vs Deleted Accounts

When an employee leaves a company, deleting the account immediately is often undesirable:

Disabling is useful because administrators may still need to investigate incidents, recover ownership of files, transfer mailboxes, review audit logs, or determine previous permissions. Identity lifecycle processes should be defined by organisational policy rather than performed manually and inconsistently.

11🖥️ Computer Objects

Domain-joined computers also have identities in Active Directory, for example LON-LT-00452$ — the $ commonly identifies the computer account representation. A computer object contains information used to establish trust between the computer and the Active Directory domain:

The computer can then authenticate against the domain, receive Group Policy, access domain resources, use Kerberos, and authenticate services using its machine identity.

12👥 Groups

Groups allow administrators to manage permissions efficiently. Imagine 5,000 employees require access to a Finance application. A bad design assigns permissions individually to each user. A better approach:

Now access can be granted by adding or removing users from the group.

13📂 Security Groups vs Distribution Groups

Security groups are used for assigning permissions — for example GG-Finance-Users could provide access to \\fileserver\finance.

Distribution groups are traditionally used for email distribution rather than resource permissions — for example All-London-Employees could let email reach everyone in the London office. In modern environments, distribution lists may instead be managed through Exchange or Microsoft 365.

14🌐 Group Scopes

Active Directory security groups can have different scopes: Domain Local (typically used to assign access to resources within a domain), Global (typically contains users from the same domain), and Universal (can contain identities from multiple domains in a forest and can be used across domains).

You may encounter the traditional Microsoft group-design model, AGDLP:

In multi-domain environments you may encounter AGUDLP (Accounts → Global → Universal → Domain Local → Permissions). These models are particularly common in established enterprise environments.

15🪥 Nested Groups

Groups can be members of other groups — group nesting:

This can simplify administration but excessive nesting creates troubleshooting difficulties. When a user says "I should have access because I'm in the Finance group," the engineer may discover several layers of nested groups behind the scenes. PowerShell can help investigate membership:

Get-ADPrincipalGroupMembership alice.brown

16🗁️ Organisational Units – OUs

An Organisational Unit, or OU, is a container used to organise Active Directory objects:

corp.example.com
├─ Users
│   ├─ Finance
│   ├─ HR
│   └─ IT
├─ Workstations
│   ├─ London
│   ├─ NewYork
│   └─ Singapore
├─ Servers
│   ├─ Application
│   ├─ Database
│   └─ FileServers
└─ ServiceAccounts

OUs are extremely important for two main reasons: delegation of administration and Group Policy application. Microsoft's current guidance specifically describes OU design as a way to delegate administration and apply Group Policy.

17⚖️ OU vs Group

Beginners commonly confuse groups and OUs. They serve different purposes.

Alice could exist in OU=London while simultaneously belonging to Finance, VPN-Users, Office365-E5, SAP-Users, and Remote-Workers groups. So: OU = where the object lives, Group = what memberships/access it has.

18🔑 Delegation

Large organisations should not give every IT technician Domain Admin permissions. Instead, Active Directory allows administrators to delegate specific permissions. For example, the help desk might be allowed to reset passwords, unlock accounts, and update phone numbers — but not modify Domain Admins, change domain security policy, or promote domain controllers.

This supports the cybersecurity principle of least privilege — give users only the permissions required to perform their jobs.

19📜 Group Policy

Group Policy is one of the most powerful features of traditional Windows enterprise management. It enables administrators to centrally configure thousands of computers. A Group Policy Object, or GPO, contains configuration settings — password policies, screen lock timeout, Windows Defender configuration, firewall rules, registry settings, security settings, drive mappings, scripts, browser configuration, certificate settings, software restrictions, audit policies, and Windows Update configuration.

Microsoft describes Group Policy as the centralized management mechanism for user and computer configuration across Windows Server and Windows clients.

20🕑 Example Group Policy

Imagine a company wants every Windows computer to lock after 10 minutes. Without Group Policy, that means configuring 30,000 laptops one by one — obviously this does not scale. With Group Policy:

21⚙️ Computer Configuration vs User Configuration

GPOs contain two major areas. Computer Configuration applies to the computer — Windows Defender, firewall, local security policies, services, computer certificates, Windows Update. User Configuration applies to users — desktop settings, Start menu, user restrictions, drive mappings, user registry settings.

Understanding which section to use is a common administration and troubleshooting requirement.

