# What Is Active Directory Security? Preventing Domain, Privilege and Identity Risks

**URL:** https://securesys.com.tr/en/learning/system-cloud-security/what-is-active-directory-security

![What Is Active Directory Security? Preventing Domain, Privilege and Identity Risks](/images/bilgi-merkezi/covers/cover-sistembulut-03.webp)

Active Directory sits at the centre of the identity and access infrastructure in many organisations.

Users.

Computers.

Servers.

Service accounts.

Groups.

Privileges.

Group Policy settings.

Authentication processes.

A significant part of all these structures is managed through **Active Directory (AD)**.

Active Directory security is therefore not merely a Windows topic.

When an attacker obtains sufficient privileges in AD they can gain access to;

critical servers,

file shares,

applications,

databases,

backup systems,

cloud integrations.

All from one place.

In modern corporate security, therefore, concepts such as **Active Directory security, AD hardening, identity security, privileged access management, attack path analysis, Kerberos security, NTLM security, LAPS, gMSA and tiering** must be handled together.

The basic truth is this:

**If Active Directory is compromised, many of the organisation's security controls can become ineffective at once.**

AD security therefore consists of far more than protecting Domain Admin accounts.

The real objective is;

**to keep identities, privileges, trust relationships and attack paths systematically under control.**

#### What Is Active Directory?

**Active Directory Domain Services (AD DS)** is the directory service allowing users, computers, groups and other identity objects to be managed centrally in Microsoft-based corporate environments.

Through Active Directory;

user accounts can be created,

groups can be managed,

computers can be joined to the domain,

Group Policy can be applied,

access privileges can be controlled centrally.

This central structure brings great convenience.

But it also creates central risk.

If an attacker obtains high privileges in the identity infrastructure they can affect a great many systems from a single point.

### What Is Active Directory Security?

**Active Directory security** means protecting the identity, privilege, authentication, trust relationship and management processes in the AD environment against attack.

AD security assesses many areas such as;

- Domain Admin accounts,
- privileged group memberships,
- service accounts,
- Kerberos,
- NTLM,
- Group Policy,
- delegation,
- ACLs,
- local admin privileges,
- password policy,
- logging,
- monitoring.

All of them together.

The aim is not only to block the attack but to reduce the attacker's capacity to progress through the identity infrastructure.

### Why Is the Domain Controller Critical?

The **domain controller (DC)** is one of the fundamental components of Active Directory.

It plays a central role in authentication and directory services.

A domain controller can hold critical data such as;

user accounts,

group memberships,

password hashes,

Kerberos-related information,

Group Policy links.

Compromising a domain controller is therefore one of the highest-impact security incidents possible.

### What Is a Domain Admin?

**Domain Admins** is the privileged group holding very broad rights over an Active Directory domain.

If a Domain Admin account or a user in that group is compromised, the attacker can;

reach servers,

change privileges,

edit GPOs,

modify user accounts,

create new privileged accounts.

Domain Admin membership must therefore be kept extremely limited.

### How Many Domain Admins Should There Be?

There is no single universal number.

But the principle is:

**The minimum number needed.**

Twenty-five people being Domain Admins in a 200-person IT team is a serious privilege risk.

Privileged group memberships must be assessed against;

job role,

operational need,

emergency requirements.

Temporary privilege models can be preferred over permanent Domain Admin membership.

### What Is Standing Privilege?

**Standing privilege** is a user holding high privileges continuously even when they do not need them.

This is valuable to an attacker.

Because compromising the privileged account gives them high privilege directly.

The modern approach is therefore:

#### Reducing standing privilege

and

#### Using just-in-time access

instead.

### What Is Just-in-Time Privilege?

**Just-in-time (JIT) privilege** means the user holds high privileges only for the period they need them.

An administrator;

takes Domain Admin rights for 30 minutes for a maintenance task.

The privilege is removed automatically when the period ends.

This approach reduces the period of privileged credential exposure.

### What Is Active Directory Hardening?

**AD hardening** is the tightening of the Active Directory environment against security baselines.

This work can include steps such as;

reducing the number of privileged accounts,

restricting legacy authentication methods,

making Group Policies secure,

reducing service account privileges,

strengthening logging,

removing unnecessary trust structures.

