Active Directory

Active Directory Domain Services helps organizations manage accounts, computers, groups, and policy. A relationship graph is a useful model: it can show who belongs to a group, which group can access a resource, and who may change an object. The graph includes resources and policy objects as well as identities.

This overview connects the vocabulary used in the shorter lessons. The goal is to understand intended access and identify relationships that grant more authority than a job requires.

Domains, forests, and controllers

A Domain is an administrative and directory partition, commonly associated with a DNS name such as corp.example. A Domain controller hosts directory data and supports authentication and related services. It is an important server, not the whole directory environment. Multiple controllers can support the same domain.

A Forest can contain multiple domains with shared schema and configuration. In the AD DS design, the forest is the overarching security boundary; a separate domain within the same forest is not complete isolation from forest-level administration. Trusts and external relationships still require their own security design.

Organizational units help organize objects and delegate administration. They do not automatically provide isolation merely because objects appear in different folders.

Read each kind of relationship

A membership arrow is not the same as a permission grant. An ACL describes access or auditing entries on an object. Delegation, trusts, ownership, and application permissions have additional rules. A graph must retain those distinctions instead of treating every arrow as unrestricted control.

Directory information is often readable so normal authentication, discovery, and administration can work. Visibility alone is not proof of excessive access. Sensitive attributes and modification rights need protection appropriate to their purpose.

A powerful group can nevertheless deserve close review. Backup Operators in AD has significant backup and restore rights on domain controllers. The group name alone does not prove a particular data read or domain compromise; scope, effective rights, and evidence still matter.

A person leaves one team. Is removing one group membership enough?

Possibly, but nested groups, direct grants, other roles, and existing security contexts may preserve access. Review effective permissions and the lifecycle of sessions or tokens before concluding that the intended access ended.

Tickets authenticate; resources authorize

Kerberos allows authentication to services without sending those services the user’s password. A client uses a ticket-granting ticket, or TGT, to obtain an appropriate service ticket. It presents the service ticket to its intended service; the TGT is not a universal application ticket.

The service must still apply authorization. Valid authentication does not grant access to every file or administrative operation. NTLM uses a different challenge-response design and remains relevant in some environments. The protocol actually used should be identified rather than inferred from the presence of a domain.

Connect concepts to defensive review

• Enumeration explains how authorized observations describe directory structure.
• Permission paths connect relationships to their possible authority and preventive controls.
• Lateral access and persistence concepts examine where identities can be used and how access survives changes.

A useful finding identifies the object, relationship, intended job, effective authority, and supported consequence. It separates verified behavior from possibilities that remain untested. A correction might narrow membership, protect delegated administration, constrain a service identity, or improve access removal.

After a change, confirm both that necessary work still succeeds and that unintended access has ended. This makes the graph a practical tool for maintaining permissions over time.

Worked review: a job change is a relationship change

The fictional Cedar archive supplies these records. Both groups are security groups in the same domain, nesting is valid, and the exercise uses a fresh security context. No direct grant, other membership, deny, or extra access restriction affects the folder decision.

D1: Eva belongs to the global group Exhibitions. Exhibitions belongs to the domain-local group ArchiveReaders.

D2: ArchiveReaders has read permission on the Catalog folder. That permission grants no content modification.

D3: Eva has moved to Visitor Services. The owner says her new job needs the public schedule, but no Catalog access. Exhibitions colleagues still need Catalog.

PredictShould the owner remove ArchiveReaders’ folder permission to end Eva’s old access?

That would remove required access for colleagues too. Under the stated assumptions, Eva’s membership in Exhibitions is the narrower relationship to remove. The two membership links explain why the folder grant reaches her; neither membership link is itself the folder ACL.

The directory administrator should record the approved membership correction. The resource owner then checks the intended result using a fresh context: Eva cannot read Catalog, while a current Exhibitions colleague still can. The directory update and successful verification are different pieces of evidence.

Existing sessions require a separate lifecycle decision. Group information already represented in a token or application session may not change immediately, and other products may maintain their own grants. Define which sessions the removal process covers and when the owner expects access to end.

This small graph also shows why organizational charts are insufficient. Eva’s new department label expresses business intent; effective access follows implemented relationships and the resource’s policy. A controller records directory changes and participates in authentication, while the folder’s access decision still concerns its own permissions.