Active Directory
Microsoft's directory for domain authentication and authorisation. Own the directory and you usually own the estate.
Active Directory (AD) is the identity plane for most Windows estates: users, computers, groups, and the policies that bind them. Domain Controllers hold the database. Kerberos and NTLM are how clients prove who they are. Apps that trust the domain inherit that trust.
Compromise of AD is high impact because one set of credentials can unlock mail, files, and often the hybrid path into Entra ID. The usual path is not a single exploit. It is enumeration, a weak service account or certificate template, and privilege that was standing when it should have been just-in-time.
Hardening starts with Tier 0: Domain Admins, KRBTGT, AD CS, backup admins, and Entra Connect stay off lower-tier hosts. Then kill the common ticket and certificate abuse paths. See the CyberStack guide Active Directory compromise and ASD's joint paper with CISA and the Five Eyes partners.
See also:
Fact source: ASD's ACSC — Detecting and mitigating Active Directory compromises (Sep 2026).