Log in Request a demo

Glossary

Active Directory.

Also called AD, AD DS, Active Directory Domain Services

In Short

Active Directory is a directory service for managing identities in Windows domain networks, as NIST defines it. It holds the accounts of users, administrators and services, and it controls who can sign in to what. Because one set of credentials can often work across many systems, control of the directory gives an attacker wide reach, so it is a common target.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called3other namesAD · AD DS
  2. Related Terms3linked entriesLateral movement · Credential theft · Zero trust

What is Active Directory?

NIST defines Active Directory as a directory service for the management of identities in Windows domain networks. MITRE ATT&CK notes that domain accounts managed by Active Directory Domain Services span users, administrators and services across networked systems. In simple terms, it is a central list of who and what belongs to a network, and what each may do.

How does it work?

An organization keeps its accounts in the directory. Computers in the domain can use it to check a sign-in, so one set of credentials can often work across many systems. This is general background rather than a technical description of its internals.

Why does it matter for security?

MITRE says adversaries can use domain account credentials for initial access, persistence, privilege escalation or defense evasion, and that they can obtain such credentials through methods like OS credential dumping or password reuse. Reasoning from this, control of the directory can give an attacker wide reach, so protecting it matters.

How can you reduce the risk?

MITRE lists these mitigations for domain accounts.

  • Use multi-factor authentication to reduce the risk from compromised credentials.
  • Use strong, complex, unique and regularly rotated passwords.
  • Audit domain account permissions regularly, and avoid placing user or admin accounts in local administrator groups unless tightly controlled.
  • Review accounts regularly and remove inactive ones.

MITRE says routine audits of domain account permissions help identify excessive access, and that reviewing and removing inactive accounts limits chances for abuse. It also says strong password policies reduce exposure to guessing and credential stuffing, which is when stolen logins are tried against other services.

How can you detect misuse?

MITRE suggests watching for suspicious logon patterns, such as access to multiple hosts, off-hours activity, and simultaneous sessions from geographically distant places. Sensitive systems deserve extra attention.

Is Active Directory the same as a domain?

No. A domain is a group of computers and accounts managed together. Active Directory is the service that stores and manages the identities for it.

Is Active Directory the same as a cloud identity service?

This page covers the Windows domain service named in the NIST definition. Cloud identity services are separate products and are not described here.

See also lateral movement, credential theft and zero trust.

Sources

  • NIST: NIST glossary definition of Active Directory.
  • MITRE ATT&CK: MITRE ATT&CK on domain accounts, mitigations and detection.

Also Called.

  • NameAD
  • NameAD DS
  • NameActive Directory Domain Services

Questions.

  • What is Active Directory?

    NIST defines Active Directory as a directory service for the management of identities in Windows domain networks. In simple terms, it is a central list of who and what belongs to a network, and what each may do.

  • Why do attackers target Active Directory?

    MITRE says adversaries can use domain account credentials for initial access, persistence, privilege escalation or defense evasion. Control of the directory can give an attacker wide reach.

  • How can you reduce the risk of Active Directory misuse?

    MITRE lists multi-factor authentication, strong unique passwords, regular audits of domain account permissions, and removing inactive accounts. Avoid placing user or admin accounts in local administrator groups unless tightly controlled.

  • Is Active Directory the same as a domain?

    No. A domain is a group of computers and accounts managed together. Active Directory is the service that stores and manages the identities for it.

In Our Research

  1. 1 GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. 2 Akira ransomware advisory AA24-109A: stages and tools October 2026
  3. 3 Volt Typhoon advisory AA24-038A: what CISA says October 2026
  4. 4 Initial access techniques: all 11 in MITRE ATT&CK October 2026
  5. 5 UK retail attacks 2025: lessons for retailers October 2026
  6. 6 Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026

Keep Exploring.

Knowledge Hub
Article The Breakout Window: How Long Does An Attacker Have Inside Your Network? Breakout time vs dwell time explained: how long attackers stay hidden, how fast they reach a second system, and why defenders have so little… Open Glossary term Kerberoasting Kerberoasting is an attack on Windows Active Directory in which an attacker who already has a valid domain login asks for service tickets and then tries to crack them offline to learn a service account password. Open Article How Attackers Use Stolen Credentials: The Complete Account Takeover Lifecycle Account takeover lifecycle for defenders: how combolists, infostealer logs, credential stuffing tools and session hijacking turn stolen logins into access. Open Threat group Andariel Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term. Open

Browse The Library.