Glossary.

Directory service that stores domain identities and objects.

Server that hosts the AD DS directory and related domain services.

AD structure that covers a common schema/configuration and related domains.

Structure that organizes accounts and objects within a specific management area.

Organizational unit used for delegation and policy organization.

Structure that contains objects in the directory; not every container is an OU.

Windows local security authority functions.

System process that runs security components such as authentication packages.

Security database associated with local account data.

Components related to the Active Directory directory service and its data.

Windows object that represents the security context of a process or thread.

Session context associated with authentication; it is not the same object as a token.

Infrastructure for protecting application data on Windows with identity and system context.

The full name of an object in the directory.

A sign-in name that resembles the user's email format.

Account name used for compatibility with legacy Windows account naming.

A security identifier is the identity number Windows uses to recognize a user, group or computer account. WS01\tunahan and IYELABS\tunahan can share a name but have different SIDs. These recognized identities are called security principals.

Relative identity component appended to the domain SID.

GUID identifier of the directory object.

Role that also provides partial attribute copies for forest-wide search.

Directory access protocol; it is not a security guarantee by itself.

LDAP connection established over TLS from the start.

Approach for binding the authentication context to the underlying secure channel.

Discovery/selection mechanism that helps locate an appropriate domain controller.

DNS record type that advertises endpoint information for a service.

Netlogon trust relationship between a member computer and the domain.

Interactive sign-in without DC access using suitable local information.

Accounts → Global groups → Domain Local groups → Permissions modeli.

ACL that carries allow/deny access entries for an object.

ACL that carries related audit and security information.

A single access or audit entry inside an ACL.

Owner of the object; access to data should be separated from descriptor management.

AD object associated with the permission template for protected objects.

Trust center that provides Kerberos ticket services.

Account associated with the keys used to protect the domain's TGTs.

Ticket-granting ticket used to request subsequent service tickets from the KDC.

Kerberos ticket for a specific target service.

Structure containing fresh evidence of use of the relevant session key.

Service principal name that associates a service instance with an account identity.

Structure carrying authorization data in the Windows Kerberos context.

Delegation approach where delegation authority is defined on the target resource side.

Challenge-response based Windows authentication protocol family.

Package that helps select the appropriate authentication mechanism.

Additional authentication binding controls in suitable applications.

Defining password policies for different user/global security group scopes.

Account model that provides automatic secret management for suitable multi-host services.

Management and backup of local administrator passwords.

The AD directory object side and SYSVOL file side of a GPO.

Share that provides domain-shared data such as Group Policy files.

Processing approach that relates user policies to the computer location.

Read-only domain controller; password cache scope is controlled separately.

Special roles that coordinate specific domain/forest operations.

Trust relationship involving one authority accepting identities from another.

Legacy SID information in an identity lifecycle/migration context.

Additional access boundary for authentication to a specific target over a trust.

Sertifika imzalayan certificate authority.

extended key usage field related to the certificate's usage purposes.

Public-key authentication extension at Kerberos startup.

Relevant trust publication in the AD certificate validation acceptance chain.

Cloud password validation data synchronization and on-prem pass-through approaches.

Controlled, hardened workstation approach for sensitive administration.

Coordinated recovery approach for broad AD trust/service loss.

computers managed without joining a domain directory; each device stores its local accounts in its SAM.

shared domain storage for user, group and computer objects.

runs AD DS and provides directory and domain authentication functions. Multiple DCs replicate directory data.

a security principal used to administer resource permissions through membership. Resource ACLs still require configuration.

central policy administration subject to scope and client processing; joining a domain alone does not prove every setting was applied.

LSA, the Kerberos SSP, and SSPI acquire a context for the principal, request a service ticket, and present it to the target service.

AD DS stores and replicates directory data; the Windows KDC uses AD DS as its domain-account database.

hosts the service and securable resource; accepts the ticket in the service context, creates a logon session or token, and evaluates the resource ACL.

Event 4769 on the DC Security log; Event 4624 on the target member server Security log where the session is created.

a matching, non-zero LogonGuid in both events; neither its presence nor a one-to-one match is universal.

distinguished name (DN), relative distinguished name (RDN), and domain naming context.

organizationalUnit; schemaIDGUID bf967aa5-0de6-11d0-a285-00a003049e2.

owner, DACL, SACL, and ACEs in nTSecurityDescriptor.

trustee SID, access mask, inheritance flags, and—where applicable—object and inherited-object GUIDs.

granular rights written to an OU or parent-container ACL that can propagate to descendants under inheritance rules.

\server\share\path identifies the target server, share, and relative path.

NEGOTIATE establishes connection capabilities; SESSION_SETUP establishes the user security context; TREE_CONNECT establishes share context; CREATE requests that a file or directory be opened.

during SESSION_SETUP, SMB uses Kerberos or another suitable Windows authentication package; Kerberos is not the only option.

the target object and requested access mask become inputs to the file-server resource decision.

the corresponding computer is the security authority; its local SID and assignments have meaning on that host.

the AD domain is its security authority; resource ACLs refer to the account’s full SID, including its RID, rather than the shared domain SID prefix.

SCM logs on the configured account, creates an access token, and attaches it to the service process.

a highly privileged predefined identity on the local computer; on the network, it presents the computer account's credentials.

a low-privilege predefined local identity; on the network, it presents the computer account's credentials.

a low-privilege predefined local identity; on the network, it presents anonymous credentials.

a service logon session initiated by SCM on the service host.

security-authority and subsystem functions that provide local security policy, logon, and authentication-package architecture.

the critical system-process boundary that hosts LSA functions and authentication/security package components.

the local user and group account store present on each Windows system.

the directory service for domain objects and its persistent store on a domain controller; Ntds.dit is not a member-workstation store.

the boundary through which applications work with security packages; normal application flow does not read SAM or Ntds.dit directly.

records a trusted logon process registering with LSA in the Security channel.

returns the AuthenticationId, TokenId, and TokenType fields from the TOKEN_STATISTICS structure.

requests access to a process's primary token.

requests access to an impersonating thread's token.

an operation requested on a securable object; evaluated against DACL ACEs.

logon-right and privilege assignments in device policy.

a special capability for a local system task or resource; it must be present in the token and, where required, enabled.

under Admin Approval Mode and applicable account and policy conditions, separates standard and administrator tokens and governs elevation.

compares the token integrity level with the object's mandatory label before DACL evaluation.

a secret the user knows; depending on the protocol, it may become an input to a verifier or key-derivation function.

a value derived by a specific algorithm; by itself, it does not prove knowledge of the plaintext password.

secret or public key material for a particular algorithm and purpose; by itself, it proves neither identity nor policy acceptance.

carries an open realm and sname alongside an enc-part protected with the target key; the ticket alone does not prove that the client possesses the session key.

