> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/active-directory/fundamentals.md). # Active Directory Fundamentals Active Directory security notes for Active Directory Fundamentals, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps. {% hint style="info" %} Active Directory stores information about a network's resources and makes it easy for users and administrators to organize, find, and manage them. It uses a structured data store as the basis for a hierarchical organization of information. This store is called **directory**. {% endhint %} Resources stored in Active Directory typically include: * Serveurs * Imprimantes * User accounts * Network equipment In addition to information storage (database), Active Directory is made up of a set of services. #### Active Directory Domain Services (AD DS) AD DS corresponds to a set of services that control different operations in an IT environment: * **Authentication**: guarantees that each entity is who it claims to be * **Authorization**: guarantees that each entity has access only to the data and services that are authorized to it * **Name resolution**: allows communication between network elements via names * **Centralized management**: allows the application of group policies (Group Policy) ### Active Directory Structure The main elements of the logical structure of Active Directory are: * **Forests** * **Domaines (Domains)** * **Organizational Units (OU)** #### Forest A forest is the highest organizational level in Active Directory./ Each forest shares a unique directory and represents a security boundary. #### Domains Forests can contain one or more domains. #### Organizational units (OU) Domains can contain one or more organizational units. ### Data storage Domain and organizational unit information is stored on a specific **domain controller**. This storage is called **Data Store**. Information is stored as **objects**./ All objects are defined by a **schema**, and the directory checks the validity of the data based on this schema. ### What is a domain? A domain is a **logical partition of objects** within a forest that share common administration, security, and replication configurations. Concretely, a domain: * Guarantees the identity of a user across the entire network * Provides authentication services * Provides authorization services * Allows information to be replicated between different domain controllers and managed as a single unit * Allows the creation of trust relationships between domains ### What is an organizational unit (OU)? An organizational unit (OU) is a **container object** that allows you to organize other objects within a domain. It has three main functions: * Allows organized visualization of domain objects * Groups objects to which group policies can be applied (Group Policy) * Allows you to group objects in order to delegate management rights to other users or groups in the domain ### Schema Active Directory (AD Schema) Everything stored in Active Directory is represented as **objects**./ The **schema** defines the attributes of each object type. Main features: * Only one schema is defined per forest * A copy of the schema is present on all domain controllers in the forest, ensuring consistent object definition * The **Data Store** uses schema to ensure data integrity Result : All objects are created uniformly, regardless of which domain controller creates or modifies them. ### Active Directory Data Store The **Data Store**, generally called **directory**, stores all the information concerning the objects in the forest: * Users * Groups * Computers * Domaines * Organizational Units (OU) The directory is stored on **domain controllers** and can be accessed by applications and network services. If there are multiple domain controllers, each has a **full copy of the directory** containing all the domain information. *** ### Data Store Components #### Interfaces Interfaces such as **LDAP**, **REPL**, **PAMI**, and **SAM** provide means of communicating with the database. #### DSA (Directory System Agent) The **DSA** allows: * To access the directory * To maintain the pattern * To guarantee the identity of objects * To impose the data types of the attributes #### Database Layer The **database layer** is an API that serves as an interface between applications and the directory. It prevents applications from interacting directly with the database and manages access to individual directory records. #### Database files Directory information is stored in a **single database file**. In addition, **log files** are used to: * Manage transactions * Ensure recovery in the event of an incomplete or failed transaction --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/active-directory/fundamentals.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.