22📋 Group Policy Processing Order

A useful memory aid is LSDOU:

For nested OUs, parent OU policies are processed before child OU policies. Microsoft documents this processing sequence as Local → Site → Domain → OU. Generally, later applicable settings can override earlier conflicting settings. However, administrators must also understand enforced GPOs, block inheritance, security filtering, WMI filtering, and loopback processing — these can make troubleshooting more complicated.

23📂 Group Policy Inheritance

Suppose a GPO is linked to the Workstations OU, which contains a child OU Finance. That GPO will normally also affect devices inside Finance — this is inheritance. Administrators should avoid building excessively complicated GPO structures because troubleshooting becomes difficult.

24🧩 Group Policy Troubleshooting

gpupdate /force                        # Forces Group Policy refresh
gpresult /r                            # Shows applied policies
gpresult /h C:\Temp\gpresult.html      # Detailed HTML report
rsop.msc                               # Resultant Set of Policy

Typical troubleshooting question: "why didn't this GPO apply?" Check:

25🔒 Authentication

Authentication answers the question "who are you?" Authorization answers "what are you allowed to do?" These concepts must not be confused.

Example: Alice enters alice.brown / Password123. Active Directory authenticates Alice. After authentication, Windows evaluates group memberships, file permissions, application permissions, and user rights to determine what Alice is authorised to access.

26🖥️ Windows Logon

The access token may contain the user's SID, group SIDs, privileges, and other security information. Windows then compares those identities against access-control lists when the user accesses resources.

27🎟️ Kerberos

Kerberos is the primary authentication protocol used in modern Active Directory environments. Kerberos uses tickets rather than repeatedly sending a user's password to every service. The Domain Controller hosts the Key Distribution Center – KDC. Microsoft's Windows Kerberos implementation integrates the KDC with Active Directory.

28🎟️ Simplified Kerberos Authentication

Imagine Alice signs into her PC. After successful authentication against the KDC, Alice receives a Ticket Granting Ticket – TGT. Think of the TGT as proof that "the domain has already authenticated this user."

Later Alice accesses \\FILESERVER01\Finance. Instead of sending her password to FILESERVER01, her computer requests a service ticket using the TGT, and presents that service ticket to FILESERVER01. This provides Single Sign-On — Alice does not need to enter her password again.

29🏷️ Kerberos Terminology

Incorrect or duplicate SPNs are a common reason enterprise applications unexpectedly fall back from Kerberos.

30🎟️ Viewing Kerberos Tickets

klist

Example output may show tickets for krbtgt/CORP.EXAMPLE.COM, cifs/fileserver01.corp.example.com, HTTP/intranet.corp.example.com. Tickets can be purged during troubleshooting:

klist purge

Use this carefully because existing Kerberos tickets will be removed from the current session.

31⌛ Time Synchronisation

Kerberos is sensitive to time. If a client and domain controller have significantly different times, authentication can fail. Therefore Active Directory environments require reliable time synchronisation. A troubleshooting engineer should think: check DNS, check connectivity, check account, check domain controller, check time, check Kerberos — not simply "the password must be wrong."

32⌛ NTLM

NTLM is an older Windows authentication technology, using a challenge-response mechanism rather than Kerberos-style ticketing. Legacy environments may still require NTLM for old applications, old NAS systems, older Windows integrations, misconfigured applications, systems accessed using IP addresses rather than suitable hostnames, workgroup environments, and situations where Kerberos cannot be negotiated.

33⚖️ NTLM vs Kerberos

As of the current Windows Server generation, Microsoft lists NTLM as deprecated. NTLMv1 has been removed, while NTLMv2 remains available for compatibility but Microsoft states it will be removed in a future Windows Server release. Organisations should therefore identify NTLM dependencies and move applications toward Kerberos/Negotiate or other modern authentication technologies.

This makes NTLM knowledge especially important: you need to understand it not because companies should build new systems around it, but because enterprise engineers will continue encountering legacy dependencies while organisations migrate away from it.

34⌛ Why Kerberos Falls Back to NTLM

Suppose a user accesses \\fileserver01\share — Kerberos may work normally. But imagine the application accesses \\10.10.10.50\share or uses an alias with an incorrectly configured SPN. Kerberos authentication may fail and Windows may attempt another authentication method through the Negotiate provider.

Support engineers therefore frequently investigate: why is NTLM being used? Why didn't Kerberos work? Is the SPN correct? Is DNS correct? Is the user accessing the correct hostname? Can a domain controller be reached? Understanding the fallback is much more useful than simply memorising protocol definitions.

