What is Active Directory Security?

Active Directory security focuses on protecting the identity infrastructure that controls authentication and authorization in most enterprise environments from attacks like Kerberoasting and privilege escalation.

What is Active Directory security?

Active Directory (AD) security encompasses the practices, configurations, and monitoring needed to protect the identity and access management infrastructure central to most enterprise networks. Since AD controls authentication and authorization for nearly all resources, compromising AD gives attackers complete domain dominance and access to all organizational systems.

Why is Active Directory a primary attack target?

AD is targeted because it manages authentication for the entire enterprise. Compromising a single domain admin account grants access to every system, database, and application. Attackers know that AD frequently has misconfigurations, legacy settings, excessive privileges, and weak service account passwords that enable escalation from initial foothold to full domain control.

What are common Active Directory attack techniques?

Common techniques include Kerberoasting (cracking service account tickets), AS-REP Roasting (attacking accounts without pre-authentication), Pass-the-Hash (using stolen NTLM hashes), DCSync (replicating domain credentials), Golden and Silver Ticket attacks, NTLM relay, delegation abuse, ACL exploitation, and Group Policy manipulation.

How do you harden Active Directory?

Hardening includes implementing tiered administration model, enforcing strong service account passwords or gMSA, enabling Protected Users group for privileged accounts, configuring Kerberos armoring, removing unnecessary delegations, auditing ACLs for excessive permissions, implementing LAPS for local admin passwords, and enabling advanced audit logging.

What is the AD tiered administration model?

The tiered administration model segments AD administration into three tiers: Tier 0 (domain controllers and identity systems), Tier 1 (servers and applications), and Tier 2 (workstations and user devices). Privileged accounts are restricted to their tier, preventing lateral movement from a compromised workstation to domain controllers.

How do you monitor Active Directory for attacks?

Monitor for suspicious Kerberos ticket requests, DCSync replication attempts from non-DC sources, group membership changes for privileged groups, service account authentication anomalies, LDAP reconnaissance queries, unusual logon patterns, certificate template modifications, and Group Policy changes using Windows Event Forwarding and SIEM integration.

How does penetration testing evaluate AD security?

AD penetration testing attempts Kerberoasting, AS-REP Roasting, credential harvesting, token manipulation, delegation abuse, ACL exploitation, and privilege escalation paths from standard user to domain admin. Tools like BloodHound map attack paths, while manual testing validates exploitability of discovered weaknesses in the AD environment.

What is BloodHound in AD security?

BloodHound is an AD attack path analysis tool that maps relationships between users, groups, computers, and permissions to identify paths to domain admin. It uses graph theory to discover non-obvious privilege escalation chains that manual analysis would miss. Both attackers and defenders use it for offensive path discovery and defensive gap analysis.