carries subject and public-key information, an issuer signature, validity, and extensions; it does not prove possession of the corresponding private key.

protects application data as a DPAPI blob, or unprotects it, according to user or machine context.

the definition of an object type, including objectClassCategory, subClassOf, and mustContain/mayContain.

the definition of one attribute, including lDAPDisplayName, attributeSyntax/oMSyntax, isSingleValued, and schemaIDGUID.

a multi-valued instance attribute listing the structural/abstract superclass chain and any dynamically attached auxiliary classes.

a single-valued attribute holding the distinguished name of the class or a superclass, used for searches.

the class's required and optional attribute sets.

the value type (Unicode string, integer, SID, DN, and so on) and comparison rule.

the stable identifier used to refer to an attribute or class in security descriptors.

the object's full directory location, a comma-separated sequence of RDNs (RFC 4514).

the object's name within its parent. This AD user example uses the naming attribute cn and RDN CN=Büşra. General LDAP string syntax permits one or more attribute-value assertions in an RDN.

the naming attribute of a user object; it supplies the RDN.

prefix@suffix logon name; forest-wide uniqueness is checked under documented originating-write conditions.

a down-level logon name of no more than 20 characters, unique within a domain.

Configuration entries that define alternative UPN suffixes.

the binary SID that identifies a security principal; assigned when the account is created, stable through rename/same-domain OU move, and replaced on cross-domain move.

the version of the SID structure (practically 1).

the highest authority that issued the SID; 5 for NT Authority and 1 for World Authority.

the subauthority sequence before the RID; it distinguishes a domain within the forest.

the final subauthority; it distinguishes an account within the domain and is never reused.

a globally unique 128-bit identifier assigned when an object is created; it survives rename and move.

a multi-valued attribute that stores former objectSid values when an object moves between domains.

section of a domain that holds user, computer, and group objects; only it replicates exactly between the DCs of domain.

holds site, subnet, service and replication topology objects; common to all forest.

holds the definitions attributeSchema and classSchema; It is unique and common throughout forest.

a separate partition for application data such as DNS, replicated to selected DCs; in AD DS it cannot contain security principals and is not automatically replicated to the GC.

Server-specific entry that publishes the list of NCs (namingContexts) and the schema entry (subschemaSubentry), not belonging to any NCs.

DN where the search will begin; the root of the call is determined from here (RFC 4511 §4.5.1.1).

baseObject(0) that entry only, singleLevel(1) direct subobjects, wholeSubtree(2) the entire subtree (RFC 4511 §4.5.1.2).

matching condition of objects; Alternatives to CHOICE such as equalityMatch, present, substrings, and/or/not (RFC 4511 §4.5.1.7).

TRUE returns only attribute names, without values ​​(RFC 4511 §4.5.1.6).

upper limits requested by the client; The server can also impose its own upper limit (RFC 4511 §4.5.1.4–5).

control used to retrieve large result sets piece by piece; The server limits the number of objects returned in a single request.

BindRequest authentication=simple [0] OCTET STRING carries credentials, commonly a password; TLS simple bind has no CBT (RFC 4511 §4.2; KB4563239).

authentication=sasl [3] SaslCredentials carries a mechanism and credentials, for example Negotiate, Kerberos, NTLM, or Digest (RFC 4511 §4.2).

port 636 starts TLS on connect; StartTLS can protect a connection on port 389. A properly validated TLS session protects transport confidentiality and integrity.

LDAPServerIntegrity=2 requires signing for applicable unsigned sessions. TLS provides signing/integrity and satisfies this requirement; for non-TLS SASL, the client must request signing or sealing.

SASL can provide LDAP message integrity and confidentiality on a non-TLS session, depending on the mechanism and negotiated protection.

for SASL authentication over TLS, CBT cryptographically binds the authentication context to the TLS session; it does not apply to TLS simple bind (KB4563239).

LDAPServerIntegrity (None=1, Require Signing=2) and LdapEnforceChannelBinding (Never=0, When Supported=1, Always=2) under NTDS\Parameters (KB4520412).

Sending an update is different from knowing its outcome. Examine LDAP operation boundaries, atomicity within one Modify, and uncertainty when a response is lost.

Win32 Locator API that the application on the client calls to request DC; The request goes to the local Netlogon service with RPC.

Implements DsGetDcName, queries DNS, pings LDAP UDP and caches the found DC.

Declares DC capabilities (LDAP, Kerberos, PDC, Global Catalog) in the format _<service>._<protocol>.<DnsDomainName>.

Allocates DCs in the client's own site with the format _<service>._<protocol>.<SiteName>._sites...

datagram sent to candidate DCs; Verifies that DC is live and available, first responder preferred.

stores the discovered DC, ensuring consistent use of DC in subsequent requests; DS_FORCE_REDISCOVERY skips this.

diagnostic log that records site mismatched clients NO_CLIENT_SITE.

computer): Directory object representing the machine participating in domain; sAMAccountName ends with '$ (e.g. WS-034$).

domain-level default allowance for the quota-managed “Add workstations to domain” user-right route; the default value is 10.

ID material set at join, kept as secret on the client as LSA, and renewed by default every ~30 days.

secure communication channel between a client Netlogon service and a DC based on machine account identity.

the AD attribute bit identifying a computer account. Event 4741 NewUacValue is a separate SAM User Account code field; the example value 0x80 denotes a workstation-trust account.

The default primary group of machine accounts is Domain Computers.

the “Add workstations to domain” user right; this is the quota-managed authorization route for creating a new computer account, not a second gate independent of the quota.

an explicit ACL permission on the target OU/container; an alternative to the quota-managed user-right route for creating a new account. Reusing an existing account has separate permission requirements.

Service that aligns the time of member domain according to the hierarchy; Members are in the time client role by default.

Default synchronous mode in which member domain receives time from an authenticating DC.

default authorized clock source at the top of the time hierarchy; PDCs of child domains are synchronized from it.

the largest clock difference between the client and DC that Kerberos tolerates; default 5 minutes.

timestamped preauth data that the client encrypts and sends with the key derived from its password.

Kerberos error returned when the difference between the requested time and the KDC time exceeds the allowed skew; On 4771 it appears in the Status field.

the fact that a port is reachable indicates that it is a listening-only service; It does not contain identity or authority.

The sequence NEGOTIATE → SESSION_SETUP (authentication) → TREE_CONNECT (IPC$ or a share) → CREATE (named pipe or file).

\PIPE\<ad> over share IPC$; RPC bind and authentication follow the SMB session.

Endpoint Mapper (TCP 135) resolves dynamic endpoint; dynamic port range 49152–65535 on modern Windows.

UUID 12345678-1234-ABCD-EF00-01234567CFFB, RPC version 1.0; \PIPE\NETLOGON via named pipe or ncacn_ip_tcp, in the context of machine account secure channel.

