DB.
Courses

Active Directory: Introduction and Enumeration
OSCP · Chapter 17

Active Directory: Introduction and Enumeration

Active Directory (AD) is the identity and access backbone of most enterprise Windows networks. Understanding its object model — domains, forests, users, groups, and trust relationships — is the prerequisite for every AD attack technique that follows.

Key concepts

  • Core objects: domain controllers hold the directory database; users and computers are objects with security identifiers (SIDs); groups grant nested permissions.
  • Enumeration tools like BloodHound turn raw AD data into an attack-path graph, showing exactly which low-privileged user can reach Domain Admin and how.
  • Kerberos is AD's default authentication protocol — tickets (TGT/TGS) replace direct password exchange, which is why ticket-based attacks (later chapters) are so powerful.
  • A single misconfigured ACL or nested group membership can silently grant far more access than intended — enumeration is often more valuable than exploitation here.

Example

# Basic unauthenticated enumeration
nmap -p 389,445,88 --script ldap-rootdse 10.10.10.100

Try it yourself

In an AD lab (e.g. a HackTheBox or TryHackMe AD box), run BloodHound's collector (SharpHound) with a low-privileged user's credentials and identify one attack path to Domain Admin in the resulting graph.

ReferenceSearch video walkthroughs

@ Daniel Burlacu