Active Directory Domain Services
The identity backbone of enterprise Windows: directory, Kerberos authentication, and Group Policy — and the highest-value target on any corporate network.
What is Active Directory Domain Services?
AD DS is the on-premises identity system most enterprises still run beneath everything else: a replicated LDAP directory of users, computers, and groups; Kerberos ticket-based authentication; DNS integration; and Group Policy pushing configuration to every domain-joined machine. Domain controllers replicate this state multi-master across sites. When a company says “log in with your work account,” on-prem, this is usually the machinery.
Why security teams obsess over it
AD is the skeleton key problem: whoever controls the domain controls every joined system, which is why ransomware operators head straight for it. The attack canon is mature — Kerberoasting (cracking service-account tickets offline), Pass-the-Hash, Golden Tickets (forged Kerberos via the krbtgt hash), DCSync (impersonating a domain controller to pull all password hashes) — and defenses are correspondingly specific: tiered administration (Tier-0 isolation for DC-touching accounts), long random service-account passwords or gMSAs, LAPS for local admin passwords, and monitoring for replication requests from non-DCs. An AD compromise assessment is standard incident-response scoping for a reason.
The cloud-era relationship
AD DS did not die; it federated. Entra ID (Azure AD) is a different product — OAuth/OIDC/SAML for cloud apps, no Group Policy or Kerberos-by-default — and most enterprises run hybrid: AD on-prem synced upward via Entra Connect, cloud SSO in front, legacy auth behind. AWS’s Managed Microsoft AD exists because lifted-and-shifted Windows workloads still expect a domain.
What people get wrong
- Flat admin models — daily-driver accounts with Domain Admin are the shortest path from one phish to total compromise.
- Stale objects: unused accounts and ancient trust relationships are standing attack surface; lifecycle hygiene is security work.
- Treating Entra ID as AD-in-the-cloud and discovering Group Policy, Kerberos, and OU semantics didn’t come along.
Primary source: Microsoft — AD DS documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.