active directory 101

TLDR;

1. Let's start with a domain; say (kashz.com)

2. Hierarchy of domains forms a tree.

• (kashz.com)

  • (writeups.kashz.com)

  • (jewels.kashz.com)

1. Different trees together forms a forest.

Inside a domain:

1. Organization Units (OUs) - collection of objects.

2. Objects can be any of the following:

   1. User

   2. Contact

   3. Groups

   4. Computers

   5. Printers

   6. Shared Folders

Long Explanation

Active Directory consists of

1. 1 or more Domain Controller (mainly for fault tolerance)

2. 1 or more storage servers / user workstations

Domain Controller

• has the AD domain services data store installed

• promoted to a domain controller in the forest

• center of Active Directory; controls the rest of the domain

• handles authentication and authorization services

• replicate updates from other domain controllers in the forest

• allows admin access to manage domain resources

AD DS data store

• Contains the NTDS.dit well as password hashes for domain users

• Stored by default in %SystemRoot%\NTDS

• accessible only by the domain controller

Default Paths

• Database folder: C:\Windows\NTDS

• Log files folder: C:\Windows\NTDS

• SYSVOL folder: C:\Windows\SYSVOL

Forest

Collection of one or more domain trees inside an Active Directory network. It can contain:

• Trees - A hierarchy of domains in Active Directory Domain Services (collection of domains)

• Domains - Used to group and manage objects

• Organizational Units (OUs) - Containers for groups, computers, users, printers and other OUs

• Trusts - Allows users to access resources in other domains

• Objects - users, groups, printers, computers, shares

• Domain Services - DNS Server, LLMNR, IPv6

• Domain Schema - Rules for object creation

User + Groups

Default DC comes with default groups and two default users: Administrator and guest.

Users

Four main types of users:

• Domain Admins - control the domains and are the only ones with access to the DC

• Service Accounts - for service maintenance

• Local Administrators - can login to local machines as administrators; cannot access the DC

• Domain Users - Normal users who can log in to machines they have the authorization to access.

Groups

Allows giving permissions to users and objects by organizing them into groups.

• Security Groups - specify perms for a large number of users

• Distribution Groups - specify email distribution lists.

Default Security Groups

• Domain Controllers - All domain controllers in the domain

• Domain Guests - All domain guests

• Domain Users - All domain users

• Domain Computers - All workstations and servers joined to the domain

• Domain Admins - Designated administrators of the domain

• Enterprise Admins - Designated administrators of the enterprise

• Schema Admins - Designated administrators of the schema

• DNS Admins - DNS Administrators Group

• DNS Update Proxy - DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers).

• Allowed RODC Password Replication Group - Members in this group can have their passwords replicated to all read-only domain controllers in the domain

• Group Policy Creator Owners - Members in this group can modify group policy for the domain

• Denied RODC Password Replication Group - Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain

• Protected Users - Members of this group are afforded additional protections against authentication security threats.

• Cert Publishers - Members of this group are permitted to publish certificates to the directory

• Read-Only Domain Controllers - Members of this group are Read-Only Domain Controllers in the domain

• Enterprise Read-Only Domain Controllers - Members of this group are Read-Only Domain Controllers in the enterprise

• Key Admins - Members of this group can perform administrative actions on key objects within the domain.

• Enterprise Key Admins - Members of this group can perform administrative actions on key objects within the forest.

• Cloneable Domain Controllers - Members of this group that are domain controllers may be cloned.

• RAS and IAS Servers - Servers in this group can access remote access properties of users

Trusts + Policies

Trusts

Specify the way that the domains inside a forest communicate to each other.

• Directional (A -> B)

• Transitive (A -> B -> C so A -> C)

Policies

Dictates how the server operates and what rules it will and will not follow.

AD Services

Default domain services:

• LDAP - provides communication between applications and directory services

• Certificate Services - allows the domain controller to create, validate, and revoke public key certificates

• DNS, LLMNR, NBT-NS - Domain Name Services for identifying IP hostnames

AD Auth

Windows

• Kerberos - default auth service for AD; uses ticket-granting tickets and service tickets to authenticate users and give users access to other resources across the domain.

• NTLM - default Windows auth protocol uses an encrypted challenge/response protocol

Linux

• RADIUS Protocl

• LDAP

Reference

TryHackMe AD Room