AD hardening is not a one-off project but a continuous process.

### Why Does Identity Security Matter So Much?

In traditional security the perimeter concept was dominant.

If a user was on the company network they could be considered trustworthy.

In the modern structure the user can use the same identity through;

VPN,

Microsoft 365,

the cloud,

SaaS,

remote working.

Identity is therefore now one of the attacker's main targets.

**Identity security** sits at the centre of the modern attack chain.

### What Is Credential Theft?

**Credential theft** is the capture of usernames, passwords, hashes, tokens or authentication information.

Obtaining a credential is often easier for an attacker than developing a new exploit.

When a valid account is used, the attack traffic resembles a legitimate user.

**Valid accounts** is therefore one of the most critical techniques in modern attacks.

### What Is Password Spraying?

**Password spraying** is the approach of trying a small number of common passwords against a large number of user accounts.

Rather than trying hundreds of passwords against one account;

a few passwords are tried against 100 users.

The aim is to find a valid credential without triggering the account lockout mechanism.

The SOC must therefore not look only at the failed login count on a single account.

The same password pattern being tried across many users must also be monitored.

### The Difference Between Brute Force and Password Spraying

#### Brute Force

Many passwords are tried against one account.

#### Password Spraying

A few passwords are tried against many accounts.

The log behaviour of the two attacks differs.

Detection use cases must therefore be designed separately.

### Can Credential Stuffing Affect Active Directory?

Yes.

Combinations of;

email,

username,

password

obtained from other data breaches can be tried against corporate accounts.

The risk rises particularly where users use the same password on personal and corporate accounts.

MFA reduces that risk but is not the only identity security control.

### What Is Kerberos?

**Kerberos** is one of the core authentication protocols in an Active Directory environment.

Users and services verify one another through a ticket mechanism.

Kerberos provides a secure and robust structure.

But misconfigurations or credential weaknesses can be abused by attackers.

Kerberos-related security risks are therefore an important part of AD hardening.

### What Is Kerberoasting?

**Kerberoasting** is the attack technique describing the abuse of Kerberos service tickets belonging to particular service accounts for offline password cracking.

The risk rises particularly with service accounts that;

use weak passwords,

have not changed their password for a long time,

hold high privileges.

Service account security is therefore critically important.

Defensively, controls such as;

strong and long passwords,

gMSA,

minimum privilege,

service account monitoring

can be applied.

### What Is AS-REP Roasting?

Some Active Directory users have Kerberos pre-authentication switched off.

This misconfiguration lays the ground for particular attack techniques.

User attributes must therefore be reviewed regularly.

Disabling pre-authentication is not recommended unless genuinely necessary.

### What Is NTLM?

**NTLM** is one of the older authentication protocols used in Microsoft environments.

Although Kerberos is preferred in modern Active Directory environments, NTLM still exists because of legacy applications.

NTLM use creates risk in relation to certain attack techniques.

Organisations must therefore discover and reduce NTLM use as far as possible.

### Why Is NTLM Risky?

NTLM can be associated with attack scenarios such as;

relay,

credential capture,

legacy authentication.

But switching it off directly affects legacy applications.

The approach should therefore generally be:

**Discover → monitor → reduce → disable**

in that order.

Which systems use NTLM must be identified first.

### What Is NTLM Relay?

**NTLM relay** is the attack technique in which the attacker forwards a captured authentication attempt to another service to gain unauthorised access.

Defensively, controls such as;

SMB signing,

LDAP signing,

channel binding,

NTLM reduction

can be assessed.

Protocol hardening of this kind is an important part of Active Directory security.

### What Is Pass-the-Hash?

**Pass-the-hash** is the technique in which the attacker attempts authentication using the password hash without knowing the user's plaintext password.

This attack is especially dangerous in environments where the same privileged credential is used across multiple systems.

For that reason;

LAPS,

unique local admin passwords,

credential hygiene,

privileged tiering

gain importance.

### What Is Pass-the-Ticket?

**Pass-the-ticket** is the attack approach associated with capturing and reusing Kerberos ticket information.

Credential security therefore does not mean protecting the password alone.

