What Is Active Directory and Why Attackers Target It?

What Active Directory Is and How It Works

Active Directory is a directory service developed by Microsoft that runs on Windows Server. It stores information about objects in the network — users, computers, groups, printers, and other resources — and provides authentication and authorization services across the network. Every Windows domain environment uses Active Directory as its central identity and access management system.

The core components of Active Directory are domains, organizational units (OUs), forests, and trusts. A domain is a logical grouping of network objects that share the same AD database. Organizational units are containers within a domain that organize objects for administrative purposes and apply group policy. Forests are collections of domains that share a common schema and global catalog. Trusts define relationships between domains and forests that allow users in one domain to access resources in another.

Domain Controllers

Domain controllers are the servers that run Active Directory services. Every authentication request in a Windows domain environment is processed by a domain controller. When a user logs into their workstation, the workstation sends the authentication request to a domain controller. The domain controller verifies the credentials and returns an authentication token that grants access to domain resources. Domain controllers are the most critical infrastructure in a Windows environment — their compromise gives an attacker the ability to impersonate any user, access any system, and persist indefinitely.

Why Active Directory Is the Primary Target for Attackers

Active Directory is the crown jewel of every Windows environment for precisely the reason it is the crown jewel for legitimate administrators: it controls everything. An attacker who achieves Domain Administrator privileges in Active Directory has, effectively, access to every Windows system in the domain, the ability to create new accounts with any level of privilege, the ability to modify existing accounts and their permissions, access to credentials stored in AD, and the ability to establish persistence that survives most remediation efforts.

The Active Directory attack path is so well-documented and so consistently followed that it has become the standard post-exploitation playbook: gain initial foothold on any system, harvest credentials from that system's memory, use those credentials to pivot to additional systems, continue credential harvesting and lateral movement until reaching a domain admin account, and then leverage domain admin to achieve the attack objective. This path is repeatable because Active Directory's design — optimized for enterprise manageability — creates credential exposure opportunities at every step.

Securing Active Directory

Active Directory security is a deep discipline with significant overlap with the broader identity security domain. The highest-impact controls include tiered administration models that prevent administrative accounts from being used on standard workstations where credential theft is most likely, privileged access workstations dedicated to administrative tasks that are hardened against credential theft, regular Active Directory health assessments that identify misconfigurations and privilege accumulation, monitoring of privileged account activity and sensitive AD object modifications, and protection of domain controller infrastructure against unauthorized access.

Specific AD configurations that consistently appear in penetration tests and breach investigations: accounts with Kerberoastable service principal names that allow offline password cracking, accounts with 'Do Not Require Kerberos Preauthentication' enabled (AS-REP roasting), excessive membership in privileged groups, unconstrained delegation settings that allow credential impersonation, and AdminSDHolder misconfigurations that grant unexpected privileged access.

Related Reading

• Privileged Access Management (PAM) — the discipline that hardens AD admin access
• Pass-the-Hash Attacks — the AD credential-theft technique
• Kerberoasting — the Kerberos-specific attack against AD service accounts

Frequently Asked Questions

What is Active Directory?

Active Directory is Microsoft's directory service for Windows domain networks — the system that manages user accounts, computer accounts, groups, authentication, and authorization across the Windows environment. Active Directory stores identity information centrally, enforces group policy for security configuration, and provides the authentication infrastructure that determines who can access what across the domain. It is deployed by 95% of Fortune 1000 companies and the majority of mid-market organizations running Windows infrastructure.

Why is Active Directory the primary target for attackers?

Compromising Active Directory provides comprehensive access to the Windows environment — the ability to impersonate any user, access any system, modify permissions, create new privileged accounts, and establish persistence that survives most remediation efforts. The Active Directory attack path is the standard post-exploitation playbook: gain initial foothold, harvest credentials, move laterally, escalate privilege, reach domain admin. Every significant Windows-environment breach involves AD compromise as either a primary target or a pathway.

What is Kerberoasting?

Kerberoasting is an attack technique that exploits Active Directory's Kerberos authentication protocol to extract password hashes for service accounts. An authenticated attacker can request a Kerberos service ticket for any service account in the domain. The returned ticket contains an encrypted blob that includes the service account's password hash. The attacker takes that hash offline and attempts to crack it. Service accounts with weak passwords or those that have not been rotated frequently are cracked in hours. Kerberoasting requires only standard domain user privileges to execute.

What is the difference between Active Directory and Entra ID?

Active Directory (AD) is the on-premises directory service that runs on Windows Server in domain controllers. Microsoft Entra ID (formerly Azure AD) is the cloud-based identity provider for Microsoft 365, Azure, and federated SaaS applications. They serve different but related purposes — AD manages on-premises Windows authentication; Entra ID manages cloud and SaaS authentication. Most organizations operate hybrid identity, synchronizing AD to Entra ID through Entra Connect (formerly Azure AD Connect). Hybrid identity creates additional attack surface where compromises in one system can propagate to the other.

What are tier 0 assets in Active Directory?

Tier 0 assets are the most sensitive components of an Active Directory environment — the systems and accounts that have direct or indirect control over the entire forest. This includes domain controllers, the AdminSDHolder object, the Schema Admins and Enterprise Admins groups, certificate authorities that issue authentication certificates, and any system with credentialed access to these resources. Microsoft's tiered administration model isolates tier 0 administrative access from tier 1 (servers) and tier 2 (workstations) to prevent credential theft on lower tiers from compromising the most sensitive tier.

How does Mimikatz exploit Active Directory?

Mimikatz is a post-exploitation credential extraction tool that reads passwords, hashes, Kerberos tickets, and other credentials from the LSASS process memory on Windows systems. After an attacker achieves local administrative access on a workstation or server, Mimikatz can extract every credential cached on that system — including the credentials of users who logged in remotely. Mimikatz also enables Pass-the-Hash and Pass-the-Ticket attacks, where extracted credential material is used to authenticate to additional systems without knowing the actual password. Mimikatz has been used in essentially every significant Windows-environment breach since its release in 2011.

How do we secure Active Directory?

The highest-impact controls are tiered administration that prevents administrative credentials from being used on standard workstations, privileged access workstations dedicated to administrative tasks, regular AD health assessments that identify Kerberoasting targets and delegation misconfigurations, monitoring of privileged account activity and AdminSDHolder modifications, LAPS (Local Administrator Password Solution) deployment to randomize local admin passwords, and protection of domain controller infrastructure against unauthorized physical and network access. Microsoft Defender for Identity provides AD-specific behavioral detection that complements EDR.

Real-World Example: The NotPetya Active Directory Propagation

NotPetya's extraordinary speed of propagation — taking down Maersk's global network in hours — was enabled by its Active Directory exploitation capability. NotPetya used a modified version of the Mimikatz credential extraction tool to harvest credentials from the memory of compromised systems. It then used the Windows PSEXEC and WMIC tools with the harvested credentials to authenticate to additional systems on the network and deploy its destructive payload. In environments where privileged credentials were used on standard workstations — extremely common — NotPetya rapidly harvested credentials with domain-level access and used them to reach every accessible system. Network segmentation that prevented domain credentials from reaching across network zones was the only control that slowed propagation.