35📜 LDAP

Although not listed in the basic syllabus, students working with Active Directory must understand LDAP — Lightweight Directory Access Protocol. Applications use LDAP to communicate with directory services, for example searching for (&(objectClass=user)(sAMAccountName=jsmith)).

An LDAP path is written as a Distinguished Name – DN:

CN=John Smith,OU=Finance,OU=Users,DC=corp,DC=example,DC=com

Understanding DNs becomes extremely important when working with LDAP integrations, IAM products, security products, Linux applications, Java applications, VPN appliances, and identity providers.

36🔌 Common Active Directory Ports

Active Directory also uses dynamic RPC ports. This explains why network teams cannot always solve Active Directory connectivity simply by allowing TCP 389.

37🔍 The Global Catalog

In multi-domain forests, some domain controllers can operate as Global Catalog – GC servers. The Global Catalog stores information required for forest-wide searches and authentication scenarios — a user searching for another employee somewhere in the organisation does not necessarily know which domain contains the person, and the Global Catalog helps perform that forest-wide search. Standard ports: 3268 (Global Catalog) and 3269 (Global Catalog over TLS).

38🔄 Active Directory Replication

If an administrator changes Alice's password on DC01, other domain controllers must learn about directory changes — this occurs through replication. In reality Active Directory uses a multi-master replication topology, not a simple chain. Replication problems can create confusing behaviour: if replication between DC01 and DC02 breaks, a user authenticating through DC02 might temporarily see different directory information.

39🧩 Replication Troubleshooting

repadmin /replsummary   # Replication summary information
repadmin /showrepl      # Replication status for domain controllers
dcdiag                  # Domain-controller diagnostic tests

These commands are extremely valuable for Windows administrators, infrastructure engineers, support engineers, Active Directory engineers, and cybersecurity incident responders.

40👑 FSMO Roles

Although AD is largely multi-master, certain operations need designated role holders — Flexible Single Master Operations – FSMO roles. There are five: forest-wide (Schema Master, Domain Naming Master) and domain-wide (RID Master, PDC Emulator, Infrastructure Master).

netdom query fsmo

The PDC Emulator is particularly important because it plays roles involving password change coordination, time hierarchy, account lockout processing, and certain Group Policy operations. Junior administrators do not need to memorise every internal algorithm, but they should know what FSMO roles are and how to identify the role holders.

41🤝 Trusts

Sometimes users in one domain or forest need access to resources elsewhere. A trust relationship allows identities in one security domain to be recognised by another. Trusts are frequently encountered during mergers, acquisitions, subsidiary integration, corporate restructuring, and migration projects.

Imagine Company A acquires Company B. Rather than migrating every account immediately, administrators might establish a controlled trust between companyA.com and companyB.com while migration takes place. Trusts must be designed carefully because they affect security boundaries and access paths.

42☁️ Active Directory and Microsoft Entra ID

Students must understand: Active Directory is not Microsoft Entra ID. They are different identity systems.

Traditional Active Directory primarily supports Kerberos, NTLM, LDAP, domain join, Group Policy, and Windows integrated authentication. Microsoft Entra ID is a cloud identity platform heavily oriented around OAuth 2.0, OpenID Connect, SAML, cloud MFA, Conditional Access, cloud applications, and modern device identity. A modern company may use both.

43🔁 Hybrid Identity

Some organisations continue using Microsoft Entra Connect Sync. Others are adopting Microsoft Entra Cloud Sync. Microsoft describes Cloud Sync as a cloud-managed, lightweight-agent architecture and its strategic direction for hybrid identity synchronisation.

44🖥️ Domain Join vs Entra Join

A traditional Windows PC is Active Directory Domain Joined. A modern cloud-managed PC is Microsoft Entra Joined and managed through Intune. A hybrid PC is both AD joined and registered with Microsoft Entra ID — Microsoft calls this a Microsoft Entra hybrid joined device.

Hybrid joined systems can continue using technologies such as Group Policy while gaining cloud identity capabilities. Some organisations are gradually moving from AD Join + Group Policy toward Entra Join + Intune, but large enterprises may operate both models for many years.

45⌛ Current and Legacy Enterprise Technologies

Students entering IT today need to recognise multiple generations of Microsoft identity infrastructure.

