Active Directory Fundamentals: AD, DC, GPO, Kerberos & More

What you will Learn ?

Active Directory Fundamentals Active Directory (AD), Domain Controller (DC) Forest, Cluster Organizational Unit (OU) Certificate Authority (CA) Groups Group Policy Object (GPO) Group Admin,Domain Admin

Kerberos Authentication Kerberos Authentication Overview Ticket Granting Ticket (TGT) KRBTGT Account Golden Ticket Attack, Silver Ticket Attack

Active Directory Domains Domain Trust, Parent Domain, Child Domain

1. AD (Active Directory)

What is it?

Active Directory is Microsoft's centralized system for managing:

• Users, Computers,Printers,Servers,Groups,Permissions

Think of it as a company's digital phonebook + identity management system.

Example

A company has:

• 500 employees
• 300 computers

Instead of creating accounts separately on each PC: User: ahad Pass:123

Administrator creates the account once in AD. Now ahad can log into any company computer.

2. DC (Domain Controller)

What is it?

A Domain Controller is a server that runs Active Directory. It stores: User accounts,Password hashes,Policies,Group information

Example When you login: Username: ahad Password: ********

Computer asks DC: "Is this password correct?" DC verifies and allows login.

The DC is basically the brain of the domain.

3. Forest

What is it?

Forest is the highest-level AD structure.

A forest contains: One or more domains, Shared schema, Shared configuration

Example

Company: Google.com May have: us.google.com, eu.google.com, asia.google.com All together form a forest.

4. Cluster

What is it?

Multiple servers working together as one system.

Purpose:

• High availability
• Load balancing
• Fault tolerance

Example

Suppose website server crashes. Cluster: Server1 Server2 Server3 If Server1 dies: Server2 continues … Users dont notice this.

5. OU (Organizational Unit)

What is it?

A container inside AD used to organize users and computers.

Example

Company has HR , IT ,FINANACE Depts. Each department can be an OU.

Why? You can apply different policies. Example: HR: USB Disabled IT:USB Enabled

6. CA (Certificate Authority)

What is it?

A server that issues digital certificates. Certificates prove identity like a digital passport.

Example

When visiting: https://google.com Your browser trusts Google because a CA signed Google's certificate.

In Company CA issues certificates for: Employees,Computers,Servers,VPNs

7. Groups

What are Groups?

Collections of users.

Instead of assigning permissions one by one.

Example

Create group: HR Team Add: Ali, Ahad, Sara Grant folder access to group. All members get access automatically.

8. GPO (Group Policy Object)

What is it?

Rules applied to users/computers.

Domain admins use GPO to control systems.

Examples

Disable Control Panel User cannot open Control Panel

9. Group Admin

Usually means administrator of a specific group.

Example:

IT Managers Group Group admin can manage members.

10. Domain Admin

Most powerful account in domain

Can:

• Create users
• Reset passwords
• Access computers
• Modify GPOs
• Control Domain Controllers

11. TGT (Ticket Granting Ticket)

Now we enter Kerberos authentication.

What is TGT?

A temporary ticket proving who you are.

After login:

Username Password Kerberos gives you a TGT.

12. KRBTGT

What is it?

Special AD account.

Kerberos uses it to create and sign TGTs.

Every domain has one.

Example

krbtgt Hidden system account.

Without it: Kerberos cannot function

Authentication Flow

User Login → Domain Controller → KRBTGT signs TGT → User receives TGT

13. Golden Ticket

What is it?

A forged Kerberos TGT.

Created if an attacker obtains: KRBTGT hash

Why dangerous?

Attacker can pretend to be:Why dangerous?

Attacker can pretend to be: Administrator ,Domain User,Any User

Real World

A fake passport accepted everywhere.

14. Silver Ticket

What is it?

Forged service ticket.

Attacker does NOT need KRBTGT.

Only needs service account credentials.

Main Difference between both Tickets

Golden Ticket: Entire Domain Silver Ticket: Specific Service

15. Domain Trust

What is it?

Relationship between domains.

Allows users in one domain to access another.

Example

Domain A : sales.com Domain B: finance.com Trust established → Now: sales.com user can access resources in: finance.com , if permissions allow

16. Child Domain

Sub-domain under parent.

Example

company.com Child → hr.company.com

17. Parent Domain

Main domain above child domains.

Example

company.com Parent domain.

Contains: hr.company.com, it.company.com

If you find this helpful , do follow and read other blogs as well. Thank You for your time !