Active Directory
Active Directory is a directory service from Microsoft that centrally manages all user accounts, passwords, and computers within an organization. It decides at every login who is allowed to log in and which data that person can access.
In a company with 5,000 employees, everyone needs a user account with a password. Nobody wants to create these accounts individually on each of the 5,000 computers. Instead, all accounts come together in a central database. That is exactly what Active Directory is: a centralized management system developed by Microsoft for a company’s users, passwords, and devices. When someone logs in at their workstation in the morning, the computer there checks whether the person is genuine and what they are allowed to do. You can think of it as a company’s registration office and key issuance combined into one.
The master key of a company
Active Directory has been widespread in companies since the year 2000 and remains the standard to this day. By some estimates, the vast majority of larger companies worldwide use it in some form. It controls not only login access but also access to file folders, printers, and internal programs. Who is allowed to see the accounting folders and who is not is stored there.
This central role makes the system a popular target for attackers. Whoever gains control over Active Directory effectively controls the entire company network. Many major ransomware extortion attacks hinge on exactly this step. The attackers first obtain a normal employee account and then work their way up to an administrator account.
For companies, this creates a conflict of objectives. A centralized system is convenient and saves an enormous amount of administrative work. At the same time, there is a single point where an outage or breach can bring everything to a standstill. That is why securing and monitoring this service is one of the most important tasks of an IT department.
Domains, groups, and the login process
All managed objects belong to what is called a domain. A domain is the defined area for which an Active Directory instance is responsible, such as a company or a university. The data resides on one or more servers known as domain controllers. These servers hold identical copies of the database so that not everything grinds to a halt immediately in the event of a failure.
Permissions are almost never assigned to individual people, but to groups. There is, for example, an “Accounting” group with access to certain folders. When a new colleague joins, she is added to the group and everything else happens automatically. When someone leaves the company, the account is deactivated and all access is revoked at once.
During the login process itself, Active Directory uses a procedure called Kerberos. Put simply, after a successful password check, the computer receives a digital ticket. This ticket identifies it to other services on the network without sending the password again. The ticket expires after a few hours and must then be reissued.
From school logins to the cloud
Anyone who works at a Windows computer with a personal username at school or during an internship is very likely using Active Directory. The fact that your own files show up on every device is due to this centralized management. Rules such as forced password changes or locked USB ports are also distributed through it.
In the news, the term usually appears after security incidents. Phrases like “the attackers obtained domain administrator rights” describe exactly this situation. Government agencies and hospitals that had to work with pen and paper for days after an attack often had a compromised Active Directory as well.
It is important to distinguish this from Microsoft Entra ID, the former Azure Active Directory. Despite the similar name, this is not a replacement but a separate service for logins over the internet. Classic Active Directory runs on servers inside the company building, while Entra ID runs in the cloud. Many companies operate both in parallel and link the accounts together.