Active Directory: Domains, Users and Group Policies

Imagine managing 500 computers and 500 users one by one: creating accounts on each machine, changing a password everywhere, applying a security setting on every desk. No company does it that way. Instead, they use a directory service, and in the Windows world, that service is Active Directory. It is the centre of authentication and authorisation in most organisations, and therefore one of the most valuable targets for attackers and one of the most important things for defenders to understand.

The last lesson showed a single Windows machine. Now we step back to the network of machines, and see how an organisation ties them together.

What Active Directory is

Active Directory (AD) is a directory service from Microsoft: a central database that stores information about the objects of an organisation (users, computers, groups, printers, shared resources) and provides services to authenticate and authorise them. Its role is simple to state: when a person sits at any computer of the company and types their login, AD verifies who they are, and then decides what they may access.

More precisely, the part of AD you will work with is Active Directory Domain Services (AD DS). It relies on standard protocols: LDAP to query and modify the directory, Kerberos for authentication (with NTLM as an older fallback), and DNS to find services. This is why DNS, which you studied in chapter 1, is so critical in a Windows network: if DNS is broken, domain logins break.

The vocabulary of AD

• Domain: a logical group of objects that share the same directory database and security policies, for example corp.example.com (we use the reserved example name). A domain is the basic administrative boundary.
• Domain controller (DC): a server that hosts a copy of the directory and answers authentication requests. Organisations have several, for resilience. A DC is a crown jewel: whoever controls it controls the domain.
• Forest and tree: a forest is a collection of one or more domains that share a schema and a trust relationship; a tree is a set of domains sharing a namespace. For this course, think "one forest, one or two domains".
• Organisational unit (OU): a container within a domain used to organise objects, for example "Accounting", "Sales", "Workstations". OUs allow delegating administration and applying policies to a subset.
• Users, computers and groups: the main kinds of objects. A security group gathers users to whom you grant rights together.
• Trust: a relationship that lets users of one domain access resources of another.

An analogy: a domain is like a company building with a central reception desk. The domain controller is the reception: it keeps the list of all employees, issues badges and checks them. OUs are the floors and departments. Groups are job categories ("everyone in accounting may enter the archive room").

How a login works, in simple words

When a user logs in to a domain computer, the computer contacts a domain controller. With Kerberos, the DC verifies the credentials and issues a ticket that proves the user's identity for a limited time. The user then presents tickets to access services (a file server, a printer, an intranet) without typing the password again. This is how single sign-on works in a company. The details of the ticket system are covered in the advanced course of the track; for now, remember the idea: AD is a trusted third party that vouches for people and machines.

Group Policy (GPO)

Group Policy Objects (GPO) are collections of settings that AD applies automatically to users and computers. Linked to a domain or to an OU, a GPO can, for example:

• Enforce a password policy (minimum length, lockout after repeated failures).
• Configure the Windows firewall and the screen lock delay.
• Restrict which applications may run.
• Deploy software and map network drives.
• Define which events are audited and logged (see lesson 4).
• Disable risky features across the whole company in a single action.

Policies are processed in a precise order (local, then site, domain and OUs, with later ones normally overriding earlier ones), and computers refresh them regularly. This is the practical foundation of hardening at scale: one decision, applied to thousands of machines. It is also why compromising GPO management is so severe for a company: an attacker who can edit a policy can push changes everywhere.

On a domain-joined machine, gpresult /r shows which policies apply to the current user and computer, and gpupdate /force refreshes them.

Default and privileged groups

AD comes with built-in groups whose membership matters a great deal. The most powerful ones are Domain Admins (administrative control of the whole domain) and, at forest level, Enterprise Admins. Administrators of the directory should be kept few, used only for administration, and protected with strong authentication. A basic security principle is the tiering of accounts: the account that logs on to a regular workstation to read email must not be the same as the one that administers domain controllers, because credentials of a high-privilege account left on a lower-security machine can be stolen and reused.

Why AD is a prime target

Since AD authenticates everybody, an intruder who obtains control of it can reach nearly everything. That is why attackers spend effort to get from one compromised workstation to the domain controllers, moving step by step. Attackers do not need a "hack of AD" in the cinematic sense; they often exploit weak passwords, over-privileged accounts, forgotten services, old protocols and misconfigurations. Hence the importance of basic hygiene:

• Strong password policy and multi-factor authentication for administrators.
• Few privileged accounts, and review their membership regularly.
• Disable legacy protocols when possible.
• Keep domain controllers updated and strictly isolated: no web browsing, no email on them.
• Monitor changes to privileged groups and policies.
• Back up the directory and test the restoration.

Offensive and defensive aspects of AD are expanded in the last course of the track. Here, you only need the foundations.

Building a tiny AD in your lab (optional)

If your hardware allows it, you can create a miniature AD environment: a Windows Server evaluation VM promoted to a domain controller for a lab domain such as lab.local (a made-up name for your isolated network), and a Windows client VM joined to it. The steps, in outline: install the server, give it a static address (for example 10.10.10.31), install the Active Directory Domain Services role through Server Manager, promote the server to a domain controller by creating a new forest, then create a few OUs and users. On the client, point the DNS setting to the domain controller's address and join the domain. The vendor's documentation guides each step. Always snapshot before and after.

This lab is optional because it needs memory and disk space. If you cannot build it, study its structure on paper and with screenshots of vendor documentation; the concepts still apply.

Your turn: model an organisation

On paper or in your notebook, model the Active Directory of an imaginary company of 60 people with four departments: Management, Accounting, Sales and IT. Draw the domain corp.example.com, the OUs, two or three security groups, and decide: which people should be in a Domain Admins group? Which GPO would you apply to all computers, and which only to Accounting? Write at least three GPO settings, each with a short justification.

See a solution

A reasonable design: one domain with OUs named Management, Accounting, Sales, IT, and separate OUs for Workstations, Servers and Service accounts. Groups: "Accounting-Share-Read", "Accounting-Share-Modify" and "IT-Helpdesk". Domain Admins should contain only a very small number of dedicated administrator accounts, not the everyday accounts of the IT team: each administrator has a normal account and a separate privileged one. GPO for all computers: automatic screen lock after a short inactivity, the Windows firewall enabled, and a password and lockout policy; justification: basic hygiene and protection against guessing. GPO for Accounting only: restriction of removable storage devices and mapping of the accounting network share; justification: protect confidential financial data and reduce the leak path. The exact values depend on the company risk analysis, but every setting must be defensible.