Active Directory 🌳

1. RSAT Tools (Remote Server Administration Tools)

RSAT allows admins to manage Windows Server roles from a Windows client machine.
Key tools:

1. Active Directory Users and Computers (ADUC) – Manage users, groups, OUs.

2. Active Directory Sites and Services (ADSS) – Manage replication between domain controllers (DCs).

3. Active Directory Domains and Trusts – Manage trust relationships between domains/forests.

4. DNS & DHCP Management – Administer network name resolution and IP assignment.

Example: From your Windows 11 workstation, install RSAT and open ADUC to create a new user in a domain without logging onto the server itself.

2. LDAP (Lightweight Directory Access Protocol)

• Protocol to access and manage directory information (like users, groups, devices) over TCP/IP.

• Default port: 389 (unencrypted), 636 (LDAPS).

• Example: A web application querying AD for user authentication uses LDAP.

Kerberos relation:

• Kerberos is the primary authentication protocol in AD.

• LDAP can be used to query AD for users/groups, while Kerberos issues tickets for authentication.

3. NetBIOS and DNS

• NetBIOS (Network Basic Input/Output System): Legacy naming protocol used for LAN identification of computers.

• Relation to DNS: Modern AD uses DNS to resolve domain names, but NetBIOS is still used for backward compatibility.

• Example: A Windows client might first attempt NetBIOS resolution (WINS) and then fall back to DNS if not found.

4. Global Catalog (GC)

• A partial replica of all objects in the forest.

• Stores commonly searched attributes to speed up queries.

• Example: A user from Domain A searches for a user in Domain B; GC helps locate it quickly.

5. RODC (Read-Only Domain Controller)

• A DC with a read-only copy of AD database.

• Ideal for branch offices with low security.

• Example: Local login works, but changes must be replicated to writable DCs.

6. DNS & AD Integration

• AD requires DNS for name resolution.

• Domain controllers register SRV records (_ldap._tcp.dc._msdcs.domain.com).

• Without DNS, clients cannot locate DCs.

7. Active Directory Events to Monitor

• Event ID 4625 – Failed login attempt

• Event ID 4769 – Kerberos service ticket request

• Event ID 4740 – Account lockout

• Tools: SIEM (Security Information and Event Management), e.g., Splunk, to aggregate logs and alert.

Cyberattack prevention tips:

1. Monitor failed logins → brute force detection.

2. Monitor privileged account changes.

3. Regularly patch DCs.

4. Enforce strong password policies.

8. Trust Relationships in AD

• Trust: Logical link allowing authentication between domains/forests.

• Types:

  1. Parent-child trust – Auto-created when a child domain is added.

  2. Tree-root trust – Between two domain trees in a forest.

  3. External trust – Non-transitive, for domains outside the forest.

  4. Forest trust – Transitive, between two forests.

• Transitive trust: Trust extends automatically to other trusted domains.

Domain vs. Multi-Forest:

• Single forest: Centralized schema, easier replication, simple trust.

• Multi-forest: Isolated schemas, more complex trusts, used for mergers or security isolation.

9. Domain Trust Access Authentication

• Users from a trusted domain can access resources in another domain.

• Authentication request: User → DC in own domain → DC in trusted domain → access granted if permitted.

10. SolarWinds Access Rights Manager (ARM)

• Tool for monitoring, auditing, and reporting AD permissions.

• Helps detect excessive rights or suspicious changes.

• Optional: Useful for medium to large enterprises to ensure compliance and security.

11. Domain

• A logical container of objects (users, computers, printers) within AD.

• Controlled by DCs and uses common policies.

• Example: corp.local is a domain with all employee accounts.

12. Single Sign-On (SSO)

• Users log in once and access multiple resources across AD without repeated authentication.

• Example: Logging into Windows, then accessing SharePoint, Outlook, and Teams automatically.

13. Replication, Synchronization, Backup

• Replication: DCs sync changes across the domain (intra-site vs. inter-site).

• Synchronization: Ensures consistent data across DCs.

• Backup: Regular system state or AD backup for recovery.

• ID/account status: Monitor user enabled/disabled, locked accounts, password expiration.

14. Example AD Security & Operations Workflow

1. Monitor Event ID 4625 → detect brute force.

2. Use SolarWinds ARM → audit permissions.

3. Backup DCs weekly → prevent data loss.

4. Check replication status using repadmin /replsummary.

15. Organizational Units (OU)

• Logical containers used to organize users, computers, and groups.