Authentication material held in memory must be protected too.

EDR and credential protection controls matter at this point.

### What Is a Golden Ticket?

Golden ticket is one of the high-impact attack scenarios abusing the domain's Kerberos ticket mechanism.

An attack at that level generally indicates very serious compromise of the domain.

The critical defensive point is preventing the attacker reaching that level at all.

In other words;

domain controller security,

privileged credential protection,

monitoring

matter enormously.

### What Is DCSync?

DCSync is the attack technique in which the attacker abuses particular directory replication privileges to behave like a domain controller.

Not only Domain Admin membership but the special replication privileges inside AD must therefore be monitored.

Excessively broad ACLs and delegations increase risks of this kind.

### What Is an ACL in Active Directory?

An **access control list (ACL)** determines which user or group can perform which operations on an AD object.

A user may hold the right to;

reset another account's password,

add members to a group,

modify a GPO.

That user may not be a Domain Admin.

But through the ACL they hold they can progress to high privileges.

Active Directory security therefore cannot be assessed by looking at group memberships alone.

### What Is an Active Directory Attack Path?

An **attack path** is the possible attack route from a low-privileged user or system to critical privileges.

For example:

normal user

↓

local admin on server A

↓

credential exposure

↓

service account

↓

privileged group

↓

Domain Admin

No single finding in this chain looks “critical”.

But together they can give the attacker control of the domain.

**Attack path analysis** is therefore one of the most valuable analysis methods in modern AD security.

### What Is BloodHound?

BloodHound is one of the widely used tools for analysing the attack paths between users, groups, computers and permission relationships in an Active Directory environment.

Blue teams and security assessment teams can visualise risks such as;

unnecessary privileged relationships,

local admin paths,

ACL relationships,

delegation.

What matters is not using the tool but actually fixing the privilege chains it finds.

### Can the Domain Be Compromised Without Domain Admin?

The attacker does not have to start as a Domain Admin.

A low-privileged user can progress to higher privileges through routes such as;

faulty delegation,

local admin rights,

service accounts,

ACLs,

credential exposure.

Saying only:

**“Our Domain Admin account is very well protected.”**

is therefore not enough.

The whole privilege graph must be examined.

### How Do Local Administrator Rights Affect AD Security?

If a user is a local admin on many workstations or servers, an attacker compromising that account gains broad freedom of movement.

The attacker can carry out;

credential dumping,

remote execution,

lateral movement.

Local admin rights must therefore be managed centrally and kept to a minimum.

### Why Does LAPS Matter in Active Directory Security?

**Windows LAPS** helps manage local administrator passwords uniquely and automatically per device.

Using the same local admin password on hundreds of devices is a serious lateral movement risk.

With LAPS each device can use a different credential.

That makes it harder for the attacker to use a local admin password obtained from one device on the others.

**What Is gMSA?**

A **group managed service account (gMSA)** is the account model helping automate password management for Windows services.

With classic service accounts the password;

can be created manually,

may go unchanged for years,

may be known to several people.

With gMSA the password management can be automated.

That helps reduce Kerberoasting and service account credential risks in particular.

### Why Are Service Accounts So Critical?

Service accounts are usually;

highly privileged,

long-lived,

non-interactive,

rarely password-changed

accounts.

They are therefore valuable targets for attackers.

A service account inventory must be maintained and every account must have a clear owner.

### What Should a Service Account Inventory Look Like?

The organisation must be able to answer these questions:

Which application is this account for?

Who owns it?

Which servers is it used on?

Which groups is it a member of?

When did the password change?

Is interactive login required?

Is it still active?

Without that visibility, service account security cannot be managed.

### Why Is Group Policy (GPO) Critical?

A **group policy object (GPO)** can be used to apply central settings to a large number of computers and users in the domain.

That is a major management advantage.

But if the attacker obtains GPO modification rights they can affect a great many systems.

Settings for;

security policy,

scripts,

firewall,

local groups

can be changed.

GPO management rights must therefore be kept limited.

### Should GPO Changes Be Monitored by the SOC?

Absolutely.

