Active Directory.

What Is Active Directory?

NIST defines Active Directory as a directory service for the management of identities in Windows domain networks. MITRE ATT&CK notes that domain accounts managed by Active Directory Domain Services span users, administrators and services across networked systems. In simple terms, it is a central list of who and what belongs to a network, and what each may do.

How Do Computers Use the Directory?

An organization keeps its accounts in the directory. Computers in the domain can use it to check a sign-in, so one set of credentials can often work across many systems. This is general background rather than a technical description of its internals.

Kerberos-integrated clients can also update DNS records on a BIND server through GSS-TSIG. In October 2026 ISC fixed CVE-2026-94300, a memory corruption flaw in that feature.

Why Does Control of the Directory Matter?

MITRE says adversaries can use domain account credentials for initial access, persistence, privilege escalation or defense evasion. They can obtain such credentials through methods like OS credential dumping or password reuse. Control of the directory can give an attacker wide reach, so protecting it matters.

Which ATT&CK Techniques Target Active Directory?

MITRE lists these techniques against domain accounts and the directory database. Each ID was checked on attack.mitre.org.

Which MITRE Mitigations Protect Domain Accounts?

MITRE lists these mitigations for domain accounts.

• Use multi-factor authentication to reduce the risk from compromised credentials.
• Use strong, complex, unique and regularly rotated passwords.
• Audit domain account permissions regularly, and avoid placing user or admin accounts in local administrator groups unless tightly controlled.
• Review accounts regularly and remove inactive ones.

MITRE says routine audits of domain account permissions help identify excessive access, and that reviewing and removing inactive accounts limits chances for abuse. It also says strong password policies reduce exposure to guessing and credential stuffing, which is when stolen logins are tried against other services.

How Can You Spot Misuse of Domain Accounts?

MITRE suggests watching for suspicious logon patterns, such as access to multiple hosts, off-hours activity, and simultaneous sessions from geographically distant places. Sensitive systems deserve extra attention.

Is Active Directory the Same as a Domain?

No. A domain is a group of computers and accounts managed together. Active Directory is the service that stores and manages the identities for it.

Is Active Directory the Same as a Cloud Identity Service?

This page covers the Windows domain service named in the NIST definition. Cloud identity services are separate products and are not described here.

Related Pages in the Knowledge Hub

Related terms are lateral movement, credential theft and zero trust.

• Valid Accounts
• OS Credential Dumping
• Kerberoasting

Sources

• NIST: NIST glossary definition of Active Directory.
• MITRE ATT&CK: MITRE ATT&CK on domain accounts, mitigations and detection.
• MITRE ATT&CK: T1087.002 Domain Account discovery.
• MITRE ATT&CK: T1558.003 Kerberoasting.
• MITRE ATT&CK: T1003.006 DCSync.
• MITRE ATT&CK: T1003.003 NTDS.
• MITRE ATT&CK: T1484 Domain or Tenant Policy Modification.