Active Directory → All Active Directory articles
LDAP is the query interface to Active Directory. Every AD tool speaks LDAP under the hood. Understanding raw LDAP lets you enumera…
Write access to a GPO linked to Domain Computers OU is code execution on every workstation. Write access to a Domain Controllers O…
Getting Domain Admin is step one. Keeping access through a Blue Team response is step two. Golden Tickets survive password resets …
Purple teaming is collaborative security testing where red and blue teams work together in real time. The red team executes a tech…
Active Directory doesn't just use DNS — it IS DNS. DC locator queries are SRV-based, Kerberos requires DNS, replication uses hostn…
Group Policy is how Windows domains enforce configuration on every machine and user. It is also one of the most abused attack prim…
AD's permission model controls who can do what to every object. ACE misconfigurations are behind most unintended privilege escalat…
Detecting AD attacks requires knowing which Event IDs matter, how to write Sysmon configs that catch lateral movement, and how to …
AD tiering is the architectural approach that breaks the lateral movement chain by preventing credentials from crossing privilege …
Microsoft Defender for Identity (MDI) is the cloud-powered behavioral detection platform for Active Directory. Its sensors sit on …