4624 network logon carrying LogonType 3 on the target Security channel; This indicates successful authentication at the application layer, which port reachability alone does not produce.

a local, encrypted, one-way value used only to verify offline logon; it cannot recover the password.

the cache limit is 0–50 entries; 0 disables caching. The default is 25 on Windows Server 2008 and 10 on other versions; credential type affects how many entries each user consumes. In the password-user example, a new user can replace the oldest cached entry once the limit is reached.

the SID set created after successful logon; offline logon also creates a token, but that token does not represent current DC verification.

existing TGT and service tickets; When DC is missing, new tickets cannot be obtained, but existing tickets in lifetime can be used.

4624 with LogonType 11 (CachedInteractive) in the target Security channel; this indicates that the DC was not contacted. New resource access produces separate evidence.

security group appears as principal in DACLs and carries permissions; distribution group is not security-enabled and cannot be DACLed (for email distribution only).

members are account, global and other universal groups from any domain in the forest; membership is maintained in the Global Catalog.

Account → Global group → Domain Local group → Permission. Accounts are collected in global groups, global groups are nested in domain local groups that carry permissions, permission is given only to the domain local group.

a token contains the user SID and applicable direct and indirect group SIDs resolved for that logon context. Presence and participation attributes are separate; the relevant groups in this fixture are security-enabled and enabled.

Domain Users is domain SID + RID 513; Built-in Users is S-1-5-32-545. These are common in standard domain-user logons, not guaranteed in every token. Check primaryGroupId, the token host, local-group membership and logon context.

a principal proving its claimed identity (interactive logon, Kerberos ticket, credential verification); The result is a logon session and access token.

output of authentication and input of authorization; It carries the user SID and group SIDs.

the system's decision to grant/deny access by comparing the SIDs in the token with the ACEs in the DACL of the target object for the desired access mask.

set of bits that indicate what rights (e.g. FILE_READ_DATA, FILE_WRITE_DATA) the access request requests; access check is executed according to this mask.

each object has its own security descriptor; The same token may be authorized in one object but unauthorized in another.

carries proof of identity; Having a ticket does not include resource authorization, it only covers the authentication side.

structure that carries the security information of a securable object; It consists of owner SID, primary group SID, DACL, SACL and control bits.

owner of the object; It is denoted by O: in SDDL. Primary group SID: Represented as G: in SDDL (moved for POSIX compatibility, plays a secondary role in Windows access).

): ACE list that determines which rights are allowed/denyed to which trustees; produces the access decision.

): ACE list that determines which access attempts produce audit records; It does not grant access, it produces audit.

type (e.g. A=access-allowed, D=access-denied, AU=system-audit), flags (inheritance etc.), rights (access mask), object/inherit GUID and trustee SID.

READ_CONTROL (read descriptor, except SACL), WRITE_DAC (change DACL), WRITE_OWNER (change owner); these govern the permission structure of the object.

P (protected), AI (auto-inherited), AR (auto-inherit-required) flags on DACL/SACL in SDDL; Specifies the inheritance behavior of the descriptor.

the set of rights requested by the access request (e.g. FILE_READ_DATA + FILE_WRITE_DATA); access check is executed according to this mask.

those of the requested rights that have not yet been met with the allow ACE; It decreases as the evaluation progresses, access is granted when it reaches zero.

ACEs in the DACL are examined in the order they appear; The decision becomes final in the first decisive match (sufficient allow is collected or a requested right is denied).

preferred order — explicit ACEs before inherited ones; access-denied ACEs before access-allowed ones in each group.

an ACE can be explicit (defined directly on the object) or inherited (coming from the parent object, ID flagged); Inherited ACEs come after explicit ones in canonical order.

No DACL (SDDL: NO_ACCESS_CONTROL); It means full access to everyone.

the DACL exists but has zero ACEs (SDDL: D:); it grants no requested rights through allow ACEs. In AD DS, the current owner may separately receive READ_CONTROL and WRITE_DAC; SE_TAKE_OWNERSHIP_PRIVILEGE may imply WRITE_OWNER.

control access rights are defined by a GUID and not by an access-mask bit; ACE carries the RIGHT_DS_CONTROL_ACCESS (CR) bit in ACCESS_MASK and the corresponding GUID in the ObjectType field. If ObjectType is empty, ACE includes all control access rights.

fields ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid (Microsoft ACE strings).

Reset Password), rightsGuid 00299570-246d-11d0-a768-00aa006e0529 (AD Schema).

5136 (directory object modified, requires appropriate SACL), 4662 (object operated on); Subcategory Audit Directory Service Changes and Audit Directory Service Access; only on domain controller.

CN=AdminSDHolder,CN=System,DC=<dc>,DC=<dc>; The owner is the Domain Admins group of the domain; Enterprise Admins and Administrators can also make/own changes (Appendix C).

runs every 60 minutes by default on PDCE; Compares the DACL of AdminSDHolder with the DACL of protected objects, if different, writes back the protected object according to AdminSDHolder; Disables inheritance.

DWORD under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters; range 60–7200 seconds; If deleted, it returns to 60 minutes; Reducing production increases the LSASS burden on PDCE.

RunProtectAdminGroupsTask = 1 on rootDSE LDAP modify (with Ldp.exe) triggers SDProp immediately, does not affect the scheduled run.

SDProp is set to 1 on the objects it protects; It marks that an object IS protected, it does not automatically return to 0 when unsubscribed.

5136 (with appropriate SACL) for AdminSDHolder DACL or adminCount change, Audit Directory Service Changes; domain controller only.

SID S-1-5-32-544; a local SAM group on a member host, but a directory group in AD’s CN=Builtin container on a DC. On a domain controller, members have full access to the DC and unrestricted administrative access to the domain.

SID S-1-5-21-<domain>-512; global group; specific to its domain and nested by default into that domain’s Builtin Administrators group and the local Administrators groups of domain-joined computers.

SID S-1-5-21-<forest-root>-519; It is found only in the forest root domain; It is added to the Administrators group of each domain in the forest; Its scope is forest-wide.

4732 (member added) / 4733 (member removed) for local group; 4728/4729 for global group; for universal group 4756/4757.

Domain Local, Global and Universal; The RID and group scope of a SID determine which domain/forest boundary the membership is valid for.

the ordinary password-based AS path uses its long-term key as the reply key. Other pre-authentication mechanisms can select a different reply key. The client does not know the krbtgt key or open the TGT ciphertext.

is a service of the domain; It has two components: Authentication Service (AS) issues TGT, Ticket-Granting Service (TGS) issues service tickets. It runs as a single process in LSA on the domain controller and cannot be stopped.

