Ravi Sir's Cyber Security Cards › Revision Cards
AD Basics for Defenders
AD Basics for Defenders Active Directory (AD) is the Windows system that stores all users, groups and computers in a company. A Domain Controller (DC) is the server that runs it. Domain : one management area (example: sahyadri.lab). Kerberos : the login system that uses tickets, so you prove your pa
Read card text
What this card says
What it is
Active Directory (AD) is the Windows system that stores all users, groups and computers in a company.
A Domain Controller (DC) is the server that runs it.
Key terms
Domain: one management area (example: sahyadri.lab).
Kerberos: the login system that uses tickets, so you prove your password once.
Why it matters for security
The DC is the crown jewel. If an attacker controls it, they control every account.
Defence
Protect admin accounts (Tier 0). Patch the DC. Watch for odd logins and ticket requests. Test only in your own lab.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Maps domain users/groups via LDAP after any foothold | Monitor LDAP volume spikes; require LDAPS; disable… |
| Prefers Kerberos ticket theft / abuse over noisy password… | Enable advanced audit (Kerberos TGT/TGS); watch Event ID… |
| Looks for NTLM fallback hosts | Prefer Kerberos; disable NTLM where possible; SMB/LDAP… |
Learn more in the lesson: 38.1 AD Basics for Defenders