In particular;

creating a new GPO,

modifying an existing GPO,

changing a GPO link,

editing a privileged GPO

are high-value security events.

These changes can be monitored in the SIEM.

### What Is Delegation?

Certain administrative tasks in Active Directory can be delegated to users who are not Domain Admins.

The help desk can;

reset user passwords, for instance.

That is normal.

But if delegation is granted too broadly, a privilege escalation route forms.

Delegated permissions must therefore be reviewed regularly.

### What Is Unconstrained Delegation?

Some older or broad configurations of the Kerberos delegation mechanisms create high security risk.

Models such as **unconstrained delegation** in particular must be reduced as far as possible.

Modern, more restricted delegation approaches must be preferred.

### What Is RBCD?

**Resource-based constrained delegation (RBCD)** is the delegation model controlling which identities particular services can authenticate on behalf of.

Used correctly it meets legitimate management needs.

But with faulty ACLs or computer object rights it can become part of an attack path.

Delegation must therefore be analysed relationship by relationship, not merely as “is the feature on?”.

### What Is the Tiering Model?

**Administrative tiering** is the approach of separating privileged accounts and systems into different trust levels.

Levels such as;

tier 0,

tier 1,

tier 2

can be considered.

The aim is to prevent the most critical credentials being used on lower-security devices.

### What Is Tier 0?

Tier 0 contains the most critical identity and control plane systems.

For example;

domain controllers,

AD management accounts,

critical identity services

can be assessed at this level.

A tier 0 account must not be used on a normal user laptop.

Because if the laptop is compromised, the tier 0 credential is at risk.

### What Is a Privileged Access Workstation?

A **privileged access workstation (PAW)** is a high-security management device used for administrator operations.

The aim is to prevent critical accounts such as Domain Admin being used on the computers used for;

email,

web browsing,

daily office work.

The risk of privileged credential exposure is thereby reduced.

### Why Should an Admin User Not Read Email?

If a Domain Admin account is used for daily work it becomes exposed to threats such as;

phishing,

browser exploits,

malicious attachments.

A person can therefore use two accounts:

a normal user account.

A privileged admin account.

Daily work is done with the normal account and critical administration with the separate privileged account.

### How Is MFA Used for Active Directory?

Applying MFA in classic on-premise AD authentication flows is not as direct as in cloud environments.

But strong MFA can be applied at layers such as;

VPN,

PAM,

bastion,

privileged access gateway,

smart cards,

certificate-based authentication.

In hybrid identity structures, Entra ID and conditional access also play an important role.

### Smart Card and Certificate-Based Authentication

Certificate or smart card-based methods can be used instead of password-based authentication.

This approach provides security closer to phishing-resistant authentication.

It can be considered for privileged users in particular.

But the security of the PKI infrastructure itself then becomes critical.

### Why Do Active Directory Certificate Services (AD CS) Matter?

**AD CS** provides certificate infrastructure within the organisation.

Faulty certificate templates or enrolment permissions lead to privilege escalation risks.

AD CS must therefore also be part of the Active Directory security assessment.

Looking only at domain controllers and user accounts is not enough.

### What Should the Password Policy Look Like?

Modern password security consists of more than the approach:

“Change your password every 90 days.”

The more important topics are;

long, strong passwords,

breached password checking,

preventing password reuse,

MFA,

privileged credential management.

Different policies may also be needed for service accounts and normal users.

### How Should the Account Lockout Policy Be Designed?

Too low a lockout threshold lets an attacker create a denial of service by locking user accounts.

Too high a threshold makes brute force attacks easier.

A balance is therefore required.

Password spraying detection and the account lockout policy must be considered together.

### What Is Fine-Grained Password Policy?

Different password policies can be applied to different user groups in an Active Directory environment.

Privileged users can have stronger requirements, for example.

This structure can be managed through **fine-grained password policies**.

But the balance between user experience and security must be struck correctly.

### Should Disabled Accounts Be Deleted?

Old user accounts can remain disabled for long periods.

Although these accounts cannot log in directly, they carry the risk of faulty group memberships or being re-enabled.

The lifecycle of old accounts must be clearly defined in joiner-mover-leaver processes.

