Active Directory (AD)
AD · AD DS · Active Directory Domain Services · domain controller · Microsoft directory · Entra ID
Microsoft’s directory service, which centralises the accounts, passwords and permissions of most corporate Windows networks: whoever controls it controls the whole network.
In practice
Active Directory authenticates users and machines (using the Kerberos and NTLM protocols), pushes group policies and decides who can access what. It is the top target for ransomware operators: once they are domain administrators, they can switch off defences and encrypt every machine overnight. The classic weaknesses are well known: service accounts with old passwords, administrators logging on to ordinary workstations, delegations inherited from old migrations. Entra ID (formerly Azure AD), its cloud counterpart, is often synchronised with it and needs the same level of care.
Fictional case: during an audit, a mid-sized company finds that 60 accounts belong to administrative groups, including a service account created in 2011 for a printer, whose password has never changed. After a clean-up and a tiered administration model, six remain.
How to protect yourself
- Keep membership of domain administration groups to the strict minimum.
- Tier your administration: a domain administrator never logs on to an office workstation.
- Give service accounts long passwords that are managed and rotated automatically.
- Check the directory regularly against the control points published by ANSSI.
