What will you learn?
Learn where identities live, how they are authenticated and who grants access. Explore the same system through Core, Red and Blue across 15 chapters and 82 lessons.
What do you need to start?
A browser and basic computer skills. Familiarity with Windows users, files and network addresses helps you start. Prior knowledge of SIDs, tokens, Kerberos or DACLs is not assumed; the lessons introduce them where needed.
Lessons, animations and browser practice do not require a paid VM or a Windows domain. The lab guide is optional if you want to observe real behavior in your own isolated environment.
1. Build identity and directory foundations · Chapters 01–04
Learn why accounts with identical names can have different identities. Examine Windows tokens and logon contexts, directory objects, SIDs and groups. Separate the responsibilities of DNS, LDAP and domain controllers.
Explain an example: who is the user, which authority owns the account, and which computer holds each piece of information?
2. Separate authentication from access decisions · Chapters 05–08
Follow permission evaluation, Kerberos messages and key ownership, NTLM contexts and account lifecycles. Authenticating an identity and granting resource access are separate decisions.
Change a condition: authentication succeeds, but the requested right is missing. Predict which step changes and what evidence you need, then compare your answer with the lesson practice explanation.
3. Read management and trust decisions · Chapters 09–12
Learn the boundaries of GPO, domain and forest trusts, AD CS and hybrid identity. Do not use the same evidence to claim a scheduled task definition arrived, the task registered and the task executed.
Track a certificate separately from its private key, a revocation observation separately from an existing session, and on-premises identity separately from a cloud decision.
4. Move from findings to defense and evidence · Chapters 13–15
Evaluate configuration findings with their assumptions. Build controls, monitoring and recovery decisions on an understanding of the system. Explain what an event supports and what it cannot prove by itself.
These foundations support Windows and identity administration, SOC and incident response, security configuration and authorized security assessments. The course alone does not establish professional qualification or authorize work in a real environment.
How do you use each lesson?
Read Core and step through the mechanism at your own pace. In Red, examine where a changed trust assumption or configuration affects the decision. In Blue, identify the control and the observation needed to verify it.
Read concrete artifact fields and two reality-checks, then complete the lesson practice. Combine lessons in cases. Look up unfamiliar concepts in the glossary and return to the related lesson. Local progress helps you preserve reading status and notes.
Browser outputs are deterministic teaching examples for the stated scenario. They are not real lab observations unless explicitly identified as records collected from a real environment. They do not connect to a real domain; browser choices do not change real accounts, tickets or permissions.
Show what you learned with a certificate.
Core, Red, Blue and Full Spectrum have separate assessments. Choose a perspective, read the assessment conditions and earn a Hacker Directory certificate by passing. Full Spectrum covers all three views of a mechanism.
Marking lessons as read does not earn a certificate. These certificates represent a Hacker Directory assessment, not an official Microsoft or other provider certification.