KDC's account; It is created automatically when the domain is created, it cannot be deleted and its name cannot be changed; It has a random password, and from this password the key that seals the TGTs is derived. The krbtgt key is the root of domain-wide trust.

the SPN associates an instance with its sign-in account. The KDC protects the service-ticket enc-part with that account's key. One account may support multiple SPNs or instances; a separate key per instance is not guaranteed.

when trust is established between two realms, a common trust account and an inter-realm key derived from it are created; The cross-realm referral ticket is sealed with this key.

AS-REP ::= [APPLICATION 11] KDC-REP, TGS-REP ::= [APPLICATION 13] KDC-REP.

Ticket ::= [APPLICATION 1] SEQUENCE { tkt-vno, realm, sname, enc-part }.

EncryptedData ::= SEQUENCE { etype [0], kvno [1] OPTIONAL, cipher [2] }.

2 (ticket enc-part, service key), 3 (AS-REP enc-part, client key), 8/9 (TGS-REP enc-part, TGS session key or authenticator subkey).

AP-REQ ::= [APPLICATION 14] SEQUENCE { pvno, msg-type, ap-options, ticket, authenticator }.

4768 (AS), 4769 (TGS), 4771 (pre-auth error); only on domain controller.

PrincipalName ::= SEQUENCE { name-type [0] Int32, name-string [1] SEQUENCE OF KerberosString }.

name-type NT-PRINCIPAL (1) and NT-SRV-INST (2); sname mostly names the service instance with type NT-SRV-INST.

ticket enc-part is protected by the service key; this is the key to the account from which the sname was resolved.

KDC_ERR_S_PRINCIPAL_UNKNOWN (7) unknown SPN, KDC_ERR_PRINCIPAL_NOT_UNIQUE (8) same SPN found in more than one account.

<service class>/<host>:<port>/<service name>; The first two components are mandatory, port and service name are optional (Microsoft, Name Formats for Unique SPNs).

4769 / ServiceName, ServiceSid, TicketEncryptionType fields; only on domain controller.

:= SEQUENCE { padata-type [1] Int32, padata-value [2] OCTET STRING }; §5.2.7.2 PA-ENC-TIMESTAMP (padata-type 2), PA-ENC-TS-ENC (timestamp) encrypted with the client's key.

AS-REP enc-part is encrypted with the client's long-term key (reply key) and carries the session key; ticket [5] and enc-part [6] are sister fields in the same SEQUENCE.

1 (AS-REQ PA-ENC-TIMESTAMP), 3 (AS-REP enc-part, client/reply key), 2 (ticket enc-part, service/krbtgt key).

KDC_ERR_PREAUTH_REQUIRED (25), KDC_ERR_PREAUTH_FAILED (24), KDC_ERR_ETYPE_NOSUPP (14).

The req-body etype list declares the client's enctype capabilities; KDC selects a matching client long-term/reply key for AS-REP reply encryption and a separate enctype for the session key, and these two enctypes may be different. §5.2.7.5 PA-ETYPE-INFO2 is the padata by which the KDC reports the enctype, salt, and s2kparams for the long-term/reply key to the client.

encryption type profiles; string-to-key and random-to-key are enctype specific, and each protocol key is tied to a single enctype (typed key). RFC 3962: etype 18 AES256-CTS-HMAC-SHA1-96, 17 AES128-CTS-HMAC-SHA1-96; RFC 4757: etype 23 RC4-HMAC.

4771 / PreAuthType (2 = PA-ENC-TIMESTAMP), Status (Failure Code, 0x18 = KDC_ERR_PREAUTH_FAILED); generated only on domain controllers, and not generated for an account with Kerberos preauthentication disabled.

AuthorizationData ::= SEQUENCE OF SEQUENCE { ad-type [0] Int32, ad-data [1] OCTET STRING }; §5.2.6.1 AD-IF-RELEVANT (ad-type 1), unclear elements can be ignored.

PAC is encoded as AD-WIN2K-PAC (ad-type 128) and wrapped in AD-IF-RELEVANT (ad-type 1) and placed in the ticket authorization-data.

UserId, PrimaryGroupId, GroupIds (GROUP_MEMBERSHIP array: RelativeId + Attributes) and ExtraSids; group membership is carried over here.

Generated with Server Signature service key, KDC Signature with krbtgt key; signature verification checks the integrity of the PAC.

the token carries the user's SID and group SIDs and access check is done with this token.

forwardable ticket flags; The delegated identity is carried with a forwarded TGT.

ok-as-delegate ticket flag; KDC sets this flag when the service account is marked as trusted for unconstrained delegation and tells the client 'delegating credentials to this service is appropriate according to the realm policy'.

TGS extensions S4U2self (protocol transition) and S4U2proxy (constrained delegation); They are two separate steps.

TRUSTED_FOR_DELEGATION 0x80000 (unconstrained), TRUSTED_TO_AUTH_FOR_DELEGATION 0x1000000 (protocol transition), NOT_DELEGATED 0x100000 (account cannot be delegated).

allowed target SPN list that resides in the front-end account in classic constrained delegation.

Security descriptor (String(NT-Sec-Desc), 2.5.5.15), which resides in the back-end account in RBCD and carries the allowed front-end SIDs.

Shows through which service the delegation is made in the ticket issued with S4U2proxy; only on domain controller.

EncTicketPart inside Ticket and EncKDCRepPart inside KDC-REP are separate structures; both carry times but are protected with different keys.

endtime is the current validity limit; renew-till is the latest renewal limit. They are distinct fields, often with a later renew-till, but the values need not be strictly different.

new endtime is obtained by presenting existing ticket; renew-till remains constant.

KRB-ERROR ::= [APPLICATION 30]; error-code [6] is the Int32 numeric ID of the error, e-text [11] and e-data [12] are additional information.

KDC_ERR_S_PRINCIPAL_UNKNOWN 7, KDC_ERR_PREAUTH_FAILED 24, KDC_ERR_PREAUTH_REQUIRED 25, KRB_AP_ERR_TKT_EXPIRED 32 (0x20), KRB_AP_ERR_REPEAT 34 (0x22), KRB_AP_ERR_SKEW 37 (0x25), KRB_AP_ERR_MODIFIED 41 (0x29).

KDC transaction logs; These fields are the Windows equivalent of the above error namespace and are produced only in DC.

has the NT hash (key for NTOWFv2) derived from the user's password. The server in Type 2 receives the challenge, generates its own client challenge, calculates NTProofStr and sends it in Type 3. The password itself does not go in any messages.

it cannot validate a domain account response using its local account data and passes validation to a DC through Netlogon. For a local account, the target computer is the account authority and uses its own account data. An upper protocol such as SMB or HTTP carries the NTLM messages.

the validation authority for a domain account. Writable DCs replicate credential material. An RODC can validate an account whose credentials are cached under its Password Replication Policy; otherwise it forwards to a writable DC. This visual does not emulate RODC forwarding.

pass-through authentication path between the server and the DC. The server transports the NTLM credential to the DC via Netlogon (MS-NRPC) in the format defined by MS-APDS; This channel is set up with the server's computer account.

the authentication package used for NTLM credential validation. Visibility of 4776 depends on applicable Audit Credential Validation coverage; absence of the event does not by itself show that validation did not occur.

