Active Directory (AD DS)
Active Directory Domain Services (AD DS) is Microsoft's on-premises directory service for Windows networks: it manages users, groups, computers and policies within a domain and authenticates them via Kerberos, LDAP and DNS. Introduced with Windows 2000, AD DS is still the root of all permissions in most mid-market environments — and therefore a preferred target for attackers. It is not the same as Entra ID, the cloud identity service; the two are joined through hybrid identity.
Active Directory (AD DS) in practice
Whoever controls the domain controls the company, which is why attacks after initial access almost always turn to Active Directory: pass-the-hash, Kerberoasting, lateral movement via local administrators, abuse of service accounts whose passwords never rotate. Hardening addresses the same points: fine-grained password policies for differentiated rules, group managed service accounts (gMSA) with automatically rotating passwords instead of static service accounts, tiering of privileged accounts, administrative access exclusively through a hardened jump host with PIM/PAM instead of standing admin rights, and passwordless sign-in via Windows Hello for Business or FIDO2 security keys.
Microsoft Defender for Identity continuously monitors the domain for exactly these patterns. Technically AD DS has used an ESE database with 8 KB pages since Windows 2000; Windows Server 2025 introduces a 32 KB page format under which multi-valued attributes can hold roughly 3,200 values instead of around 1,200. It is an optional feature that has to be enabled deliberately: functional level 10 requires every domain controller in the forest to run Windows Server 2025, in-place upgraded domain controllers keep their 8 KB format, and the move to 32 KB pages is forest-wide and irreversible.
Alendris hardens Active Directory environments as part of its infrastructure work — in one customer project the underlying passwords rotate daily at 128 characters via fine-grained password policies, so nobody knows their own password any more and sign-in is passwordless.