• Allow delegation of control and GPO targeting.

• Example:
  OU=IT, OU=Employees, DC=corp, DC=local

Keyboard shortcut tip:

• Win + R → dsa.msc to open AD Users & Computers directly.

16. Group Policy Objects (GPO)

• Centralized configuration management for users and computers.

• Applied in this order: Local → Site → Domain → OU (LSDOU).

• Example:

  • Disable USB storage.

  • Enforce password complexity.

  • Map network drives automatically.

Key files:

• SYSVOL stores GPO templates and scripts.

17. Security Groups vs Distribution Groups

• Security Groups: Used for permissions and access control.

• Distribution Groups: Used only for email lists.

Scopes:

1. Domain Local

2. Global

3. Universal

Example:

• Global group → added to Domain Local group → applied to a folder.

18. FSMO Roles (Flexible Single Master Operations)

There are 5 critical AD roles:

1. Schema Master

2. Domain Naming Master

3. RID Master

4. PDC Emulator

5. Infrastructure Master

Why they matter:

• Prevent conflicts (e.g., duplicate SIDs).

• Required for password changes and time synchronization.

Command:

netdom query fsmo

19. SYSVOL

• Shared folder replicated across DCs.

• Contains:

  • GPOs

  • Login scripts

• Uses DFSR (Distributed File System Replication).

Failure symptom:

• GPOs not applying to users or computers.

20. AD Schema

• Blueprint defining object types and attributes.

• Extending schema is irreversible.

• Example: Exchange Server extends AD schema.

Security note:

• Only Schema Admins can modify it.

21. AD Authentication vs Authorization

• Authentication: Who are you? (Kerberos / NTLM)

• Authorization: What can you access? (ACLs, group membership)

Example:

• Login succeeds, but access to a folder is denied → authorization failure.

22. Kerberos Ticket Flow (Simplified)

1. User logs in → requests TGT (Ticket Granting Ticket)

2. KDC issues TGT

3. User requests service ticket

4. Access granted

Ports:

• TCP/UDP 88

Attack vector:

• Pass-the-Ticket

• Golden Ticket

23. NTLM (Legacy Authentication)

• Older authentication protocol.

• Less secure than Kerberos.

• Vulnerable to relay attacks.

Best practice:

• Disable NTLM where possible.

24. AD Certificates & PKI

• Used for:

  • Smart card logins

  • LDAPS

  • VPN authentication

• Managed via Active Directory Certificate Services (AD CS).

Example:

• Enforcing MFA using smart cards.

25. Time Synchronization (Critical)

• Kerberos requires clocks within 5 minutes.

• PDC Emulator syncs with external time source.

Command:

w32tm /query /status

26. Service Accounts

• Used by applications and services.
  Types:

1. Local Service

2. Network Service

3. Managed Service Account (MSA)

4. Group Managed Service Account (gMSA)

Security tip:

• Never use normal user accounts for services.

27. AD Hardening Best Practices

1. Tiered admin model (Tier 0, 1, 2)

2. Disable legacy protocols

3. Least privilege

4. Monitor privileged group changes

5. Regular backups

Event IDs to watch:

• 4728 (group membership added)

• 4732 (local group changes)

28. Azure AD / Entra ID vs Active Directory

• AD: On-premises, LDAP, Kerberos

• Azure AD (Entra ID): Cloud-based, OAuth, SAML, OpenID Connect

Hybrid identity:

• AD + Azure AD Connect

29. Account Lifecycle Management

States:

1. Created

2. Enabled

3. Disabled

4. Locked

5. Deleted

Key Event IDs:

• 4720 (account created)

• 4725 (disabled)

• 4740 (locked)

30. Disaster Recovery for Active Directory

• System State backups

• Multiple DCs per domain

• Test restores regularly

Worst case:

• Authoritative restore

• Forest recovery

31. Common AD Interview Red Flags

• Single DC only

• No backups

• No monitoring

• NTLM still enabled

• Everyone is Domain Admin

32. Active Directory Attack Surface

Active Directory is attacked through:

• Credentials

• Trusts

• Misconfigurations

• Legacy protocols

Key principle:

• AD is not hacked; it is abused.

