Active Directory is still a systemic target for enterprise attacks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OLOID's blog post: Active Directory concentrates identity control, and the guide shows how attackers turn that concentration into domain-wide compromise.

Why it matters: This matters because IAM, PAM and frontline access teams need to harden the identity layer that attackers most often use to escalate, persist and spread laterally.

By the numbers:

• 9 out of 10 organizations reported that their Active Directory environment had been targeted in a ransomware attack, according to OLOID's guide citing Semperis' 2024 Ransomware Risk Report.

Context

Active Directory is the enterprise identity control plane, which means a compromise there changes who can authenticate, what they can access and how far an attacker can move. Standard identity models assume a stable user, a stable device and a stable session, but that assumption breaks in shared-terminal environments and during attacker-led privilege escalation. Active Directory hardening starts from that reality, not from directory convenience.

The practical issue is not that AD is outdated. The issue is that it centralises authentication, authorisation and policy distribution, so weak privilege boundaries, stale accounts and replication trust can turn one foothold into a broad operational failure. For frontline and hybrid environments, that makes AD governance an identity problem as much as a systems problem.

Key questions

Q: What are the signs that Active Directory compromise may be hiding behind normal service account activity?

A: A common warning sign is that compromised service account credentials look legitimate in logs and routine operations. The activity may blend in until payload delivery, direct attack, or other downstream impact appears. That is why security teams should not rely on passive log review alone. They need detection that understands normal directory behavior and flags suspicious change patterns early.

Q: Why does domain admin compromise create such a severe security risk for Active Directory environments?

A: Domain admin compromise is so dangerous because it gives attackers broad control over the directory, including visibility into the forest, access to systems, and the ability to impersonate users or services. Once that level of control exists, attackers can manipulate, encrypt, or destroy the identity backbone, which expands both operational impact and recovery complexity.

Q: How should security teams govern Active Directory service accounts?

A: Treat them as non-human identities with an owner, purpose, review cadence, and retirement path. Governance should cover effective permissions, not only visible group membership, because nested groups and inherited ACLs often define the real blast radius. Security teams should also monitor for interactive use, stale credentials, and accounts that no longer match any active workload.

Q: How do shared-device environments change Active Directory access control?

A: Shared-device environments weaken user-to-device trust, so Active Directory access control must rely more on device state, session controls and short-lived authentication than on persistent local trust. Administrators typically use computer objects, group policy, conditional access, certificate-based authentication, least privilege and rapid sign-out or lock policies to stop one user's session or cached credentials from exposing another user's access.

Technical breakdown

How Kerberos, LDAP and NTLM shape AD trust

Active Directory depends on several identity protocols with different security properties. Kerberos is the primary authentication mechanism, using ticket exchange rather than password transmission. LDAP supports directory lookups, while NTLM remains a legacy compatibility path that is easier to abuse and harder to govern. The security consequence is that protocol choice affects attack surface, credential exposure and how much trust is embedded in the session itself. See the Kerberos Security Guide.

Practical implication: Reduce exposure by limiting legacy authentication paths and treating Kerberos, LDAP and NTLM as distinct governance surfaces.

Why domain controller replication amplifies compromise

Domain controllers do more than authenticate users. They replicate directory changes automatically, which means an attacker who alters privilege, policy or credentials on one controller can spread those changes across the forest. That replication makes recovery harder because the malicious state is not confined to a single host. In AD terms, the blast radius is built into the architecture unless administrative tiers and change controls narrow it. See the Active Directory and Entra ID Hardening Guide.

Practical implication: Treat replication as a high-risk propagation channel and monitor it with the same discipline as privileged administration.

How shared-device environments break per-user accountability

Shared terminals in plants, hospitals and distribution centres create an identity attribution problem. When several workers use the same device across a shift, the directory can still authenticate them, but it cannot by itself guarantee reliable per-session accountability unless the workflow binds the session to the individual. That gap is not just an audit nuisance. It weakens non-repudiation, complicates incident review and increases the chance that one exposed credential affects many workers.

Practical implication: Use session-level identity controls when one device serves many people so the access trail remains attributable.

Threat narrative

Attacker objective: The objective is domain dominance, which allows the attacker to impersonate users, alter permissions and deploy ransomware through trusted identity paths.

1. Entry typically begins with a compromised workstation or phishing victim, giving the attacker a foothold inside the environment.
2. Enumeration follows as the attacker maps privileged groups, trusts, GPOs and service accounts to identify escalation paths.
3. Privilege escalation comes next through techniques such as Pass-the-Hash or Kerberoasting, which let the attacker reuse or crack credentials.
4. Impact occurs when the attacker reaches domain controller-level control, enabling broad authentication abuse, policy changes and ransomware deployment.

