What Is Active Directory?

Active Directory (AD) is Microsoft’s directory service for Windows networks. It stores and manages information about user accounts, computers, printers, shared files, security groups, and permissions, and it authenticates users against that central record instead of each machine keeping its own list.

The full role name is Active Directory Domain Services (AD DS), and it runs on Windows Server. A server running that role is called a domain controller.

The problem it solves is administrative arithmetic. Without a directory service, an organization with 40 employees and 45 machines has to create and maintain accounts on every machine individually, which means a password reset touches dozens of devices. With AD, the account exists once and every domain-joined machine checks against it.

One naming point causes more confusion than anything else on this topic, so it is worth settling early. Active Directory is the on-premises product. Microsoft Entra ID is the separate cloud identity service that used to be called Azure AD. They are related but not the same thing, and the comparison section below covers where each one fits.

How Active Directory Works

Active Directory uses a tiered architecture that arranges network resources logically rather than physically. Five elements make up that structure.

• Domains: The primary building blocks, functioning as containers for objects like user accounts and computers. A domain establishes boundaries for administrative and security policies.
• Trees and forests: Domains are organized into trees, and trees into forests. A tree is a collection of one or more domains sharing a contiguous namespace. A forest is the largest AD container, consisting of one or more trees that share a common schema and global catalog.
• Organizational Units (OUs): Containers within a domain that group objects for administrative purposes, enabling granular policy application and delegation of administrative rights.
• Global catalog: A distributed repository holding a partial replica of every object in the forest, which is what makes forest-wide searches and logons possible without querying each domain separately.
• Trusts: Relationships that let users in one domain access resources in another. Parent and child domains are linked automatically, and trees within a forest trust each other by default.

A point that matters for security planning and gets stated incorrectly on most pages covering this: the forest, not the domain, is the security boundary. Separate domains within one forest do not isolate a compromise from each other. If you need genuine separation, you need a separate forest.

Authentication and authorization

Active Directory verifies identity and then decides what that identity may reach. Two steps, two different mechanisms.

Authentication uses Kerberos as the default protocol, with NTLM retained as a legacy fallback, and LDAP as the protocol applications use to query the directory itself. Once a user is authenticated, AD authorizes access to individual resources based on the permissions attached to their account and the security groups they belong to.

What Active Directory Does

Everything AD provides follows from one design decision: the record lives in one place. Six capabilities come out of that.

What this means: AD is less a security product than an administrative one. The security benefit is a side effect of consistency, and it only holds while the directory itself is well maintained.

Access control in regulated environments

Detailed permissions matter most where sensitive data carries legal obligations. Finance, healthcare, government, and legal work all require demonstrating who had access to what and when, which is a directory question rather than an application question. AD supplies the access records, and the compliance modules layered on top determine what has to be retained and for how long.

Active Directory vs Microsoft Entra ID

Microsoft renamed Azure Active Directory to Microsoft Entra ID in July 2023, and the stated reason was to reduce confusion with Windows Server Active Directory. The rename changed the branding only. All features, licensing, and configurations carried over untouched.

The important detail is what the rename did not cover. Active Directory Domain Services, AD FS, and the product name Active Directory were all unaffected. If you run domain controllers, you still run Active Directory. Only the cloud service was renamed.

Most organizations run both. The common pattern is on-premises AD as the authoritative source for domain-joined machines and internal applications, synchronized to Entra ID so the same identities work for cloud applications and remote sign-in. Microsoft Entra Domain Services, previously Azure AD Domain Services, sits between the two as a managed option offering domain services without running your own domain controllers.

Running both is where the practical benefits show up: one set of credentials across internal and cloud resources, multi-factor authentication and single sign-on applied consistently, onboarding and offboarding handled once instead of per system, and directory capacity that grows with headcount without an infrastructure redesign.

It is also where most of the risk shows up, because two directories mean two attack surfaces and one synchronization link between them.

Active Directory Use Cases

Single sign-on across internal resources

Users authenticate once and reach applications, file shares, and systems without re-entering credentials. Fewer passwords in circulation means fewer written down, and it removes the credential sprawl that makes account compromise easy.

Hybrid identity for cloud applications

Synchronizing on-premises AD to Entra ID extends existing accounts to cloud services, so the directory you already maintain governs access to SaaS applications too. This is now the default configuration in most businesses rather than an advanced one.

Disaster recovery and directory backup

The directory is not just a list of users. It holds group memberships, Group Policy Objects, trust relationships, and configuration state, all of which have to be restored for a network to function again. Recovering a domain controller is a specific discipline, and organizations that treat directory backup as ordinary file backup usually discover the difference at the worst moment. Directory state belongs in a backup and disaster recovery plan explicitly.

Audit evidence and compliance reporting

Change tracking and access logging inside AD produce the records auditors ask for under frameworks including GDPR and HIPAA. Logging has to be enabled and retained deliberately, since default retention is usually far shorter than any compliance requirement.

Active Directory Security: Why It Is the Primary Target

This is the part the standard explanation of Active Directory leaves out, and it has changed more than anything else about the topic.

Because every account, policy, and access decision flows through the directory, controlling it means controlling the network. Attackers worked this out some time ago and now go for it directly. Microsoft reported in April 2025 that a domain controller is breached in more than 78% of human-operated ransomware intrusions, and that in roughly 35% of cases the domain controller itself is the machine used to distribute the ransomware across the network.Mandiant puts Active Directory compromise in approximately nine out of ten intrusions it investigates.