MD4(UTF-16LE(password)). It is not salted and derives only from password; the same password yields the same NT hash on every account. The password is fixed unless changed; In the domain account, it is kept in the directory on the DC side, in the local account it is kept in the SAM. It is credential-equivalent: if captured, it can be used as proof of identity without knowing the password (pass-the-hash).

HMAC_MD5(NT hash, UNICODE(Uppercase(User) + UserDom)). In NTLMv2, this is the real key; NT derives from hash and user+domain name. 'Salt' is not random here, it is the username and domain name.

structure embedded in response; Contains RespType 0x01, timestamp (FILETIME), 8-byte client challenge and TargetInfo AV_PAIRs. These variables explain why Response changes every time.

HMAC_MD5(NTOWFv2, NTProofStr). It is the basis of session key derivation; It does not go open on the wire and cannot be read directly from the response.

mechTypes is an OID list in initiator preference order. The acceptor can choose an offered, acceptable mechanism or reject the list; it need not always choose the first common entry.

mechListMIC is a MIC protected by the chosen mechanism and serves to detect whether the mechTypes list has been downgraded by a middle party.

an application can select the Negotiate package through SSPI; the package prefers Kerberos when it can be used and the caller supplies sufficient target identity information, such as an SPN, UPN, or NetBIOS account name. The selected package appears in Event 4624 AuthenticationPackageName.

LogonType 3 (Network) is a network session; LogonProcessName 'NtLmSsp' distinguishes a session processed by NTLM SSP, while AuthenticationPackageName distinguishes the packet actually used (Kerberos / NTLM / Negotiate).

The LmPackageName field indicates the minor version ('NTLM V1' / 'NTLM V2' / 'LM') used in NTLM sessions; Kerberos sessions have '-'. KeyLength carries the key length (e.g. 128); It is 0 for Kerberos sessions.

'Network security: Restrict NTLM' policy family can manage outgoing/incoming NTLM traffic as Allow / Audit / Deny; Deny may fail to fallback to NTLM, so fallback is not guaranteed in all environments.

NTLMSSP_NEGOTIATE_SIGN requests message integrity (signature), NTLMSSP_NEGOTIATE_SEAL requests message confidentiality (encryption); The two are separate flags. With NTLMSSP_NEGOTIATE_KEY_EXCH the AUTHENTICATE message carries an EncryptedRandomSessionKey; The exported session key is RC4 encrypted with KeyExchangeKey.

The MsvAvChannelBindings (0x000A) field is an MD5 hash of the gss_channel_bindings_struct value of the external secure channel (e.g. TLS); By putting this in the target information in AUTHENTICATE, the client binds the internal NTLM authentication to the external channel (channel binding component of EPA).

MsvAvTargetName (0x0009) carries the SPN (service binding) of the target service; Bit 0x00000002 in MsvAvFlags (0x0006) indicates that a MIC is present. If a MIC is present and authenticated in the AUTHENTICATE message, this MIC protects the NEGOTIATE + CHALLENGE + AUTHENTICATE triple with the session key via HMAC-MD5 and prevents flags (e.g. removing signing) from being changed later; MIC may not be available/mandatory in every session.

Under NTDS\Parameters, LDAPServerIntegrity sets signing requirement (1 = not required, 2 = signing required); LdapEnforceChannelBinding Determines the channel binding enforcement on TLS (0 = never, 1 = on supporting clients, 2 = always).

3039, LDAP-over-SSL/TLS reports that a client failed LDAP channel binding token validation (under the When Supported or Always policy; minimum logging level 2). When the policy is Never, 3040 reports the number of unprotected LDAPS binds in the last 24 hours, and 3041 reports the 24-hour posture warning (channel binding enforcement is recommended) (minimum logging level is 0).

In an SMB2 session, SMB2_NEGOTIATE_SIGNING_REQUIRED specifies that the server requires signing; If signing is mandatory, a session relayed over SMB cannot produce a valid signature. This is a parallel integrity layer outside of LDAP.

ACCOUNTDISABLE = 0x0002 makes a DC that has received the change reject new online domain authentication for this account; cached desktop logon and established sessions are separate paths. In AD DS, assess effective lockout from lockoutTime and ADS_UF_LOCKOUT (0x0010) in the computed msDS-User-Account-Control-Computed attribute; do not treat this as a persistent userAccountControl value.

lockout applies when failed-password attempts reach the configured Account lockout threshold; Account lockout duration and Reset account lockout counter after determine the behavior.

a replicated, approximate indicator of domain logon activity. It updates only when its value is older than the configured msDS-LogonTimeSyncInterval. Common default behavior produces an update threshold of roughly 9–14 days; it is not an exact last-use proof. badPwdCount and lastLogon are non-replicated and maintained per DC.

a deleted object is marked isDeleted=TRUE and enters Deleted Objects. If AD Recycle Bin was enabled before deletion, preserved attributes can be restored during the deleted-object lifetime; later recycled/tombstone and permanent-cleanup stages depend on tombstoneLifetime and configuration. Do not assume a universal 180-day default.

User-Force-Change-Password (Reset Password) control access right, Rights-GUID 00299570-246d-11d0-a768-00aa006e0529; another-account reset attempt is audited as 4724, while the outcome must be read separately.

one per domain; It includes minimum length, password history, min/max age, complexity and Account Lockout Policy subsection (carried over by Group Policy).

overrides domain policy for specific user/global group; Contains the fields msDS-PasswordSettingsPrecedence, msDS-PSOAppliesTo, msDS-Lockout*.

evaluate directly assigned user PSOs first; otherwise consider applicable group PSOs. Within the chosen set, the lowest numeric msDS-PasswordSettingsPrecedence (highest priority) wins; objectGUID breaks ties. PSOs are not merged.

objectClass=computer; sAMAccountName ends with '<host>$; Each domain member has an account and password.

WORKSTATION_TRUST_ACCOUNT 0x1000 (workstation/member server), SERVER_TRUST_ACCOUNT 0x2000 (domain controller) — distinguishes the type of account.

the local secret stored by the member must be the same as the password of the account in AD; Netlogon secure channel relies on this matching.

It is established between the member and the DC via the MS-NRPC RPC interface (\PIPE\NETLOGON named pipe, ncacn_ip_tcp dynamic endpoint, Netlogon SSP).

default 30 days, allowed range 1-999; The member initiates the change, DC does not force it.

number of accounts an authenticated user can create, default 10.