### What Is Joiner-Mover-Leaver?

#### Joiner

A new employee.

#### Mover

An employee changing role.

#### Leaver

An employee leaving the organisation.

Identity lifecycle processes must manage user privileges correctly in all three situations.

When an employee changes department, their old privileged access must be removed.

Otherwise privilege creep forms.

### What Is a Dormant Account?

Accounts unused for long periods can be considered **dormant accounts**.

These accounts are attractive to attackers.

Because with no normal user activity, abuse is harder to notice.

Dormant accounts must be reviewed periodically and closed if no longer needed.

### Why Are Shared Accounts Risky?

Several people using the same account reduces accountability.

If everyone uses the:

admin

account, it becomes impossible to tell who performed which action.

A model of personal accounts plus the necessary privileged escalation must therefore be preferred.

### What Should Active Directory Logging Cover?

These events are particularly valuable:

successful and failed logins,

privileged group changes,

user creation,

password resets,

GPO changes,

account enable/disable,

computer account changes,

Kerberos events,

directory service changes.

This data must be forwarded to a central SIEM.

### How Should Adding a User to the Domain Admin Group Be Monitored?

This is an extremely critical event.

Under normal conditions it should happen rarely.

The SOC can verify;

who added them,

from which system it was done,

whether there is a change record,

why the user was added.

An unexpected privileged group change must be a high-priority alert.

### Is Event ID-Based Detection Enough?

Windows event IDs are valuable for security monitoring.

But a single event ID usually does not provide enough context.

A user was added to a group, for instance.

Was that change made;

by whom,

from which endpoint,

at what hour,

for which user?

SIEM correlation must provide that context.

### How Is ITDR Used in Active Directory?

**Identity threat detection and response (ITDR)** aims to detect attacker behaviour in identity infrastructure.

On the AD side, behaviour such as;

credential abuse,

privilege escalation,

unusual group changes,

lateral movement,

authentication anomalies

can be monitored.

ITDR has become steadily more important as identity has moved to the centre of modern attacks.

### How Do EDR and Active Directory Security Come Together?

EDR monitors endpoint and server behaviour.

AD logs show identity events.

For example:

EDR → LSASS access.

SIEM → a new server login by the same user.

AD → a privileged group change.

When these three signals combine, a far stronger attack story emerges.

EDR, ITDR and SIEM must therefore be assessed together.

### How Does Lateral Movement Happen in Active Directory?

The attacker uses the credential they obtained to try to reach other systems.

They can use;

RDP,

SMB,

WinRM,

remote management.

These movements relate directly to the AD identity structure.

If a user is an admin on more systems than they need, lateral movement becomes easier.

### Does Network Segmentation Protect AD?

Yes.

Access to domain controllers and management systems in particular must be possible only from the necessary networks.

A normal user workstation does not need direct access to critical management interfaces.

Network segmentation is an important layer supporting identity security.

### Should a Domain Controller Have Internet Access?

Direct, unlimited internet access is generally unnecessary.

Necessary update or service access can be provided through a controlled proxy or allowlist.

Egress filtering makes it harder for an attacker to establish external communication if the domain controller is compromised.

### Why Is Browsing the Internet on a Domain Controller Risky?

A domain controller must not be used for anything other than management.

Operations such as;

web browsing,

email,

general office applications

increase the attack surface.

A DC must run as minimally as possible and focus only on domain services.

### Should EDR Be Installed on a Domain Controller?

Suitable, supported EDR solutions can be used on a domain controller.

But performance, compatibility and vendor best practice must be taken into account.

Because a DC is a critical system, the EDR policy must be planned carefully.

But leaving the DC outside security visibility also creates serious risk.

### Domain Controller Backup Security

Domain controller backups matter for AD recovery.

But the backup contains sensitive directory data.

The backup can therefore be;

encrypted,

access-controlled,

offline or immutable.

Restore procedures must also be tested regularly.

### What Is an Active Directory Recovery Plan?

When serious compromise occurs across the domain, restoring a single server may not be enough.

The organisation must have an **AD disaster recovery** and, if needed, a **forest recovery** plan.

That plan must include processes such as;

trusted backup,

recovery order,

a clean environment,

credential reset.

