Active Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a Windows domain. It authenticates with Kerberos, falls back to NTLM, and exposes its directory over LDAP.
Active Directory has been the centre of enterprise identity since 2000 and remains so at most organizations, including those that consider themselves cloud-first: the cloud tenant is usually synchronized from it, which makes the on-premises domain a path into the cloud one. That hybrid seam is where a large share of real intrusions travel. Entra ID is a separate product with a different model, not a hosted version of Active Directory, and conflating the two causes both architectural and security mistakes.
See also: Kerberos, LDAP, NTLM, primary refresh token theft, best ITDR for Active Directory, directory service
Related on Start with Identity
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as