Active Directory (AD DS)

Active Directory Domain Services has been the directory service for Windows networks since Windows 2000: it stores users, groups, computers and policies, authenticates via Kerberos and replicates changes across all domain controllers in a domain. Windows Server 2025 raises the functional level for the first time since 2016 (domain and forest level 10) and introduces a 32K-page database as an optional feature; multi-valued attributes then hold roughly 3,200 values instead of the previous 1,200 or so — a factor of 2.6.

The switch is made forest-wide and requires every domain controller to be 32K-capable. Because AD is also one of the most common targets of credential attacks and lateral movement, how well it is hardened determines the security of the entire environment. That is exactly where Alendris starts: fine-grained password policies with 128-character passwords rotated automatically every day, Windows Hello for Business and YubiKey for passwordless sign-in, gMSA instead of static service accounts, privileged access exclusively through a jump host with PIM/PAM, and Defender for Identity for monitoring.