Active Directory Security for Beginners: The 4 Essential Concepts

You land a shell on your first Active Directory lab, you probably type whoami and it says something like corp\jdoe. A normal user, and somewhere on this network is a Domain Admin account.

You see, most beginners would never get to it, and most likely would start looking up and trying attacks from the get go. The problem is that nobody explains how Active Directory actually works before they tell you how you're supposed to break it. Once you have the model, the attacks will become very intuitive and logical.

By the end of this post you'll understand the four ideas that make AD click, and you'll see exactly how a normal user like jdoe would end up as Domain Admin. If you would prefer a more structured read then I did pack up these concepts in a pdf, just download it here

What Active Directory is :

Active Directory (AD) is how most companies running Windows manage who can do what. It holds every user, every computer, every group and every rule in one central database.

It exists to answer one question, thousands of times a second: should this user be allowed to do this, on this machine, right now?

The servers that hold that database and answer that question are called domain controllers (DCs), t hey are the brain of the network. Take over a DC and you control every account in the domain, which is why nearly every AD attack is pretty much just a search for a path to one.

That's why AD matters so much in security. It is in the vast majority of corporate networks, it's also the first thing a ransomware crew or other malicious actor goes after, and it is a core topic on certifications and in red-team and blue-team interviews alike.

Why you're stuck

If AD feels too complex, it won't be once you understand:

1. How users and groups really grant access
2. How Group Policy pushes settings to thousands of machines at once
3. How Kerberos tickets replace passwords
4. How all of it connects into attack paths

1. Users and groups: and the implications of inheritance

A user is a set of credentials tied to a set of permissions, a group is a shortcut: instead of granting 50 people access to the finance share one by one, an admin grants the Finance group and drops 50 users into it.

An important mention here is that groups can be members of other groups.

For example : Alice is in Helpdesk. Helpdesk was added to Workstation Admins years ago, during some migration nobody remembers. Workstation Admins is local admin on every workstation in the company. So Alice is local admin on every workstation, and nothing on her account page says so.

It actually is a core idea behind some AD attacks:

• When you compromise an account, you inherit everything its groups can do, directly and through every nested group above them.
• "What can this account actually do?" is rarely visible from the account itself. The real answer is the sum of the whole chain.
• Attackers love this because big companies pile up years of nested groups that no one has audited.

2. Group Policy: change one object, control every machine

Group Policy Objects (GPOs) are bundles of settings: password rules, who is a local admin, which scripts run at startup.

An admin links a GPO to an Organizational Unit (OU), which is just a folder of computers or users inside the domain. Every machine in that OU picks up the settings on its own, by default about every 90 minutes, with nobody touching it.

That's great for you if you're a sysadmin, now look at it the way an attacker does:

• Whoever can edit a GPO controls every machine it applies to. Add a startup script to a GPO linked to the Servers OU and you have code running on every server.
• Edit rights on GPOs are often handed out loosely and then forgotten.
• Because the mechanism is invisible day to day, a GPO linked higher than it should be can sit unnoticed for years.

You won't need to attack a machine directly if you can edit the policy that configures it.

3. Kerberos: the ticket is the credential, not the password

That's the notion behind a lot of of AD's attacks.

When you log in on a domain machine, your password doesn't get sent around the network every time you open a file share. Instead, you prove who you are once and get a ticket. From then on, you show tickets.

The ticket office is the KDC (Key Distribution Center), which runs on every domain controller.

It works in two steps:

1. You prove you know your password and get a TGT (Ticket-Granting Ticket), a master pass that says "this person logged in."
2. When you want a specific service, say the file server FS01, you show your TGT and ask for a service ticket for FS01. You hand that to FS01, and FS01 lets you in without ever asking the DC.

Nown the thing is, a service ticket is encrypted with the service account's own password, and any logged-in domain user is allowed to ask for a service ticket for almost any service.

You probably see where this goes by now, an attacker requests a ticket for a service account, takes it offline, and tries to crack it to recover that account's password. It won't trigger alarms from failed logins or cause lockouts.

That attack is called Kerberoasting, and it works whenever a service account has a weak password, which is far more often than it should be.

The same logic powers the Golden Ticket: steal the key that signs every TGT, and you can forge a ticket for anyone.

As you can see, these attacks become pretty intuitive by now, in case you want this flow step by step alongside domains, OUs and trusts, with a clean diagram for each, then download "Active Directory, Explained" for free.

4. Attack paths: how does jdoe become Domain Admin?

Remember jdoe from the start? Here's how these fundamental concepts combine in his favor :

Every object in AD is a node: users, groups, computers, and every permission between them is an edge: "is a member of", "can reset the password of", "is admin on", you put them together and your domain is a graph. An attack path is just a route through that graph, from where you are to Domain Admins.

Read it hop by hop:

Ironically, every one of those edges was a reasonable decision on the day someone made it. Nobody designs a path to Domain Admin, it grows out of normal admin work, one permission at a time.

This is exactly what BloodHound does, as it collects every node and edge and finds these chains automatically. Attackers use it to find the shortest path in. Defenders use the same map to find the handful of edges that, once cut, break hundreds of paths at once.

Where to go from here

You now have the four main concepts that hold AD together, every attack you'll study like Kerberoasting, GPO abuse, ACL abuse, Golden Tickets, is one of these concepts turned against the domain.

As I said before, I summed them up pretty well in one guide, "Active Directory, Explained" covers the whole model in 7 pages with 7 diagrams: the core question, domains and OUs, nested groups, Group Policy, Kerberos, trusts and the attack graph. Download it here.

However if you want to be able to attack and defend it, Active Directory for Defenders and Breakers is the deep dive. Eight chapters cover the AD model in depth, identity and access, Kerberos up close, Kerberoasting and service accounts, Group Policy as an attack surface, trusts and lateral movement, BloodHound for both sides, and hardening. Every topic is taught twice over: how the weakness is abused, and how it is detected and shut down. It has 9 diagrams and a review quiz with answers after every chapter. Get Active Directory for Defenders and Breakers here.

Which part of AD confuses you most? Tell me in the comments, I'll read every one.

Originally published at https://payhip.com.