33. Credential Theft

Common techniques:

1. Password dumping (LSASS memory)

2. Cached credentials

3. Keylogging

Typical tools (awareness only):

• Mimikatz (credential extraction)

Defense:

• Credential Guard

• Disable WDigest

• Enforce MFA

Event IDs:

• 4624 (successful logon)

• 4672 (special privileges assigned)

34. Pass-the-Hash (PtH)

• Attacker uses NTLM hash instead of password.

• No cracking required.

Conditions:

• NTLM enabled

• Reused local admin passwords

Defense:

• Disable NTLM

• Use LAPS

35. Pass-the-Ticket (PtT)

• Kerberos tickets reused or injected.

• Often follows credential compromise.

Defense:

• Short ticket lifetime

• Monitor Kerberos event IDs

Event ID:

• 4769 (service ticket request anomaly)

36. Kerberoasting

• Attacker requests service tickets.

• Cracks service account passwords offline.

Targets:

• Service accounts with weak passwords.

Defense:

• gMSA

• Long random passwords

• Monitor Event ID 4769

37. Golden Ticket Attack

• Forged Kerberos ticket using KRBTGT account.

• Full domain compromise.

Defense:

• Rotate KRBTGT password twice

• Monitor abnormal TGT lifetimes

This is catastrophic-level risk.

38. Silver Ticket Attack

• Forged service ticket.

• Limited to specific service access.

Defense:

• Strong service account security

• Monitor service authentication patterns

39. LDAP Injection

• Malicious LDAP queries via vulnerable apps.

• Similar to SQL injection.

Defense:

• Input validation

• Secure LDAPS only (port 636)

40. Privilege Escalation via Groups

• Adding user to privileged groups:

  • Domain Admins

  • Enterprise Admins

  • Backup Operators

Event IDs:

• 4728

• 4732

Defense:

• Just-in-Time (JIT) admin access

• SIEM alerts

41. Lateral Movement

• Moving from one machine to another.

• Uses SMB, WMI, RDP, PsExec.

Defense:

• Network segmentation

• Disable local admin reuse

• Firewall rules

42. Domain Controller Exposure

Common mistakes:

• DC used for browsing

• DC hosts applications

• DC has internet access

Rule:

• DCs should do only AD & DNS.

43. Active Directory Persistence Techniques

Attackers create:

1. Hidden admin accounts

2. Backdoor GPOs

3. Scheduled tasks

Defense:

• Baseline monitoring

• GPO auditing

• Regular AD health checks

44. Security Information and Event Management (SIEM)

Purpose:

• Centralize logs

• Correlate events

• Trigger alerts

Examples:

• Splunk

• Sentinel

Critical AD logs:

• Authentication

• Privilege changes

• GPO modifications

45. Tiered Administrative Model

Tier 0:

• Domain Controllers

• Enterprise Admins

Tier 1:

• Servers

Tier 2:

• Workstations

Rule:

• Never log Tier 0 creds into Tier 2 systems.

46. Privileged Access Workstations (PAW)

• Hardened admin machines.

• Used only for AD administration.

Defense value:

• Reduces credential theft risk.

47. Local Administrator Password Solution (LAPS)

• Randomizes local admin passwords.

• Stored securely in AD.

Prevents:

• Lateral movement

• Pass-the-Hash

48. Account Lockout Policies

• Prevent brute-force attacks.

• Example:

  • 5 attempts

  • 15-minute lockout

Monitor:

• Event ID 4740

49. Group Policy Abuse

Attackers:

• Modify startup scripts

• Deploy malicious tasks

Defense:

• GPO change auditing

• Restrict GPO editors

50. AD Backup & Recovery Security

Attack scenario:

• Ransomware deletes AD objects.

Defense:

• Offline backups

• Immutable storage

• Regular restore testing

51. Zero Trust & Active Directory

Principles:

1. Never trust

2. Always verify

3. Least privilege

Applied to AD:

• MFA everywhere

• Conditional access

• Continuous monitoring

52. Detection Tools for AD

Examples:

• Microsoft Defender for Identity

• PingCastle

• BloodHound (analysis)

Purpose:

• Identify attack paths

• Reduce exposure

53. BloodHound Graph Analysis

Maps:

• User → group → computer → admin paths.

Used by:

• Attackers and defenders.

Defense:

• Remove unnecessary privilege chains.

