Skip to content

Active Directory

The structure of Active Directory, how to enumerate it for administration, and how to recognize when that enumeration is an attacker rather than an admin.

Why It Matters

Active Directory is the backbone of most Windows environments: it holds the accounts, groups, policies, and trusts that control access to everything. Knowing its structure and the tools to query it is core sysadmin work, and knowing what enumeration looks like is where administration meets security.

Reference

Components

Component Description
Domain Controller Holds the AD DS data store, handles authentication and authorization
AD DS data store NTDS.dit (default %SystemRoot%\NTDS): all AD objects and domain password hashes
Forest Top-level container: one or more domain trees sharing schema and trusts
Domain Groups and manages objects
Organizational Unit (OU) Container for objects, where Group Policy applies
Trusts Allow access to resources in another domain (directional, transitive)
Objects Users, groups, computers, printers, shares

Authentication

Protocol Role
Kerberos Default AD authentication; ticket-granting tickets and service tickets
NTLM Legacy challenge/response authentication

On-Prem vs Entra ID (Azure AD)

Windows Server AD Entra ID
LDAP REST APIs
NTLM OAuth / SAML
Kerberos OpenID Connect
OU trees Flat structure
Domains and forests Tenants
Trusts Guests

Administration and Enumeration

MMC with RSAT

Install Remote Server Administration Tools (Settings -> Optional Features -> Add -> search "RSAT"), then add the Active Directory snap-ins in MMC to manage AD from a workstation. RSAT reference.

Command Prompt

net user              :: local users
net user /domain      :: domain users
net group /domain     :: domain groups
net accounts /domain  :: domain password policy

PowerShell (ActiveDirectory module)

Get-ADUser -Identity jdoe -Properties *
Get-ADGroup -Identity "Domain Admins"
Get-ADGroupMember -Identity "Domain Admins"
Get-ADDomain
Get-ADObject -Filter 'badPwdCount -gt 0'    # accounts with failed logons

Full ActiveDirectory cmdlet reference.

Enumeration Tools to Recognize

The same data attackers gather. Seeing these in an environment you administer is worth investigating:

How I Use It

For day-to-day administration I use RSAT and the ActiveDirectory module. The domain scripts in this toolkit automate the common reporting: lockouts, password policy, GPO and domain reports. The enumeration-detection angle is why I keep an eye on logon volume and tool signatures even on the admin side.

Watching for Abuse

Signal Why
Excessive logon events from one account PowerView and bulk enumeration generate many logons
SharpHound or RSAT tools on non-admin hosts Collection activity
Heavy command prompt and PowerShell use Scripted enumeration

Resources