500 Computers, One Problem
Picture a company with 500 machines and 500 employees.
Without something to tie them together, every machine is an island. Each keeps its own local users, its own passwords, its own rules.
Want to give someone access to ten machines? Make ten separate accounts.
Someone leaves the company? Hunt down every box they ever touched and delete them by hand.
Need to change a setting everywhere? Visit all 500.
It doesn’t scale. It’s a management nightmare.
One Directory to Rule Them All
Active Directory fixes this by putting one central directory at the heart of the network.
Every user, every computer, every group lives in one place: a database run by special servers called domain controllers.
Every machine joins the domain and agrees to trust that directory.
Now the chaos is gone:
- One identity per person, usable everywhere they’re allowed
- Sign in once and reach every resource you have rights to (single sign-on)
- Admins manage users, machines, and policy from a single console
Active Directory is the single source of truth for who exists and what they can do.
This is why nearly every company of any real size runs it. It is the backbone of the corporate network.
The Attacker’s Gift
Here’s the part that matters to us.
That same central design creates one enormous prize.
| You compromise… | You get… |
|---|---|
| a single local account | one machine |
| the directory itself | every machine that trusts it |
Own the domain controller, and you own the domain. Every user, every computer, every secret in the company.
That is the whole game. Start with a tiny foothold, and work your way inward toward the directory at the center.
To do that, you first have to understand how the pieces fit together. That’s what the rest of these foundations are for, starting with the shape of the domain itself.