Course Preview

Active Directory Security

Active Directory security focuses on protecting Microsoft's directory service from credential theft, privilege escalation, and domain compromise. It covers attack paths adversaries use to move from a single compromised workstation to full control of the domain, and the defenses that stop them.

itWindows and Microsoft infrastructure | OpenSkills.info

Course pathWalk it in order

Look it upDip in anytime

Go furtherLeaves this page

Don't Panic — Active Directory Security

Active Directory Domain Services is the part of a Windows domain that remembers who and what everything is, then helps decide who gets in. That makes it less like an address book and more like the building's master key cabinet, with an enthusiastic replication system that ensures every writable domain controller gets the same news. This is excellent for availability. It is less delightful when the news is malicious.

The useful mental model is Tier 0: the identity control plane and everything able to control it. Domain controllers are in it, naturally. So are the accounts that administer them, and the tools that patch, back up, monitor, virtualize, or deploy to them. The surprise is that network location does not settle the question. A jump host becomes Tier 0 when a Tier 0 credential touches it. Computers have little respect for org charts.

The rule is strict because the attacker’s route is usually quite ordinary: start with a lower-value machine, obtain a more valuable credential, and repeat. A privileged access workstation, or PAW, gives each tier its own management keyboard. If an administrator enters a Tier 0 credential on a daily-use device, the protection has already failed, even if a firewall keeps up an impressive expression.

The course then moves through the other places that credentials accumulate. Protected Users limits older authentication, delegation, and long-lived ticket behavior for suitable accounts, but it needs compatibility testing. Windows LAPS prevents one local administrator password from becoming the unofficial shared key for every device. Group Managed Service Accounts rotate service credentials without the familiar ritual of changing a password and hoping nothing critical wakes up angry.

There is also a recovery-shaped lesson: replication spreads changes; it does not remember which changes were terrible ideas. Forest recovery needs a known-good backup, protected Administrator and Directory Services Restore Mode credentials, and a rehearsed sequence. The Cheatsheet is the compact map for these controls. The Slides show how the tier boundary and credential paths connect. The Practice reference and exercise turn the privileged-group review into an observable inventory, while the Reference tab leads into Microsoft’s detailed guidance.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources