Active Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a Windows domain. It authenticates with Kerberos, falls back to NTLM, and exposes its directory over LDAP.
Active Directory has been the centre of enterprise identity since 2000 and remains so at most organizations, including those that consider themselves cloud-first: the cloud tenant is usually synchronized from it, which makes the on-premises domain a path into the cloud one. That hybrid seam is where a large share of real intrusions travel. Entra ID is a separate product with a different model, not a hosted version of Active Directory, and conflating the two causes both architectural and security mistakes.
See also: Kerberos, LDAP, NTLM, primary refresh token theft, best ITDR for Active Directory
Related on Start with Identity
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- ExpertEntra ID and Active Directory researcher
Dirk-jan Mollema researches Microsoft identity from the outside and writes the tooling to prove his findings: ROADtools for Entra ID, mitm6 and krbrelayx for re