54. Common AD Misconfigurations

1. Everyone = Full Control

2. Password never expires

3. Legacy protocols enabled

4. Shared admin accounts

55. Real-World AD Breach Pattern

1. Phishing

2. Credential theft

3. Lateral movement

4. Privilege escalation

5. Persistence

6. Domain dominance

PRACTICAL ACTIVE DIRECTORY HOME LAB — FROM ZERO

56. Lab Architecture Overview

Goal:

• One forest

• Two domains (parent + child)

• DNS integrated

• Trusts auto-created

• One client machine

Minimal setup:

1. DC1 – Forest Root Domain Controller + DNS

2. DC2 – Child Domain Controller + DNS

3. CLIENT1 – Windows workstation joined to domain

57. Host Requirements

1. Windows 10/11 Pro or Enterprise (Hyper-V required)

2. 16 GB RAM minimum (8 GB workable but painful)

3. Virtualization enabled in BIOS

Enable Hyper-V:

• Win + R → optionalfeatures

• Enable Hyper-V Platform and Management Tools

58. VM Creation (Baseline)

Create 3 VMs:

1. DC1

   • Windows Server 2022

   • 2 CPU / 4 GB RAM

   • Static IP: 192.168.10.10

2. DC2

   • Windows Server 2022

   • 2 CPU / 4 GB RAM

   • Static IP: 192.168.10.20

3. CLIENT1

   • Windows 11 Pro

   • DHCP or Static: 192.168.10.50

Networking:

• Internal Virtual Switch only (isolated lab)

59. Configure Static IP & DNS (DC1)

On DC1:

• IP: 192.168.10.10

• DNS: 127.0.0.1

Verify:

ipconfig /all

Common mistake:

• Using public DNS (8.8.8.8) → AD WILL BREAK

60. Install AD DS & DNS (DC1)

Server Manager →

1. Add Roles

2. Active Directory Domain Services

3. DNS Server

Promote to DC:

• New forest

• Domain name: corp.local

Reboot.

61. Verify Forest Root Domain

After reboot:

Check:

echo %USERDNSDOMAIN%

Open:

• dsa.msc

• dnsmgmt.msc

You should see:

• _msdcs.corp.local

• SRV records

62. Create Basic AD Structure

In ADUC:

1. Create OUs:

   • IT

   • HR

   • Workstations

2. Create test users:

   • j.decelles.it

   • j.decelles.hr

3. Create groups:

   • IT_Admins (Global)

   • HR_Users (Global)

63. Join CLIENT1 to Domain

On CLIENT1:

• DNS → 192.168.10.10

• Join domain: corp.local

Command check:

whoami

Login with domain user.

64. Install DC2 (Child Domain)

Prepare DC2:

• DNS: 192.168.10.10

Join DC2 to corp.local first.

Install AD DS + DNS.

Promote:

• Add a child domain

• Domain name: branch.corp.local

Reboot.

65. Trust Relationship Verification

Trust created automatically:

• Parent ↔ Child

• Two-way

• Transitive

Verify:

• Active Directory Domains and Trusts

• Properties → Trusts tab

66. Global Catalog Configuration

By default:

• First DC is GC

Verify:

• dssite.msc

• NTDS Settings → Global Catalog checked

Why it matters:

• Cross-domain logons

• Universal group membership

67. DNS Delegation & Resolution Test

From CLIENT1:

nslookup

set type=SRV

_ldap._tcp.dc._msdcs.corp.local

Expected:

• Both DCs returned

68. Replication Verification

Run on DC1:

repadmin /replsummary

Healthy state:

• 0 fails

• Low latency

69. Group Policy Test

Create GPO:

• Disable Control Panel

Link to:

• OU = Workstations

Force update:

gpupdate /force

Verify with:

gpresult /r

70. Account Lockout Test

Set policy:

• 3 attempts

• 10-minute lockout

Trigger failed logins.

Check Event Viewer:

• Event ID 4740

71. RODC (Optional Advanced Step)

Create a 4th VM:

• Branch office DC

• Read-only replication

Use when:

• Physical security is weak

72. Backup & Recovery Simulation

On DC1:

• Windows Server Backup

• System State backup

Test restore in isolated snapshot.

73. Security Hardening Tasks

1. Disable NTLM

2. Enable LDAP signing

3. Enforce MFA (if hybrid)

4. Apply LAPS

74. Trust Testing

From parent domain user:

• Access child domain resource
  From child domain user:

• Access parent resource

Confirm:

• Kerberos tickets issued

75. Lab Validation Checklist

✔ DNS resolves DCs
✔ Users authenticate
✔ GPOs apply
✔ Replication healthy
✔ Trust works

If any fails → DNS first.