Current Technologies

Windows Server 2016–2025, Active Directory Domain Services, Kerberos, Microsoft Entra ID, Entra Cloud Sync/Connect Sync, Microsoft Intune, Entra joined/hybrid joined devices, Windows Hello for Business, FIDO2/passkeys, Windows LAPS, Group Managed Service Accounts, and the PowerShell ActiveDirectory module.

Windows Server 2025 introduced a new Windows Server 2025 AD forest/domain functional level. Windows Server 2019 and 2022 environments commonly still use the Windows Server 2016 functional level.

Legacy Technologies You May Still Encounter

Windows Server 2008/2012, legacy domain functional levels, NTLM, NTLMv1 in extremely old systems, RC4-based Kerberos dependencies, old/unsigned LDAP integrations, older SMB dependencies, WINS/NetBIOS, logon scripts, VBScript administration, legacy Microsoft LAPS, old Group Policy templates, legacy service accounts with static passwords, and applications hard-coded to Domain Admin credentials.

The correct lesson is not "legacy technology doesn't matter." It is: understand legacy technology well enough to troubleshoot it, secure it, and migrate away from it.

46🛡️ Active Directory Security

Active Directory is frequently one of the highest-value systems in an enterprise. If an attacker compromises identity infrastructure, they may gain access to large portions of the organisation. Attackers therefore target user and administrator passwords, service accounts, domain controllers, Kerberos tickets, NTLM hashes, group memberships, misconfigured permissions, legacy protocols, and weak service accounts.

47👑 Domain Admins

Membership of Domain Admins should be extremely restricted. A normal IT support engineer generally does not need permanent Domain Admin access — a helpdesk account should have delegated password reset rights, not Domain Admin. Microsoft recommends privileged-access designs based on least privilege and separation between different administrative tiers.

48🖼️ Privileged Administration Tiers

Administrators should avoid using extremely privileged accounts on less-trusted systems. If a Domain Admin signs into an ordinary employee laptop and that laptop is compromised, administrator credentials may also be exposed.

49🔐 Windows LAPS

One important modern security technology is the Windows Local Administrator Password Solution – Windows LAPS. Without LAPS, organisations sometimes make the dangerous mistake of configuring the same local Administrator password on thousands of machines — if one machine is compromised, the attacker may reuse the password everywhere.

Windows LAPS can manage and rotate local administrator passwords and store authorised recovery information securely through supported directory mechanisms. Microsoft provides Windows LAPS integration with Windows Server Active Directory and modern Windows versions.

50🤖 Service Accounts

Applications often require identities, for example a SQL backup service using CORP\svc_sqlbackup. Traditional environments frequently use normal AD user accounts as service accounts — problems include passwords never changed, passwords stored in scripts, excessive privileges, passwords shared between teams, accounts added to Domain Admins, and nobody knowing which systems use the account.

Modern Windows environments may use Group Managed Service Accounts – gMSA where appropriate, reducing the requirement for administrators to manually manage service-account passwords.

51⚠️ Common Active Directory Attacks

Cybersecurity students should recognise attack concepts such as password spraying, credential stuffing, Kerberoasting, AS-REP roasting, Pass-the-Hash, Pass-the-Ticket, Golden Ticket attacks, Silver Ticket attacks, NTLM relay, LDAP reconnaissance, DCSync abuse, excessive group membership, and delegation abuse.

This module should teach what these attacks target and how defenders identify the associated weaknesses. The practical exploitation of these techniques belongs in controlled cybersecurity labs rather than production systems.

52🏄 Password Spraying

Traditional brute force might attempt 500 passwords against Alice's account — this can quickly cause lockout. Password spraying instead tries one common password against many accounts (Alice, Bob, Charlie, Maria...), attempting to avoid triggering per-account lockout thresholds.

Defences include MFA, strong password policy, password protection, Smart Lockout where applicable, monitoring authentication activity, removing legacy authentication paths, user awareness, and Conditional Access for cloud authentication.

53🔑 Pass-the-Hash

NTLM authentication historically created environments where possession of a user's NTLM password hash could sometimes be abused without knowing the plaintext password. This is one reason credential theft from Windows systems is so dangerous.

Defensive controls include Credential Guard, Privileged Access Workstations, reducing NTLM, least privilege, Windows LAPS, separating administrative accounts, and restricting lateral movement.

54🎟️ Kerberoasting

Some service accounts have Service Principal Names associated with them. An attacker with domain access may request certain Kerberos service tickets and attempt offline attacks against ticket material.