4741 (account created) and 4742 (account changed) are produced only on DCs, in the Audit Computer Account Management subcategory.

an ordinary domain user account; The administrator knows the password and returns it manually; The administrator manages the SPN.

Came with Windows Server 2008 R2; It provides automatic password management and simplified SPN management, but is tied to a single host.

Came with Windows Server 2012; multiple hosts in a server farm share the same identity; DC calculates the password.

A constructed attribute in the gMSA object; It is not stored static, it is returned to the authorized caller as MSDS-MANAGEDPASSWORD_BLOB at the time of the request.

Version, Reserved, Length; CurrentPasswordOffset, PreviousPasswordOffset, QueryPasswordIntervalOffset, UnchangedPasswordIntervalOffset; current/optional previous WCHAR values and two distinct interval fields.

Determines how many days the gMSA password will change; In PowerShell, the default is 30 days and is determined at creation time.

<port> and /<service name> are optional components used when needed. For example, cifs/files.example.test needs neither extra component. The SPN must be unique within the forest.

Unicode string; carries the cleartext password as JSON with encryption off ({"n":account, "t":UTC update time hex, "p":password}); SearchFlags 904 (including fCONFIDENTIAL).

byte string; encrypted password blob; SearchFlags 904; AttributeSecurityGuid ms-LAPS-Encrypted-Password-Attributes (f3531ec6-6330-4f8e-8d39-7a671fbac605).

64-bit integer, UTC expiration time of the password; SearchFlags 0 — not confidential.

history and DSRM password for DCs; only when encryption is on; SearchFlags 904.

extended right / property set; Rights GUID f3531ec6-6330-4f8e-8d39-7a671fbac605; valid accesses 48 (RIGHT_DS_READ_PROPERTY | RIGHT_DS_WRITE_PROPERTY). RP/WP property-set scope does not remove the confidential attribute’s additional RIGHT_DS_CONTROL_ACCESS requirement.

password is stored in the computer object; access is protected by ACLs (and optional AES-256/CNG DPAPI encryption).

events under Applications and Services > Microsoft > Windows > LAPS > Operational; It's not on the Security channel.

runs once an hour, hard-coded and non-configurable; Unlike Microsoft LAPS, legacy is not a GPO CSE.

GPO is the combination of GPC metadata in AD and GPT files in SYSVOL under the same policy GUID; You cannot say "GPO has been applied" without considering both replication paths and client reading together.

LSDOU only gives the starting order; security/WMI filtering, inheritance, and loopback narrow or reframe which client and user context will produce the effective policy.

the directory object in Active Directory under CN={GPO-GUID},CN=Policies,CN=System,DC=outreason,DC=example; GPO metadata and extension lists are stored here.

the Policies\{GPO-GUID} directory in SYSVOL; policy files and GPT.INI live on this file system surface.

an attribute of the Site, domain, or OU (SOM) object; the relationship that links a GPO to the target is stored here, not on the GPC.

manage the policy-aware setting of a Windows component; the result depends on that component's policy semantics.

configuration items processed by a client-side extension; they cannot be assumed to have the same rollback/application semantics as policy enforcement.

a command or script surface configured at specific processing phases such as computer startup/shutdown or user logon/logoff.

a definition/configuration item for Task Scheduler; a definition being present in a GPO is not proof that the task was successfully registered or ran on every endpoint.

A GPO not appearing on a target, appearing in the list, or not producing the expected result from a setting are not the same failure. This lesson separates scope first, then GPC/GPT version and access evidence, and finally client-side extension processing. A resultant policy report is a results list; a refresh attempt alone is not proof that deployment and every setting applied successfully.

Writable DC, Global Catalog (GC), and Read-Only Domain Controller (RODC) are not alternative labels for one role. Writable/read-only describes whether a directory replica accepts changes. A GC-role DC holds full writable replicas of the schema, configuration, and its hosted domain naming contexts, plus partial read-only replicas of other domains. RODC Password Replication Policy (PRP) separately governs password caching on that RODC. This lesson distinguishes these axes and the behavior when connectivity is unavailable.

schema, configuration, domain and application partitions each have their own replication scope.

a retained directory state that propagates a deletion to other DCs.

the destination DC stopped inbound replication from the named source partner after their last successful replication interval exceeded tombstone lifetime. This does not describe every partner or outbound path.

Different values on two DCs do not always indicate a failure. Separate version and originating stamps from local USN, and see how delay and conflict produce different outcomes.

coordinates forest-wide schema changes.

coordinates adding or removing domains and application partitions at forest scope.

allocates RID pools to DCs in each domain.

has specific responsibilities for password-change priority, account lockout coordination and the domain time hierarchy.

updates cross-domain object references; whether this work is needed depends on GC placement and the Recycle Bin feature.

stores the role holder’s NTDS Settings DN on the relevant directory object.

contains domain principals, the policy base and domain-local administration scope.

shares schema, configuration and the forest-wide trust/control plane.

forest-wide privileged groups located in the forest-root domain.

holds partial attribute sets for forest objects and connects domains for discovery.

grants administrative scope within a domain without creating a domain/forest security boundary.

has separate schema/configuration and a separate privileged control plane; adding a trust requires a separate access-path decision.

represents trust partner and relationship properties in the directory.

the trusted domain trusts the primary domain. Read the direction from the perspective of the domain containing the TDO.

the primary domain trusts the trusted domain.

combination of inbound and outbound bits, bidirectional trust.

allows trust path to expand in defined domain/forest hierarchy.

between certain two domains, non-transitive relationship; forest trust provides transitive coverage between two forest root.

a krbtgt/FOREIGN-REALM ticket that the local KDC can issue so the client can contact the target realm’s KDC.

directory data the KDC uses for cross-domain referrals and trust-key operations.

authorization data that can carry additional SIDs, including historical SIDs retained during migration.

trust-boundary processing that can remove SID classes from PAC authorization data or reject authentication, depending on the trust and SID class.

a trust mode that requires the principal to have the Allowed-to-Authenticate control-access right on the target object.

68b1d179-0d15-4d4f-ab71-46152e79a7bc.

the target object’s permissions determine whether an authenticated principal may perform the requested operation.

normally generated and retained by the requester; an explicitly configured key-archival workflow may send an encrypted copy to the CA for recovery.

included in the certificate request and carried in the certificate’s SubjectPublicKeyInfo; it can be distributed publicly.

covers the DER-encoded TBSCertificate; signatureAlgorithm and signatureValue are separate fields in the outer Certificate structure.

identifies the issuing CA; path construction uses issuer/subject relationships and other certificate information to find supporting certificates.

help identify issuer/key relationships when multiple CA certificates are candidates.

information supplied by the verifier’s path-validation configuration, commonly a trusted root but potentially another explicitly configured CA or peer trust.