The trend is going the wrong way for on-premises infrastructure generally. Netwrix found that 28% of organizations experienced a targeted attack on on-premises infrastructure in 2025, up from 19% in 2023.

What makes this difficult is that the common techniques exploit AD working as designed rather than software defects. Kerberoasting is the clearest example: an attacker with an ordinary user account requests a Kerberos service ticket for a service account, then cracks the ticket offline to recover the password. It requires no elevated privileges to start and leaves minimal traces in logs, because requesting a service ticket is legitimate activity (Microsoft, December 2025). Joint guidance published in September 2024 by CISA, the NSA, the ACSC, and other Five Eyes partners catalogues 17 such techniques.

The quotable version: Active Directory is rarely broken into. It is usually logged into, using credentials that were left more powerful than they needed to be.

Active Directory Best Practices

Generic advice is easy to write and hard to act on, so each item below names the specific thing to check.

• Audit privilege, not just access. Count how many accounts hold Domain Admin. In most organizations the number is several times higher than necessary, and every one of them is a full compromise if taken. Review service account permissions with the same scrutiny.
• Inventory your service principal names. Orphaned SPNs on unused accounts are a direct Kerberoasting surface. Service accounts with weak or non-expiring passwords are the ones that get cracked. Windows Server 2025 introduced Delegated Managed Service Accounts, which restrict an account’s use to a specific device.
• Structure OUs and naming conventions deliberately. Consistent OU design and group naming is what makes permissions auditable later. Ad hoc structure is how excessive permissions accumulate without anyone noticing.
• Enforce policy through GPOs, and monitor GPO changes. Group Policy is a strength and an attack path, since modifying a GPO is how ransomware reaches every domain-joined endpoint in one action. Log and alert on GPO modification specifically.
• Patch domain controllers on their own schedule. A domain controller running an unsupported or unpatched Windows Server build exposes the entire forest. Isolate domain controllers on their own network segment and restrict administrative access to dedicated systems.
• Back up directory state and test restoring it. Group Policy Objects, trust relationships, and configuration all need to come back, not just user objects. An untested directory restore is an assumption.
• Monitor authentication behavior, not just failures. Unusual Kerberos encryption types, group membership changes, and abnormal ticket requests are the signals that matter. SIEM monitoring exists to correlate them, since none of these is conclusive alone.
• Train the people with the keys. The techniques above depend on standing privilege and stale accounts, both of which are administrative habits rather than technical faults.

Where the domain controller lives

If a domain controller is involved in most ransomware intrusions, its hosting and recovery arrangements deserve more thought than they usually get.

V2 Cloud runs cloud servers that can host domain controllers, and cloud desktops that join an existing domain, which puts the directory and the machines authenticating against it in the same managed environment with daily backups and patched host infrastructure. Our IT infrastructure guide covers how this sits alongside the rest of the stack.

Being straightforward about the limit: moving a domain controller into a managed cloud does not harden Active Directory. Standing Domain Admin accounts, weak service account passwords, and unmonitored GPO changes travel with the directory wherever it runs. Hosting changes who patches the host and how recoverable the server is. The configuration work remains yours, and an advanced security pack supports it rather than replacing it.

Planning a Windows environment or moving domain-joined desktops into the cloud? Talk to a cloud expert about how it would map to what you run today, or see our pricing first.

Frequently Asked Questions

What is Active Directory used for?

Active Directory centralizes the management of users, computers, and permissions on a Windows network. It authenticates users, authorizes their access to resources, applies configuration through Group Policy, and provides the audit records needed for compliance reporting.

Is Active Directory the same as Microsoft Entra ID?

No. Active Directory is Microsoft’s on-premises directory service running on Windows Server. Microsoft Entra ID is a separate cloud identity service, renamed from Azure AD in July 2023. The rename did not affect Active Directory Domain Services or the Active Directory product name, and many organizations run both together in a hybrid configuration.

What is the difference between a domain, a tree, and a forest?

A domain is a container of objects such as users and computers that shares administrative and security policy. A tree is one or more domains sharing a contiguous namespace. A forest is one or more trees sharing a schema and global catalog, and it is the actual security boundary, which is why separating sensitive environments requires a separate forest rather than a separate domain.

What is a domain controller?

A domain controller is a server running the Active Directory Domain Services role. It holds a copy of the directory database, authenticates users, and enforces security policy for its domain. Most environments run at least two so that authentication survives one going offline.

What is Group Policy?

Group Policy is the mechanism AD uses to apply settings automatically to users and computers. Administrators create Group Policy Objects (GPOs) containing security settings, restrictions, or software deployments and link them to organizational units, and every affected machine applies them without being configured individually.

Why is Active Directory a target for ransomware?

Because control of the directory means control of every account and policy on the network, including the ability to push software to all domain-joined machines at once. Microsoft reported in April 2025 that a domain controller is breached in more than 78% of human-operated ransomware intrusions, and Mandiant places AD compromise in roughly nine out of ten investigated intrusions.

What is Kerberoasting?

Kerberoasting is an attack in which an ordinary domain user requests a Kerberos service ticket for a service account and then cracks it offline to recover that account’s password. It needs no elevated privileges and produces almost no unusual log activity, because requesting service tickets is normal behavior. Strong, rotated service account passwords and regular review of service principal names are the practical defenses.

Do I still need Active Directory if we use cloud applications?

It depends on what you run internally. Cloud-only organizations can often use Microsoft Entra ID alone. Businesses with domain-joined Windows machines, file shares, printers, or legacy applications that expect Kerberos or LDAP authentication generally still need Active Directory, synchronized to Entra ID for cloud access.