The defensive lesson: avoid weak service-account passwords, prefer managed service accounts where appropriate, use long random credentials, monitor unusual Kerberos activity, and minimise service-account privileges.

55🏆 Golden Tickets

The Active Directory domain contains a special account called KRBTGT. The KDC uses this account in Kerberos ticket operations. Microsoft documents KRBTGT as the built-in account associated with the Kerberos ticket-granting service.

If extremely sensitive KRBTGT secrets are compromised, attackers may be able to forge powerful Kerberos authentication material. The takeaway: protect domain controllers and Tier 0 identities extremely carefully.

56🧩 Active Directory Troubleshooting Methodology

When a user reports "I cannot log in," do not immediately reset their password. Investigate systematically.

This methodology is far more valuable than memorising every Active Directory menu.

57⚡ Useful Active Directory PowerShell Commands

Get-ADUser -Identity alice.brown                    # Search for a user
Get-ADUser alice.brown -Properties *                 # View detailed properties
Get-ADUser -Filter 'Name -like "*Brown*"'             # Search by name
Get-ADGroupMember "Finance-Users"                     # View group members

Add-ADGroupMember `
  -Identity "Finance-Users" -Members alice.brown       # Add user to group

Remove-ADGroupMember `
  -Identity "Finance-Users" -Members alice.brown       # Remove user from group

Disable-ADAccount alice.brown                         # Disable account
Enable-ADAccount alice.brown                          # Enable account
Unlock-ADAccount alice.brown                          # Unlock account

PowerShell becomes particularly valuable when administrators need to manage hundreds or thousands of objects.

Lab🦡 Lab 1 — Build an Active Directory Lab

Hypervisor
├─ DC01     Windows Server, AD DS, DNS, 10.10.10.10
└─ CLIENT01 Windows 11, 10.10.10.20

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Install-ADDSForest -DomainName "corp.cybercafe.test"

Lab📜 Lab 2 — Explore DNS

nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.cybercafe.test

Lab🗁️ Lab 3 — Create an OU Structure

CyberCafe
├─ Users
│   ├─ Finance
│   ├─ HR
│   └─ IT
├─ Workstations
├─ Servers
└─ ServiceAccounts

New-ADOrganizationalUnit -Name "CyberCafe" -Path "DC=corp,DC=cybercafe,DC=test"
New-ADOrganizationalUnit -Name "Users" -Path "OU=CyberCafe,DC=corp,DC=cybercafe,DC=test"

Lab👤 Lab 4 — Create Users

$password = Read-Host -AsSecureString
New-ADUser `
  -Name "Alice Brown" -GivenName "Alice" -Surname "Brown" `
  -SamAccountName "alice.brown" `
  -UserPrincipalName "alice.brown@corp.cybercafe.test" `
  -AccountPassword $password -Enabled $true `
  -Path "OU=Finance,OU=Users,OU=CyberCafe,DC=corp,DC=cybercafe,DC=test"

Get-ADUser alice.brown

Lab👥 Lab 5 — Create Groups

Add-ADGroupMember -Identity "GG-Finance-Users" -Members alice.brown
Get-ADGroupMember "GG-Finance-Users"

Lab🖥️ Lab 6 — Join a PC to the Domain

Add-Computer -DomainName "corp.cybercafe.test" -Restart

Lab📜 Lab 7 — Break DNS and Troubleshoot It

ipconfig /all
nslookup corp.cybercafe.test
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.cybercafe.test
nltest /dsgetdc:corp.cybercafe.test

Lab🔑 Lab 8 — Reset a Password

$newPassword = Read-Host -AsSecureString
Set-ADAccountPassword -Identity alice.brown -Reset -NewPassword $newPassword
Set-ADUser -Identity alice.brown -ChangePasswordAtLogon $true

Lab🔒 Lab 9 — Unlock an Account

Unlock-ADAccount alice.brown

Lab📜 Lab 10 — Create a Group Policy

gpupdate /force
gpresult /r
gpresult /h C:\gpresult.html

Lab📜 Lab 11 — Group Policy Inheritance

Lab🎟️ Lab 12 — Investigate Kerberos

Lab🖥️ Lab 13 — Domain Controller Diagnostics

Lab🎤 Lab 14 — Enterprise Helpdesk Scenario

Lab👤 Lab 15 — New Employee Scenario

Lab🚫 Lab 16 — Employee Leaves the Company

🏢 Real-World Enterprise Architecture

By the end of the module, students should be able to understand an architecture such as:

Endpoints might simultaneously be:

All three models may exist inside the same multinational enterprise.