CRL or OCSP status is obtained separately when required by the verifier’s application/profile policy; a certificate may advertise where to retrieve status information.

a directory object stored in AD DS; an Enterprise CA must also publish it in its own list before issuing from it.

the template determines whether the Subject is built from selected AD data or supplied in the request; review SAN behavior separately.

can carry structured identities such as dNSName, rfc822Name, or UPN-form otherName; the verifier decides which form it recognizes.

when present, limits the certificate to the listed purposes; the verifier’s usage policy also matters.

extended rights on the template object, granted through its security descriptor.

can hold a request for approval before issuance.

maintained for each CA; a template existing in AD DS does not mean every CA issues from it.

current KDC certificate-to-account mapping is a separate check; Subject/SAN or issuance alone does not prove strong mapping to a principal.

An AD DS directory object under Public Key Services in the Configuration naming context, with its own security descriptor. Read its permissions using AD ACL semantics, not filesystem semantics.

The control access right with CN Certificate-Enrollment, Display-Name Enroll, Rights-GUID 0e10c968-78fb-11d2-90d4-00c04f79dc55, and Applies-To PKI-Certificate-Template.

A separate control access right with rightsGuid a05b8cc2-17bc-4802-a710-e7c15ab866a2. It is distinct from Enroll and is represented by a separate ACE.

A bit field for enrollment and issuance behavior. CT_FLAG_PEND_ALL_REQUESTS (0x00000002) ordinarily makes the CA return a pending response and require CA manager approval. MS-WCCE documents a qualifying previous-approval renewal path where the CA ignores this flag.

Client and CA processing must be kept separate. MS-CRTD tells the client to include Subject information when CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x00000001) is set, or SAN information when CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME (0x00010000) is set. On the CA side, MS-WCCE says to ignore the ALT_NAME bit by itself; when ENROLLEE_SUPPLIES_SUBJECT is set, the CA uses the request's Subject and SAN information. The client flag alone does not prove that the CA will issue the requested SAN. Review the separate CA-wide SAN setting as well.

the request service and the CA's own security descriptor. Its Request Certificates permission is separate from Read/Enroll/AutoEnroll on the AD template object; the template's Enroll GUID does not represent this CA-level permission.

no strong mapping is modern39 or legacy41; SID mismatch is modern41 or legacy49. The legacy IDs apply to Windows Server2008 R2 SP1 /2008 SP2.

A secret, protected separately from the certificate, that enables the certificate's identity claim. The certificate is shareable data; access to the key and its export surface must be controlled separately.

The period bounded by the certificate's notBefore and notAfter fields.

Obtaining a new certificate near the end of its validity window. Reusing or regenerating the key pair is a separate decision.

A signed CA-issued structure listing revoked certificates and, when present, a nextUpdate time.

A CRL-entry extension (OID 2.5.29.21) that identifies the reason for revocation, such as keyCompromise (1). It does not by itself give the time of compromise.

An online request/response protocol for querying certificate status. It is a status-query path distinct from distributing a CRL; responses carry freshness information.

A separate CRL-entry extension (OID 2.5.29.24) that can carry the date when key compromise was known or suspected, or when a certificate otherwise became invalid. It can be earlier than the CRL revocationDate.

a directory service operated by the organization. Objects are kept in forest and domain naming contexts; clients use LDAP, Kerberos, and NTLM and receive configuration through Group Policy. Schema, replication, and DC operations belong to the organization.

cloud identity provider operating at the tenant border. It gives tokens to applications, and cloud controls such as Conditional Access are evaluated here. It is not a cloud copy of AD DS's LDAP/Kerberos/Group Policy surface.

a managed domain created with a unique namespace. Microsoft deploys and manages two Windows Server domain controllers as a replica set in the selected Azure region; customers don't deploy, configure, patch, or monitor those DCs. Entra ID is the source for identities synchronized into this managed domain.

an on-premises federation service configurable with Entra Connect. For federated sign-in, Entra ID delegates validation to a trusted authentication system such as AD FS; the organization operates the AD FS farm, WAP servers, and certificates.

Entra ID validates against synchronized password-derived data. Both Connect Sync and Cloud Sync support PHS. The detailed derivation and two-minute cycle below are documented for Connect Sync; they are not asserted as Cloud Sync implementation details.

the agent requests the unicodePwd value from a DC through the MS-DRSR replication protocol; the DC encrypts the MD4 hash using the MD5 hash of the RPC session key and a salt, then sends it to the agent. The agent expands the 16-byte hash to 64 bytes, adds a 10-byte per-user salt, and produces a 32-byte result with 1,000 iterations of PBKDF2/HMAC-SHA256. The per-user salt and iteration count are appended before the value is sent to Entra ID over TLS.

During sign-in to Entra ID, the password is verified directly against the on-premises Active Directory. A lightweight agent installed on on-premises servers performs the verification; The agent only opens an outbound connection and communicates with Entra ID using certificate-based authentication.

Entra ID delegates validation to a separate trusted authentication system, typically on-premises AD FS. The federation service issues a SAML assertion; Entra ID validates that assertion and then issues its own token. Federation can be chosen for requirements such as a third-party MFA provider that Entra ID doesn't support natively.

the on-premises provisioning agent talks to AD DS; the cloud provisioning service owns configuration, scheduling and orchestration. The agent initiates its Service Bus connection outbound. The architecture page’s two-minute scheduler description does not guarantee that an object appears in Entra ID within two minutes.

the device is registered with Entra ID, but an organizational account is not required to sign in to Windows. This is common for BYOD and mobile scenarios; ownership can remain with the user, who signs in with a local account. Registration alone does not enroll the device in MDM; device management and app protection are separate controls.

the device is joined to Entra ID; an organizational user signs in to Windows with an Entra account. Local accounts and applicable cached sign-in paths also exist; the join type does not establish online validation of every session. These devices are typically organization-owned; MDM and co-management are separate management configurations.

You can sign in to a cloud app, but an AD file share does not open. A Windows Hello credential, PRT, partial TGT, AD TGT and service ticket are distinct evidence. Compare three trust models against one resource goal.

a principal's security-group membership or nested-group path.

a DACL ACE for a specific object, property, or control-access right.

an observed, time-bounded session for a principal on a manageable target.

the separate authorization boundary required to perform a management operation on the target.

the SIDs in the token, the requested access, and the object's DACL are evaluated together.

a directory snapshot, session telemetry, and ACL may not represent reality at the same point in time.

authentication material such as a password, key, ticket, or certificate.

the ability to affect an operation or object through a token, ACL, or delegation.

the boundary at which identity and authorization information is accepted between security authorities.

verification of a principal's claim.

the decision about requested access for an authenticated principal.

the limited record produced by the system observing an event; it is not the whole mechanism.

obtaining TGS ciphertext for a service account tied to an SPN and the risk of offline key guessing.

forwarding an authentication exchange under the conditions required for the target service to accept it.

requesting replication-like directory data through the directory replication service protocol.

an observation of a KDC service-ticket operation.

an observation of a directory-object operation when a SACL is present; the Properties GUID provides essential context.

the technical or administrative state genuinely required for the finding to apply.

the object, principal, boundary, and time window affected.

data that directly supports the claim, with source and collection time recorded.

a deny, scope, control, or business requirement that limits the mechanism.

a change with an owner and verification criteria that reduces the risk assumption.

a level that keeps gaps in the mechanism, applicability, and impact evidence visible.

lower-plane identities must not manage the control plane, and control-plane identities must not be used on lower-plane productivity surfaces.