### Why Does Ransomware Target Active Directory?

Ransomware operators try to reach the identity infrastructure to achieve broad distribution.

Domain-level privileges provide;

access to many systems,

the ability to change security controls,

the ability to target backups.

AD security is therefore also an important part of ransomware resilience.

### Should AD and the Backup Environment Be Separated?

It is worth considering that critical backup infrastructure should not depend solely on domain credentials.

If an attacker who becomes Domain Admin can also fully manage the backup system, recovery risk increases.

A separate credential plane and separation of duties can therefore matter.

### What Is an Active Directory Security Assessment?

An **Active Directory security assessment** is the systematic evaluation of the risks in the AD environment across;

identity,

privilege,

authentication,

delegation,

GPO,

trust,

logging,

attack paths.

This work is not merely a vulnerability scan.

Because most Active Directory risks are configuration and relationship-based.

### How Is an AD Security Assessment Carried Out?

A professional assessment can generally cover these areas:

#### \1. Domain Architecture

The forest and domain structure.

#### \2. Privileged Groups

Highly privileged users.

#### \3. Service Accounts

Service identities.

#### \4. Authentication

Kerberos, NTLM and password policies.

#### \5. Delegation

Delegated rights.

#### \6. ACL Analysis

Directory permissions.

#### \7. GPO Review

Group Policy security.

#### \8. Attack Path Analysis

Privilege chains.

#### \9. Logging & Monitoring

SOC visibility.

#### \10. Recovery

AD backup and disaster recovery.

This approach provides a far more realistic risk picture.

### The Difference Between an AD Pentest and an AD Security Assessment

#### AD Pentest

Tests how far an attacker can progress using active attack techniques.

#### AD Security Assessment

Examines configuration, privilege and architecture risks more broadly.

Used together they give a far stronger result.

The assessment answers:

**“Where is the risk?”**

The pentest answers:

**“Can this risk genuinely be exploited?”**

### Why Is AD Attack Path Analysis as Important as a Pentest?

Attack path analysis shows the privilege chains an attacker has not yet exploited but could use in theory.

Risk can thereby be reduced before a real attack happens.

A five-step path from a normal user to Domain Admin may exist, for instance.

Breaking just one of those steps can eliminate the whole attack path.

That is a highly efficient risk reduction method.

### What Is a Choke Point?

A **choke point** is the critical privilege or system through which many attack routes pass.

A single service account may sit on dozens of attack paths.

Fixing that account's privileges can close many attack routes at once.

This is where the strategic value of attack path analysis appears.

### What Is a Tier Zero Attack Path?

All privilege routes reaching tier 0 systems must be considered especially critical.

If a route such as;

normal user → server local admin → service account → Domain Admin

exists, tier 0 isolation is weak.

The goal is to restrict every route to tier 0 as far as possible.

### What Does a Red Team Test in Active Directory Security?

A red team or authorised AD security test can assess areas such as;

credential exposure,

privilege escalation,

Kerberos abuse,

NTLM risks,

lateral movement,

attack paths

in a controlled way.

The aim is not to bring the domain down:

**It is to measure the routes by which a real attacker could reach critical privileges.**

### How Is a Purple Team Used in AD Security?

The red team simulates a particular identity attack behaviour.

The blue team tries to detect it through EDR, SIEM or ITDR.

Techniques such as;

password spraying,

Kerberoasting,

privileged group manipulation

can be tested in a controlled way.

Detection gaps are then closed together.

This approach raises the identity detection level.

### Which KPIs Can Be Used for Active Directory?

Example security metrics:

#### Domain Admin Count

#### Privileged Account Count

#### Dormant Account Count

#### Service Account Password Age

#### LAPS Coverage

#### NTLM Usage Rate

#### MFA/PAM Coverage

#### Critical Attack Path Count

#### Tier 0 Exposure

#### Logging Coverage

These metrics allow AD security posture to be measured over time.

### How Should Critical Attack Path Count Be Interpreted?

The number alone is not enough.

There may be 10 critical attack paths.

But if they all depend on a single faulty privilege, the fix is easy.

