Understand Active Directory
82 technical lessons on identity, directory services, authentication, authorization and security mechanisms.
Chapter 01 · Building the big picture
01.01What problem does Active Directory solve? Workgroup, domain, and centralized identity01.02Domain Controller, client, and member server: Who does what in the system?01.03Forest, domain, OU, and container: Separating the organizational structure from the trust boundary01.04What happens from start to finish when a user accesses a file share?
Chapter 02 · The Windows security foundation required for AD
02.01The differences between a local account, domain account, SYSTEM, and service identity02.02LSA, LSASS, SAM, and NTDS: Which component manages what?02.03Logon session and access token: How are a process’s identity and permissions formed?02.04Permissions, user rights, privileges, and UAC: Authority concepts that are not the same thing02.05Password, hash, key, ticket, and certificate: Credential types and the place of DPAPI
Chapter 03 · Reading the directory and its objects
03.01User, computer, and group objects: The logic of attributes and schema03.02CN, DN, UPN, and sAMAccountName: Why does one account have multiple names?03.03SID, RID, and objectGUID: Identity independent of the name03.04Naming contexts and Global Catalog: Where is each piece of information located?03.05Reading the directory with LDAP: Search base, scope, filter, and accessible attributes03.06Security on an LDAP connection: Bind, SASL, LDAPS, signing, and channel binding03.07LDAP Updates: Operation, Result and Uncertainty
Chapter 04 · Connecting to the domain and discovering services
04.01DNS, SRV records, and DC Locator: How does the client find the right DC? Sites and subnets04.02Domain join: How are the computer account and Netlogon secure channel created?04.03Why does time matter? W32Time and authentication dependency04.04SMB, RPC, and Netlogon: Mapping communication paths in an AD environment04.05Online, offline, and cached logon: What does signing in mean when the DC is unavailable?
Chapter 05 · Groups, permissions, and object control
05.01Group types, scope, nesting, and AGDLP: How does effective membership form?05.02The difference between authentication and authorization: Why proving your identity is not permission to access05.03Security descriptor, owner, DACL, SACL, and ACE: Reading a permission record05.04Allow, deny, and inheritance: Understanding the effective access decision05.05Administrative delegation: Authority at the object, attribute, and extended-rights levels05.06AdminSDHolder, SDProp, and adminCount: Permission behavior for privileged accounts05.07Local Administrator, Domain Admin, and Enterprise Admin: Separating authority scopes
Chapter 06 · Really understanding Kerberos
06.01Client, KDC, service, and krbtgt: Kerberos actors and trust relationships06.02AS, TGS, and AP flow: The difference between a TGT and a service ticket06.03SPN and service key: Which identity owns the requested service?06.04Pre-authentication, session keys, and encryption types: Who proves what?06.05PAC and group information: The relationship between the ticket, access token, and resource authorization06.06Kerberos delegation: The purpose of unconstrained, constrained, RBCD, and S4U06.07Ticket lifetime, renewal, and error conditions: Reading double-hop, SPN, and clock problems
Chapter 07 · NTLM and protocol selection
07.01NTLM challenge-response: Authentication between the client, server, and DC07.02Why are the NT hash and the NTLMv2 response not the same thing?07.03Kerberos or NTLM? Negotiate and the conditions that influence protocol selection07.04Signing, EPA, and channel binding: Which security feature protects what?
Chapter 08 · Accounts, passwords, and service identities
08.01The account lifecycle: Creation, disabling, lockout, deletion, and orphaned accounts08.02Password policy and FGPP: The difference between password change, reset, history, and lockout08.03Computer accounts: Machine passwords, join permissions, ownership, and secure channel maintenance08.04Service accounts, sMSA, and gMSA: The relationship between identity, SPN, password, and access; a version note on dMSA08.05Local administrator passwords and Windows LAPS: A different problem from a domain account
Chapter 09 · Group Policy: How centralized control works
09.01The two halves of a GPO: GPC, GPT, and SYSVOL09.02Which policy applies? LSDOU, filtering, inheritance, and loopback09.03Editing, linking, and applying a GPO: Separate permissions, separate impact domains09.04Policies, preferences, scripts, and scheduled tasks: What can centralized configuration change?09.05Why was the GPO not applied? Reading resultant policy, refresh, version, and evidence
Chapter 10 · DCs, replication, and trust relationships
10.01Writable DC, Global Catalog, and RODC: Differences in authority, data, and password caching10.02Replication: How changes, deleted objects, and SYSVOL propagate10.07Why Two DCs Differ: Metadata, Conflict and Convergence10.03FSMO roles: Understanding their special tasks without confusing them with a single “main DC”10.04Forest and domain boundaries: Administrative separation and security isolation10.05Trust direction, transitivity, and trust types: Who trusts whom?10.06Cross-domain access: Kerberos referrals, SIDHistory, SID filtering, and selective authentication
Chapter 11 · AD CS and certificate-based identity
11.01Public/private keys, certificates, CAs, and the trust chain: The foundations PKI requires11.02Enterprise CAs and certificate templates: Subject, SAN, EKU, and intended use11.03Who can obtain a certificate on whose behalf? CA/template permissions, enrollment, and issuance controls11.04AD authentication with certificates: PKINIT, NTAuth, and certificate mapping11.05The certificate lifecycle: Private-key protection, renewal, revocation, and identity trust
Chapter 12 · AD’s relationship with the hybrid world
12.01AD DS, Entra ID, Entra Domain Services, and AD FS: Separating the products and their boundaries12.02PHS, PTA, and federation: Where is the user, and how are they authenticated?12.03Connect, Cloud Sync, and writeback: The trust relationships of synchronization12.04Registered, joined, and hybrid joined devices: The place of Windows Hello in this model12.05From Windows Hello to AD Resources: PRT, Trust and Ticket Paths
Chapter 13 · The Logic Behind Security Findings
13.01Reading an Authorization Graph: Membership, Object Control, Sessions, and Management Relationships.13.02Separating Risks Arising from Credentials, Privileges, and Trust Relationships.13.03From Attack Names to Mechanisms: Understanding Kerberoasting, Relay, DCSync, and Related Terms.13.04Assessing a Finding: Preconditions, Impact Scope, Evidence, Exceptions, and Remediation.
Chapter 14 · Protecting AD
14.01The Privileged Access Model: Tier 0, Administrative Separation, and the Enterprise Access Model.14.02PAWs, Separate Administrator Accounts, and Session Discipline: A Trusted Management Path.14.03Critical Dependencies Outside the DC: Hypervisors, Backups, PKI, and Management Agents.14.04Protocol Hardening: Safely Enabling LDAP, NTLM, SMB, and Kerberos Controls.14.05Protected Users, Credential Guard, and MFA: Protection Scope and Boundaries.
Chapter 15 · Collecting Evidence, Isolating Problems, and Understanding Recovery
15.01Where Is Telemetry Generated? The Relationship Between Clients, Servers, DCs, Audit Policy, and SACLs.15.02Correlating Sessions, Kerberos, and Directory Changes in Event Records.15.03Failure, Misconfiguration, or Security Incident? DNS, Time, and Replication Symptoms.15.04Comparing Configuration with Effective Behavior: Evidence Quality and False Positives.15.05Scoping a Suspicious Situation: Isolation, Identity Trust, and Recovery Priorities.15.06Object Restore, DC Recovery, and Forest Recovery: Scenarios That Are Not the Same Problem.15.07One Access Incident, Multiple Trust Boundaries: Evidence to Decision