A trusted management path combines three boundaries: a separate administrator account for a high-impact role, use of that account only on a hardened PAW, and monitoring of the session's source and target context. A PAW is not a magic device; the trust chain breaks when productivity accounts, web/email exposure, or lower-plane sessions enter the same path.

a separate management domain that can provide console, snapshot, and disk access to a DC VM; guest AD ACLs do not by themselves constrain this plane.

backup server, repository, and restore-operator roles. Access to a backup copy is a recovery authority distinct from ordinary file permissions inside AD-managed systems.

the Enterprise CA, certificate templates, and enrollment-agent chain. A misconfigured template or weak private-key protection can produce identity material independently of a password.

RMM, monitoring, or patch-agent accounts and service channels. Track permissions separately between the host running the agent and the targets it manages.

evaluate non-TLS SASL signing/sealing, TLS-protected simple binds and channel binding for TLS with SASL under their respective conditions.

account for the challenge-response and relay surface; move from audit to deny only after mapping dependencies.

signing provides message integrity; SMB 3 encryption provides confidentiality and integrity on encrypted traffic and can supersede separate signing protection on that path. Signing alone does not provide confidentiality; behavior depends on protocol/version and configuration.

SPN, DNS, time, and ticket flow are required for the correct target identity; monitor fallback behavior separately.

A global security group defined in Active Directory. Membership imposes client-side restrictions on the Windows device where the member signs in; when the domain functional level is Windows Server 2012 R2 or later, it also imposes additional restrictions on the domain controller.

on supported Windows, NTOWF, long-term Kerberos keys and offline logon verifier are not cached; CredSSP/WDigest plaintext credential caching is prevented. DC-side protocol restrictions have a separate DFL prerequisite.

members cannot authenticate with NTLM, cannot use DES or RC4 for Kerberos pre-authentication, cannot be delegated through delegation (constrained or unconstrained), and their initial TGT lifetime is shortened in a way that cannot be renewed.

A Windows platform control. It uses virtualization-based security to keep LSA secrets in an isolated process; its goal is to prevent the NTLM password hash, Kerberos TGT, and domain credentials from being extracted from the operating system.

the Active Directory database itself, local and Microsoft accounts, third-party authentication packages, or attack classes such as physical access and keylogging.

A control that requests a second verification factor during sign-in on the Microsoft Entra ID side. It affects the token issuance decision; it does not inject an additional factor into an in-domain Kerberos ticket exchange or an NTLM session.

Advanced Audit Policy Configuration divides auditing into detailed subcategories under nine main categories. Event families depend on these subcategories, so a category-level statement does not identify which events are enabled.

When 'Audit: Force audit policy subcategory settings to override audit policy category settings' is enabled, subcategory settings override legacy category-based settings. If this setting is off, legacy policy can interfere with the intended detailed configuration.

Object-access auditing has two conditions. The audit subcategory must be enabled, and the object's SACL must contain an audit ACE for the relevant principal and access type. A matching SACL can audit successful or failed attempts according to its flags.

Kerberos authentication-service and service-ticket events are generated on domain controllers; searching for them on a client is looking at the wrong source.

Audit Directory Service Changes is logged only on domain controllers, requires a matching SACL on the relevant object or container, and covers create, delete, modify, move, and undelete operations.

Event 4719 reports system audit-policy changes. Event 4907 reports SACL changes on objects such as files or registry keys, but Microsoft says it is not generated for Active Directory objects. AD DS object changes may appear as Event 5136 when the subcategory and an attribute-specific Write Property audit ACE in the object’s SACL cover the change. None of these records alone proves the effective policy or SACL coverage on every object.

Session identifier generated on a login event and reappearing on subsequent events on the same machine. Records such as session closure and privilege usage are linked to the same session through this field.

The value is unique only to the computer that generated it and across reboots. Equal values ​​on different machines do not indicate the same session.

An identifier generated in sessions with Kerberos that can be mapped to Kerberos ticket events in the domain controller. It may not have any meaningful value in non-Kerberos sessions.

TGT and service ticket requests are recorded only on domain controllers; These records do not contain the session ID on the client side, the connection is established through different domains.

The event generated when a directory object changes carries information of the session that made the change and the changed attribute; The operation correlation ID groups records resulting from the same operation.

When an account initiates a transaction with another account's credentials, it is recorded in a separate event family and is one of the breaking points in the chain.

allows the client to resolve domain and DC service records appropriate for the site.

domain members take samples from the trusted source in the AD DS hierarchy and discipline the local clock.

the opposite end of the inbound/outbound exchange relationship for the specific naming context.

Which DC, naming context and time moment the observed directory state belongs to.

The enterprise, site or single server target of the dcdiag test and the function it tests.

Which of the discovery, authentication-time, transport or directory convergence layers is narrowed by evidence.

the value written in the directory, registry, GPO or service configuration.

the setting in effect on the target after scope, precedence, inheritance and local conditions have been evaluated.

an operation observed for a particular principal and target within a defined time interval.

operations visible within the audit-policy, SACL, collector, retention and query scope.

the system, time and method from which a record was collected.

describing the strength of a conclusion by distinguishing direct evidence, correlation and missing information.

affected identity, DC, domain, forest, admin tier, time window and dependent service set.

the conditions under which credentials, tickets, keys, privileged accounts and management workstations can be trusted.

a boundary that reduces spread or unauthorized access while preserving evidence and critical dependencies.

controlled separation of an investigated or recovered system from untrusted network and identity paths.

the dependency order of the identity control plane, name resolution, time, replication and business authentication.

an explicit threshold for revisiting containment or recovery when scope or evidence changes.

Restoring a deleted object, recovering a DC and rebuilding the identity control plane after a forest-wide failure are different problems. Choose the method by first identifying what was lost and which trust assumptions still hold.

record producer, time, identity and scope together.

it can explain the symptom but needs distinguishing evidence before acceptance.

it changes state owned by a particular actor; it does not refresh unrelated contexts automatically.

evaluate trusted identity state, new resource behavior and legitimate workflow separately.