In a nutshell Active Directory (AD) is how organizations manage Windows at scale: one central directory of every user, computer and group, with logins and policy handled in one place. It's the beating heart of almost every corporate network — and therefore the single biggest topic in real-world pentesting.
The problem AD solves
Ten computers you manage by hand. Ten thousand — with staff joining, leaving, changing roles — you cannot. AD centralizes users, computers, groups and permissions into one directory, so an admin sets a rule once and it applies everywhere. You log into any company machine with one account, because that machine asks AD.
Analogy — HR + reception combined. One central office knows every employee, their role, and which doors their badge opens. Change a role once, every door updates.
The vocabulary
| Term | What it is |
|---|---|
| Domain | the managed group of users/computers (corp.local) |
| Domain Controller (DC) | the server running AD — own it and you own the domain |
| Groups | bundles of permissions — Domain Admins is what you climb toward |
| OU | folders to organize objects and target policy |
| GPO | rules pushed to machines/users; misconfigured ones are an attack path |
Login via Kerberos, briefly
AD mostly authenticates with Kerberos, a ticket system: prove yourself once to the DC, get a ticket, then present tickets to services instead of your password. This underpins classic AD attacks you'll meet — Kerberoasting (grab a service's ticket, crack it offline) and Pass-the-Ticket / Pass-the-Hash (reuse stolen creds without the password — see Windows authentication).
Why it dominates pentesting
Breaking a company almost always means moving through its AD: a foothold on one machine, then account-to-account and machine-to-machine (lateral movement), escalating, until you reach Domain Admin and own the DC — and with it, everything.