Another environment may have 3 attack paths with entirely different root causes.

Attack paths must therefore be assessed against;

impact,

exploitability,

choke points.

### Can an Active Directory Security Score Be Built?

Yes.

The areas of;

identity hygiene,

privileged access,

authentication security,

attack path exposure,

monitoring,

recovery

can each be scored separately.

But a single score must never replace the technical findings.

It can still be useful for management visibility.

### What Should an Active Directory Report Contain?

A professional report can contain these areas:

#### Executive Summary

The risk summary for management.

#### AD Architecture

The forest/domain structure.

#### Privileged Access Review

Highly privileged accounts.

#### Authentication Risks

Kerberos, NTLM and password security.

#### Service Account Risks

Service accounts.

#### GPO & ACL Findings

Permission and policy problems.

#### Attack Path Map

Critical privilege routes.

#### Detection Coverage

SOC and SIEM visibility.

#### Recovery Readiness

Backup and AD recovery status.

#### Remediation Roadmap

Priority improvements.

This structure connects technical findings directly to corporate identity risk.

### What Is the Biggest Mistake in Active Directory Security?

One of the biggest mistakes is the approach:

**“Our Domain Admin password is strong, so AD is secure.”**

A real attacker does not have to attack the Domain Admin account directly.

A service account.

A faulty ACL.

Broad local admin rights.

Legacy NTLM use.

Weak delegation.

GPO rights.

Any one of these can be part of the privilege escalation chain.

In AD security the focus must therefore be not a single account but **the entire identity and privilege graph**.

### Core Controls for Active Directory Security

The following approach can be considered at corporate level:

#### Privileged Account Reduction

Reduce unnecessary admin memberships.

#### LAPS

Manage local administrator passwords uniquely.

**gMSA**

Improve service account credential management.

#### PAM / JIT

Reduce standing privileged access.

#### Tiering / PAW

Isolate critical management accounts.

#### Kerberos & NTLM Hardening

Reduce legacy authentication risks.

#### Attack Path Analysis

See the privilege chains.

#### SIEM / ITDR

Monitor identity attacks.

#### Network Segmentation

Restrict domain controller access.

#### AD Recovery

Build a post-compromise recovery plan.

Used together these controls significantly reduce the AD attack surface.

### The Relationship Between Active Directory and Microsoft Entra ID

A significant proportion of modern organisations no longer use only on-premise Active Directory.

Cloud services such as;

Microsoft 365,

Azure,

Entra ID

have become part of the identity infrastructure too.

Some users access;

a Windows device,

Microsoft 365,

Teams,

SharePoint,

an Azure application

with the same identity.

AD security is therefore no longer limited to the on-premise environment.

**Hybrid identity security** is becoming increasingly critical.

### What Are the Hybrid Identity Risks?

There are relationships between on-premise and cloud identity for;

synchronisation,

federation,

authentication,

administrative roles.

Compromise on one side affects the other.

A highly privileged cloud account or the synchronisation infrastructure can be a critical target for the attacker.

Active Directory and Entra ID must therefore be assessed together.

### Conclusion: Active Directory Security Is About Protecting the Identity Graph

Active Directory is not a user database.

It is the centre of the corporate privilege architecture.

Which system can a user reach?

Which server can which administrator manage?

Which resource can which service account reach?

Which devices can which GPO affect?

Which ACL permits modifying another account?

All of these questions are part of Active Directory security.

A strong AD security approach therefore:

#### Password Policy

is where it starts, not where it ends.

Real security is formed by applying the layers of;

**identity hygiene + least privilege + PAM + LAPS + gMSA + tiering + Kerberos/NTLM hardening + attack path analysis + ITDR + SIEM + recovery**

together.

And the most important question is this:

#### When a normal user account is compromised, through which routes can the attacker reach critical privileges?

Organisations that can answer that question have begun genuinely managing Active Directory risk.

But today's corporate identity infrastructure no longer consists of Active Directory alone.

Microsoft 365 and Microsoft Entra ID bring the layers of;

email,

Teams,

SharePoint,

OneDrive,

cloud applications,

identity

together under the same ecosystem.

And that creates an extremely valuable new target area for attackers.