Defending Active Directory

Defending Active Directory is attack-informed defense: you learn each attack against a modern domain from both sides, what the adversary does and what it leaves in the evidence, then how to detect and analyze it. This orientation covers what Active Directory is, why it is attacked, its attack surface, the common paths to compromise, and the architecture and modern context you need before the hands-on detection begins.

The threat landscape for Active Directory and the defensive doctrine that answers it.

A current, defender-led survey of how Active Directory is actually attacked: enumeration and recon, credential attacks, Kerberos roasting, ticket forgery and delegation abuse, privilege escalation and persistence, AD CS certificate abuse, the hybrid seam into Entra ID, and the network-side vectors. Eight subs, each carrying one runnable detection against the Northgate corpus, so you leave knowing what each attack does, what it records, and how you would catch it.

Reconnaissance is the phase you cannot see in native logs, and the one that decides everything after it. How attackers read the directory with LDAP and SAMR, how BloodHound turns that into a shortest path to Domain Admin, why Windows records almost none of it, and the two defenses that actually work: posture (tiering, ACL hygiene, attack-path management) and Microsoft Defender for Identity. Five subs, one runnable detection, grounded in the Northgate corpus.

The machinery Active Directory uses to prove identity and grant access is the single largest attack surface in the enterprise, and almost every AD intrusion is an abuse of it working as designed. This module maps that surface as one domain: the authentication and access concerns, the protocols, where credentials live and how they are protected, the attacks that target the machinery, access control and authorization, hardening, the hybrid seam to Entra, and detection.

A stolen credential does not need to be cracked to be used. This module is the deep treatment of credential theft and replay: where credentials live and how they are lifted, pass-the-hash, pass-the-ticket and overpass-the-hash, the BadSuccessor dMSA takeover, the exact logon events each one leaves, how to reconstruct one credential moving across hosts, and a capstone that works the whole intrusion.

Most Active Directory privilege escalation is not an exploit, it is the abuse of delegation and directory write rights the domain already grants. This module is the deep treatment: the delegation spectrum from unconstrained to resource-based, the attribute writes that hand out power, the 5136 directory-change event that is the defender's through-line, a full escalation reconstructed from the evidence it left, and one consolidated detection set.

Domain dominance is the point where an attacker stops escalating and starts owning the directory: replicate its secrets with DCSync, forge the tickets the domain trusts with the stolen krbtgt key, and write themselves persistence that survives the cleanup.

Active Directory Certificate Services is a second set of keys to the domain, and coercion is the trick that forces a domain controller to authenticate where an attacker wants.

On-prem Active Directory and Entra ID are one trust boundary stitched together by synchronization, and the seam between them is how an attacker who owns the domain reaches the cloud. This module is the crossing: the pivot where a synced privileged identity signs into the cloud, the Entra Connect bridge that runs both ways, and the single-sign-on and federation keys that forge cloud identity wholesale.

Detecting a domain compromise is half the job; this module is the other half. Analyst-seat Active Directory incident response worked against the reconstructed Northgate intrusion: scope past the alert queue, contain without tipping the attacker, eradicate the keys the attacker forged from rather than the passwords, decide whether the domain can be cleaned or must be rebuilt, and separate fixing the vulnerability from evicting the adversary.

The course's two halves on one intrusion. You are handed an open incident cold and reconstruct the whole Northgate compromise from the evidence: a phished foothold, Kerberoasting, a lateral move, directory-write escalation, DCSync and a golden ticket, a forged certificate and a Domain Admins addition, spooler coercion, and a pivot into the cloud. Then you run the response end to end, eviction, the rebuild decision, and the paths closed last.

The question, the query, what a hit means, and what the check does not prove, one sheet per attack stage.

Ordered procedures for the Active Directory hardening that recurs, each with the breakage it causes named up front.

A domain built with the misconfigurations this course finds, where you can run the attacks and watch what they leave behind.

Active Directory work reasoned end to end, including the cases where the finding was already there and the ones that end in doing nothing.

What to do when a detection fires or somebody asks: DCSync, ticket forgery, a coerced authentication, a delegation change, a locked-out estate.

Every practice surface available for this course, what each one gives you, and where the gaps are.

Microsoft Active Directory and identity documentation, MITRE ATT&CK techniques, security frameworks and standards, threat-intelligence research, and hardening and recovery guidance used throughout the Defending Active Directory course.

You've reached the end of Defending Active Directory. This closing module looks back at what you built across the course, how it changed the way you read an alert, and where to take the work next.