Active Directory

Active Directory: Microsoft directory service for the centralized managementCentralized ManagementAdministration of distributed systems or controls from a common management plane. of identities and resources. The term is central to identity and access controls. In practice, clear policies, loggingLoggingThe recording of security-relevant events so activity can be monitored, investigated, and audited., regular reviews, and the strongest possible authentication are crucial.

The environment is organized into forestsActive Directory ForestTop-level Active Directory structure whose domains share a schema, configuration, global catalog, and mutual trust foundation., treesActive Directory TreeHierarchy of one or more Active Directory domains with a contiguous DNS namespace and transitive trusts., and domainsActive Directory DomainLogical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.; domain controllersDomain ControllerServer running Active Directory Domain Services that replicates directory data and supports authentication and authorization for a domain. replicate directory objectsActive Directory ObjectActive Directory entry representing an identity, resource, or structure through an object class and associated attributes. and provide services including KerberosKerberosTicket-based protocol for secure authentication in insecure networks. and LDAPLightweight Directory Access ProtocolProtocol for querying and modifying distributed directory services..

How it works and where it fits

Active Directory separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

Related concepts

• Active Directory DomainActive Directory DomainLogical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.: Logical Active Directory partition with a shared directory database, namespace, policies, and domain controllers.
• Active Directory ForestActive Directory ForestTop-level Active Directory structure whose domains share a schema, configuration, global catalog, and mutual trust foundation.: Top-level Active Directory structure whose domains share a schema, configuration, global catalog, and mutual trust foundation.
• Domain ControllerDomain ControllerServer running Active Directory Domain Services that replicates directory data and supports authentication and authorization for a domain.: Server running Active Directory Domain Services that replicates directory data and supports authentication and authorization for a domain.
• Active Directory ObjectActive Directory ObjectActive Directory entry representing an identity, resource, or structure through an object class and associated attributes.: Active Directory entry representing an identity, resource, or structure through an object class and associated attributes.