Post cover image
The directory service behind nearly every corporate network — and one of the richest attack surfaces in VAPT

October 23, 2026

Introduction to Active Directory: What Every Pentester Needs to Know First

Walk into almost any internal penetration test and you’ll find the same thing running the show: Active Directory. It’s the system deciding…

By Vipin_M

4 min read

Walk into almost any internal penetration test and you'll find the same thing running the show: Active Directory. It's the system deciding who can log into what, which files someone can open, and which servers trust which users.

That also makes it one of the single richest attack surfaces in offensive security. This post covers the foundation — what AD actually is, its core components, how authentication works, and the recon steps that kick off almost every internal engagement.

Tools referenced: nslookup, Nmap, ldapsearch, net commands, Impacket, BloodHound — all common on Kali Linux

None

Why Active Directory Matters So Much in VAPT

Roughly the majority of enterprise networks worldwide run on Windows infrastructure, and Active Directory is the backbone that manages it. Compromise AD, and you typically don't just own one machine — you own the identity system behind an entire organization.

  • Internal pentests very often start with "no credentials" and end with Domain Admin — AD is usually the path.
  • A huge share of real-world breaches (ransomware especially) pivot through AD misconfigurations.
  • Understanding AD's trust model is what lets you predict where it can be abused, not just run tools blindly.

1. What Active Directory Actually Is

Active Directory (AD) is Microsoft's directory service — a centralized database of users, computers, groups, and policies for a Windows network. Instead of every machine managing its own local accounts, AD lets an organization manage identity and access from one place.

Without AD:   Each computer has its own local users and passwords
With AD:      One central directory — log into any domain machine
              with the same username and password

Why it matters: that same centralization is exactly what makes AD such a high-value target. One compromised set of domain credentials can potentially unlock access across the entire network, not just a single machine.

2. Core AD Components

Domain              A logical group of objects (users, computers, groups)
                     sharing one directory database — e.g. corp.local
Domain Controller    (DC) The server running AD, holding the directory
                     database and handling authentication
Forest                The top-level container — one or more domains
                     sharing a common schema and trust
Organizational Unit    (OU) A folder-like container used to organize
                     objects and apply Group Policy
Group Policy Object      (GPO) Centrally-defined settings pushed to
                     users/computers — passwords, software, restrictions
Schema                    Defines what kinds of objects and attributes
                     can exist in the directory

Every user, computer, and group in a domain is an "object" in this directory — and every object has attributes (like group membership) that define what it can do.

3. Finding Domain Controllers

Domain Controllers advertise themselves via DNS SRV records — this is usually the very first recon step once you have network access, as shown in the terminal above. Once you know a DC's IP, a quick port scan confirms it and reveals which AD-related services are exposed.

None

4. How AD Authentication Works (High Level)

AD primarily uses "Kerberos" for authentication — a ticket-based system, not a simple password check on every request.

1. User requests a Ticket Granting Ticket (TGT) from the DC, using their password
2. DC verifies and issues a TGT (encrypted, time-limited)
3. User presents the TGT to request a Service Ticket (TGS) for a specific resource
4. The service trusts the TGS without re-checking the user's password

Why it matters: this ticket model is the foundation behind some of the most well-known AD attacks — Kerberoasting, AS-REP Roasting, and Golden/Silver Ticket attacks all abuse specific steps in this exact flow.

Older networks may still have NTLM authentication enabled alongside Kerberos — a weaker, hash-based protocol that's a frequent target for relay attacks.

5. LDAP: Querying the Directory

LDAP (Lightweight Directory Access Protocol) is how clients and tools actually query AD's database — listing users, groups, computers, and their attributes.

None

6. Basic Enumeration Once You Have Credentials

With any valid domain credentials — even a low-privilege user — a huge amount of the directory becomes visible by design (AD is meant to be readable by authenticated users).

None

7. Kerberoasting: A Classic AD Attack, Briefly

Any domain user can request a service ticket for any service with a registered Service Principal Name (SPN) — and that ticket is encrypted with the service account's own password hash. If that account has a weak password, the ticket can be cracked offline.

None

8. Mapping Attack Paths with BloodHound

Modern AD environments are usually too complex to manually trace every trust relationship and permission. BloodHound ingests AD data and builds a graph of every user, group, computer, and permission — then shows the shortest path from "where you are" to Domain Admin.

None

9. Common AD Misconfigurations Worth Knowing

Weak service account passwords   Kerberoastable, often never rotated
Excessive group nesting          Users end up in privileged groups unintentionally
Unconstrained delegation          A compromised server can impersonate any user
AdminCount=1 stale accounts        Old admin accounts that kept inherited rights
Password in description field        Literally written in a user object's notes
Overly permissive ACLs                GenericAll/WriteDACL rights users shouldn't have

Each one of these is a known, repeatable finding — not an exotic edge case — which is why AD assessments tend to turn up real findings quickly once you know where to look.

10. A First Enumeration Flow, Put Together

Once the concepts above click, a real (lab-based) starting sequence against a domain looks like this:

nslookup -type=SRV _ldap._tcp.corp.local        # find the DC
nmap -p 88,389,445,464,636,3268 <dc-ip>            # confirm it
ldapsearch -x -H ldap://<dc-ip> -s base namingcontexts   # check anon bind
net user /domain                                      # enumerate users (with creds)
GetUserSPNs.py domain/user -request                     # check for kerberoastable accounts
bloodhound-python -u user -p pass -d domain -c All        # map the full attack surface

Host discovery → service confirmation → directory enumeration → credential-based attacks → full attack-path mapping. Every step builds on the last.