What Is Active Directory? LDAP, Kerberos, and Directory Services Explained

Active Directory is Microsoft's directory service that manages users, computers, and permissions across an organisation. Understanding LDAP, Kerberos, and AD's attack surface is essential for both defenders and penetration testers.

Active Directory (AD) is Microsoft's directory service — a centralised system that manages users, computers, printers, and policies across an organisation's network. It is the backbone of authentication and authorisation in the vast majority of enterprise Windows environments.

For attackers, Active Directory is the crown jewel: compromising it typically means complete control of the organisation. For defenders, understanding its structure and weaknesses is essential.

Core Active Directory Concepts

Domain

A domain is the administrative boundary in Active Directory — a collection of objects (users, computers, groups) that share a common directory database and are governed by the same security policies. Example: corp.example.com.

Domain Controller (DC)

A server running Active Directory Domain Services (AD DS). It stores the AD database, authenticates users, and enforces Group Policy. Every domain has at least one DC; critical environments have multiple for redundancy.

Forest and Tree

  • Tree: One or more domains with a shared namespace (e.g. example.com, sub.example.com)
  • Forest: One or more trees that share a common schema and Global Catalog. The forest root domain is the most trusted domain in the environment.

Organisational Unit (OU)

A container within a domain used to organise objects and apply Group Policy. OUs mirror an organisation's structure (by department, geography, or function).

Groups

  • Security groups: Grant permissions to resources
  • Distribution groups: Used for email distribution (no security function)
  • Domain Admins: The most privileged built-in group — members have full control of the domain

LDAP: The Directory Access Protocol

LDAP (Lightweight Directory Access protocol) is the protocol used to query and modify Active Directory. Applications authenticate users and look up directory information via LDAP queries.

LDAP uses a hierarchical naming system called Distinguished Names (DN):

CN=Jane Doe,OU=Finance,DC=corp,DC=example,DC=com
  • CN = Common Name (object name)
  • OU = Organisational Unit
  • DC = Domain Component

Common LDAP operations:

  • BIND: Authenticate to the directory
  • SEARCH: Query for objects matching a filter
  • ADD / MODIFY / DELETE: Create, update, or remove objects

LDAP runs on port-the-internets-core-protocol)-and-UDP-ports-explained) 389 (cleartext) or port 636 (LDAPS — LDAP over TLS). Cleartext LDAP exposes credentials to network sniffing; LDAPS or LDAP signing should always be enforced.

Kerberos: How AD Authentication Works

Modern Active Directory uses the Kerberos protocol for authentication. Kerberos uses tickets rather than passwords — users prove their identity with a ticket, not by sending their password across the network.

The Kerberos Flow

1. AS-REQ: Client asks the Key Distribution Centre (KDC) for a Ticket Granting Ticket (TGT)
   - Client encrypts a timestamp with their password hash
   - KDC verifies and returns a TGT (encrypted with the KDC's key)

2. TGS-REQ: Client presents TGT and requests a Service Ticket for a specific resource
   (e.g. a file server, SharePoint, SQL server)

3. TGS-REP: KDC issues a Service Ticket (encrypted with the service account's hash)

4. AP-REQ: Client presents Service Ticket to the target service
   - Service decrypts it with its own hash and grants access

The KDC runs on the Domain Controller. Passwords never traverse the network — only encrypted tickets.

Group Policy (GPO)

Group Policy Objects (GPOs) are sets of configuration rules applied to users and computers in a domain. A GPO can:

  • Enforce password complexity requirements
  • Push software installations
  • Configure [firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) and registry settings
  • Restrict access to USB drives or Control Panel
  • Map network drives and printers

GPOs are linked to OUs, sites, or the entire domain. They are processed at login and periodically refreshed.

NTLM: The Legacy Authentication Protocol

NTLM (NT LAN Manager) is an older authentication protocol still used as a fallback when Kerberos is unavailable (e.g. authenticating by [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) rather than hostname). NTLM is significantly weaker than Kerberos and is the basis of several attack techniques.

Active Directory Attack Techniques

Active Directory is one of the most targeted systems in enterprise networks. Here are the most common attack paths:

Pass-the-Hash (PtH)

NTLM authentication uses a hash-cryptographic-hash-functions-explained) of the password, not the password itself. If an attacker can extract a user's NTLM hash from memory (using Mimikatz), they can authenticate as that user without knowing the plaintext password.

Defence: Credential Guard, Protected Users security group, disable NTLM where possible.

Kerberoasting

Any authenticated domain user can request a Service Ticket for any service account. Service Tickets are encrypted with the service account's password hash-cryptographic-hash-functions-explained). Attackers request tickets for accounts with weak passwords and crack them offline.

1. Attacker (as any domain user) requests Service Tickets for all SPNs in the domain
2. Extracts the encrypted ticket hashes
3. Runs offline cracking (Hashcat) against them
4. Recovers the service account password — often a domain admin

Defence: Strong, long, random passwords for service accounts; use Managed Service Accounts (MSAs).

Pass-the-Ticket

Instead of cracking a Kerberos ticket, an attacker steals and imports a valid ticket from another user's session-how-the-world-wide-web-works), impersonating them without knowing their password.

Golden Ticket Attack

The most powerful Kerberos attack. If an attacker compromises the KRBTGT account (the KDC service account), they can forge Ticket Granting Tickets for any user — including Domain Admins — that are valid for 10 years by default.

Defence: Rotate the KRBTGT password twice after a DC compromise (invalidates all existing TGTs).

AS-REP Roasting

For accounts with Kerberos pre-authentication disabled, anyone can request an AS-REP without first proving knowledge of the password. The response contains an encrypted section that can be cracked offline.

Defence: Ensure all accounts require Kerberos pre-authentication (the default setting).

BloodHound: Attack Path Visualisation

BloodHound is an open-source tool (used by both attackers and defenders) that maps Active Directory relationships and visualises attack paths. It answers questions like: "What is the shortest path from a compromised user to Domain Admin?"

BloodHound ingests AD data using SharpHound (the data collector) and displays a graph of trust relationships, group memberships, and delegation rights that reveal exploitable paths defenders might not have noticed.

Hardening Active Directory

| Control | What it prevents | |---|---| | Tiered administration model | Lateral movement from workstations to domain admins | | Credential Guard | Pass-the-hash-cryptographic-hash-functions-explained), credential theft-how-attackers-steal-credentials) from LSASS | | Protected Users group | Credential caching, NTLM fallback for privileged accounts | | LAPS (Local Admin Password Solution) | Lateral movement via shared local admin passwords | | audit and SIEM-security-operations-centre-siem-incident-response-explained) integration | Detection of abnormal AD queries and authentication | | Regular privileged account reviews | Accumulation of excessive rights over time | | Rotate KRBTGT password periodically | Limits Golden Ticket persistence |

Key Takeaways

  • Active Directory is the central identity and access management-shared-responsibility-model-explained) system in Windows enterprise environments
  • LDAP is the protocol used to query the directory; Kerberos is the authentication protocol
  • Kerberos issues tickets — passwords never cross the network during authentication
  • Key attack techniques: Pass-the-hash-cryptographic-hash-functions-explained), Kerberoasting, Golden Ticket, AS-REP Roasting
  • BloodHound maps attack paths through AD relationships
  • Hardening focuses on tiered access, credential protection, and continuous monitoring