🎫 Common Active Directory Support Tickets

Students entering helpdesk or infrastructure positions are likely to encounter tickets like these. Try to think through what you'd check before revealing.

🔧 Important Tools Students Should Know

Graphical

Active Directory Users and Computers (ADUC), Active Directory Administrative Center, Active Directory Sites and Services, Active Directory Domains and Trusts, Group Policy Management Console, DNS Manager, Event Viewer.

Command Line

ipconfig   nslookup   ping       nltest     gpupdate
gpresult   klist      whoami     netdom     dcdiag     repadmin

PowerShell

Get-ADUser        New-ADUser              Set-ADUser
Get-ADComputer     Get-ADGroup             Get-ADGroupMember
Add-ADGroupMember  Remove-ADGroupMember    Get-ADOrganizationalUnit
New-ADOrganizationalUnit  Disable-ADAccount  Enable-ADAccount
Unlock-ADAccount   Set-ADAccountPassword

🎯 What a Junior IT Engineer Should Understand

A junior engineer does not need to be able to design a multinational Active Directory forest immediately. But they should confidently be able to answer these. Click each one you're already confident on.

1. 1What is Active Directory?
2. 2What is a Domain Controller?
3. 3What is a domain?
4. 4What is a forest?
5. 5What is an OU?
6. 6OU vs Group — what's the difference?
7. 7What is a user object?
8. 8What is a computer object?
9. 9What is Group Policy?
10. 10How does a PC find a Domain Controller?
11. 11Why is DNS important to Active Directory?
12. 12What is Kerberos?
13. 13What is NTLM?
14. 14Why is NTLM considered legacy?
15. 15What is LDAP?
16. 16What is a SID?
17. 17What is authentication?
18. 18What is authorization?
19. 19What is Active Directory replication?
20. 20What are FSMO roles?
21. 21What is the Global Catalog?
22. 22What is a trust?
23. 23What is Microsoft Entra ID?
24. 24AD vs Entra ID — what's the difference?
25. 25What is hybrid identity?
26. 26How do you reset a password and unlock an account?
27. 27How do you join a computer to the domain?
28. 28How do you troubleshoot Group Policy?

🧠 Interview Questions

Try answering each yourself before revealing the model answer.

🛡️ Final Security Lessons

Students should finish this module understanding that Active Directory is much more than "a place where usernames are stored." It is often the identity control plane of the enterprise.

A badly configured Active Directory environment can allow an attacker to progress from:

A well-managed environment therefore applies least privilege, separate administrator accounts, strong authentication, MFA where applicable, reduced NTLM usage, Kerberos hardening, Windows LAPS, managed service accounts, secure domain controllers, privileged administration tiers, monitoring, central logging, proper patch management, secure backups, tested disaster recovery, careful delegation, and regular privilege reviews.

Module Outcome

After completing Module 4, students should be able to:

1. Explain how Active Directory fits into global enterprise infrastructure.
2. Explain domains, forests, OUs, users, groups and computer objects.
3. Understand how domain controllers provide authentication and directory services.
4. Explain why DNS is fundamental to Active Directory.
5. Create and administer users and groups.
6. Join Windows computers to a domain.
7. Reset passwords and unlock accounts safely.
8. Create and troubleshoot Group Policy.
9. Explain Kerberos authentication using TGTs and service tickets.
10. Explain what NTLM is and why organisations are reducing its use.
11. Understand LDAP, SIDs, SPNs and Windows authentication at a practical level.
12. Understand Active Directory replication, Sites, Global Catalogs, trusts and FSMO roles.
13. Explain the difference between Active Directory and Microsoft Entra ID.
14. Understand hybrid identity and the transition from traditional AD management toward Entra ID and Intune.
15. Recognise common Active Directory security risks.
16. Use PowerShell and Windows troubleshooting tools to investigate common AD problems.
17. Understand both modern Active Directory environments and the legacy technologies they will encounter in existing global organisations.

The most important lesson is:

Do not learn Active Directory as a collection of Microsoft menus. Learn how identity, DNS, authentication, authorisation, policies, computers, networks and applications connect together.

Once you understand those relationships, Active Directory troubleshooting becomes significantly easier. This module also creates a strong bridge into Microsoft 365, cloud, authentication/MFA, IAM and SOC, because you'll already understand the difference between an identity, its authentication mechanism, group-based authorization, and the systems consuming that identity.