Breaches seen in the wild

• TeamCity CVE-2023-42793 SVR exploitation 2023: Russia's SVR exploited TeamCity CVE-2023-42793 to compromise dozens of firms' build servers, dump credentials and sit next to code and signing keys.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Active Directory is not just a directory service; it is the identity authority that attackers try to own first. When authentication, policy distribution and privilege assignment are centralised in one plane, compromise of that plane becomes a force multiplier. That is why AD-targeted intrusions so often turn a local foothold into enterprise-wide control. The practitioner lesson is to treat directory governance as a primary security programme, not an infrastructure afterthought.

Tiered administration is the governance boundary that matters most once AD becomes the attack target. The article's attack sequence shows why lower-tier credentials must never be able to touch higher-tier systems. The same logic also applies to privileged group membership and service accounts: if those identities are not isolated, escalation becomes a routine path rather than an exceptional event. Practitioners should design admin separation as a control architecture, not a policy statement.

Replication creates identity blast radius: unauthorized directory changes do not stay local because AD is designed to propagate state across controllers. That assumption was designed for availability and consistency, but it fails under active compromise because the attacker can make malicious state durable by design. The implication is that recovery planning must assume the directory itself can distribute the breach.

Shared-device accountability is the weakest part of conventional AD thinking in frontline environments. Standard directory design assumes one person, one device, one session. That assumption breaks in shift-based operations, where identity must remain attributable even when terminals are shared. Practitioners should stop treating this as a UX edge case and start treating it as a governance requirement for auditability and incident response.

Identity source of truth and Zero Trust are compatible only when access decisions move beyond domain membership. AD can remain the authoritative directory while contextual signals reshape authorisation at runtime. That means device posture, session risk and privileged path restrictions have to supplement, not replace, the directory. The practitioner conclusion is clear: a hardened directory is necessary, but it is not sufficient on its own.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Identity blast radius is the right lens for directory risk: when a directory replicates privilege and policy by design, compromise of a single control point can become an organisation-wide event. Security teams should focus on where state changes propagate, not just where authentication starts.

AD hardening should now be treated as part of a broader identity governance programme that spans privileged users, service accounts and shared-device workflows. The practical question is no longer whether the directory works, but whether it can still preserve accountability and contain blast radius under active attack.

For practitioners

• Audit privileged group changes Track additions to Domain Admins and other Tier 0 groups, then investigate any membership change that lacks an approved business reason.
• Separate Tier 0 administration Keep domain controller administration, server administration and workstation administration in distinct accounts and workflows so lower-tier credentials never touch higher-tier systems.
• Monitor domain controller replication Alert on replication anomalies, unexpected KRBTGT access and sudden GPO linking changes because those events often precede persistent compromise.
• Rotate service account credentials Replace static service account passwords on a defined cadence and remove unnecessary privilege from accounts that support Kerberos-backed services.
• Bind shared sessions to individuals Use per-session identity controls in frontline and shared-device environments so one terminal does not erase the accountability trail for multiple workers.

Key takeaways

• Active Directory remains a high-value target because it concentrates authentication, authorisation and policy control in one plane.
• Attackers typically move through enumeration, credential abuse, persistence and controller compromise rather than a single exploit step.
• The most effective defences are tiered administration, high-signal monitoring, service account governance and session-level accountability in shared-device environments.

Related NHI Mgmt Group resources: Active Directory and Entra ID Hardening Guide · Privileged Access Management Guide · NHI Lifecycle Management Guide · Identity Threat Detection and Response (ITDR) Guide

Key terms

• Active Directory: Microsoft's directory service for managing identities, authentication, and permissions across many enterprise environments. In security analysis, it matters because it often sits at the center of access control, so a compromise can affect users, systems, and administrative trust across the organisation.
• Kerberos: A ticket-based authentication protocol that proves identity without sending passwords over the network. In Linux identity programmes, it helps standardise login assurance across systems and supports stronger central governance when paired with directory services and modern access controls.
• LDAP: LDAP is a protocol for querying and managing directory services over a network. It standardises how clients talk to a directory, but it is not the directory itself. In practice, it is often used as an access layer for authentication and identity lookups in heterogeneous environments.
• NTLM: NTLM is a Microsoft challenge-response authentication protocol used to prove a user or computer’s identity without sending the password itself. Attackers abuse it through relay, pass-the-hash, and credential capture attacks, so defenders should restrict NTLM use, prefer stronger authentication, and monitor where NTLM is still accepted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.