Extended Active Directory (AD) Terminology
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- Forest – The highest logical structure in AD, containing one or more domains. - Domain – A logical grouping of users, computers, and resources managed under a single security boundary. - Organizational Unit (OU) – A container within a domain used for organizing users, computers, and policies. - Trusts – Relationships between domains allowing resource sharing and authentication. - RID (Relative Identifier) – A unique value assigned to each object within a domain, forming part of the SID. - FSMO Roles (Flexible Single Master Operations) – Specialized roles ensuring AD consistency: - Schema Master – Maintains schema updates across the forest. - Domain Naming Master – Manages domain additions and removals in the forest. - RID Master – Allocates RIDs to domain controllers. - PDC Emulator – Handles password changes, replication, and legacy system compatibility. - Infrastructure Master – Maintains object references across domains. - Replication – Synchronization of AD data across domain controllers. - SYSVOL – A shared folder containing Group Policy and logon scripts, replicated across DCs. - SAM (Security Account Manager) – A database storing user credentials on local systems. - KRBTGT Account – A special account responsible for Kerberos ticket generation. - TGT (Ticket Granting Ticket) – A Kerberos ticket used to request service tickets. - TGS (Ticket Granting Service) – Issues service tickets based on a valid TGT. - Shadow Credentials – Abusing AD Certificate Services (AD CS) to forge authentication. - SID History – Stores previous SIDs of migrated objects to maintain access. - AdminSDHolder – A security mechanism protecting privileged accounts from unauthorized modifications. - DSRM (Directory Services Restore Mode) – A recovery mode for restoring Active Directory. - GPP (Group Policy Preferences) – Legacy settings that sometimes expose plaintext credentials. - NTDS.dit – The Active Directory database file containing password hashes and directory information. - ZeroLogon – A vulnerability allowing privilege escalation by exploiting Netlogon. - Kerberoasting – Extracting and cracking Kerberos service tickets to reveal plaintext passwords. - AS-REP Roasting – Exploiting users with disabled pre-authentication to retrieve encrypted credentials. - LAPS (Local Administrator Password Solution) – A security feature that manages local admin passwords on domain-joined machines. - RBCD (Resource-Based Constrained Delegation) – A Kerberos feature often abused for privilege escalation. - SDProp (Security Descriptor Propagation) – Ensures inherited permissions are applied correctly in AD. - MS14-068 (Forged PAC Attack) – A vulnerability allowing domain admin privilege escalation.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of Extended Active Directory (AD) Terminology during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to Extended Active Directory (AD) Terminology.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| III. Domain Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |