# Active Directory

> Active Directory is Microsoft's directory service for managing users, computers, and policies in Windows networks. It is the central authentication and authorization backbone of most enterprise environments.

- **URL:** https://hackindex.io/platforms/active-directory
- **Type:** Platform
- **Tags:** active directory, windows, enterprise, authentication, ldap, privilege escalation
- **Published:** 2026-04-05
- **Updated:** 2026-09-14

Active Directory is Microsoft's directory service and the backbone of enterprise Windows networks. It manages authentication (Kerberos, NTLM), authorization (ACLs, GPOs), and identity (users, groups, computers, trusts) across domains and forests. Nearly every internal engagement touches AD, making it the highest-value target in corporate environments.

AD exposes a wide attack surface through its supporting protocols: Kerberos (ticket abuse, delegation attacks, AS-REP roasting), LDAP (object enumeration, ACL queries), SMB (relay, lateral movement), DNS (AD-integrated zones, internal hostname discovery), and MSRPC (remote procedure calls, DCSync). Misconfigurations in ACLs, delegation, certificate services (ADCS), and trust relationships frequently provide paths from low-privileged domain user to Domain Admin.

This section covers AD-specific attacks: enumeration of domain objects and relationships with BloodHound and LDAP queries, exploitation of ACLs, delegation, and certificate abuse (ADCS ESC attacks), lateral movement through ticket reuse and credential relay, privilege escalation via group membership and Kerberos delegation, and persistence through golden tickets, skeleton keys, and AdminSDHolder manipulation. Core tooling includes BloodHound, Impacket, Rubeus, and Certipy.

## Phases

- [Reconnaissance](https://hackindex.io/platforms/active-directory/reconnaissance.md): Discover AD domains, DCs, and users without credentials (2 guides)
- [Enumeration](https://hackindex.io/platforms/active-directory/enumeration.md): AD object, ACL, and attack path enumeration using BloodHound and more (5 guides)
- [Vulnerability Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery.md): Find ADCS flaws, password policies, and NTLM relay targets in AD (4 guides)
- [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md): AD exploitation guides covering Kerberos attacks, NTLM relay, ADCS, and DCS (24 guides)
- [Post-Exploitation](https://hackindex.io/platforms/active-directory/post-exploitation.md): AD post-exploitation: enum trusts, dump creds, abuse domain trusts (4 guides)
- [Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation.md): ACL abuse, Kerberos attacks, credential dumps, and operator group abuse (7 guides)
- [Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement.md): PTH, PTT, DCOM, and remote exec methods for AD lateral movement (5 guides)
- [Persistence](https://hackindex.io/platforms/active-directory/persistence.md): AD persistence via tickets, ACLs, shadow creds, and backdoor accounts (4 guides)