--- title: "Active Directory — Identity Glossary | IDSync" description: "Active Directory (AD) is Microsoft's on-premises directory service — a combination of LDAP, Kerberos, and DNS — that has authenticated and authorized users…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Active Directory", "item": "https://idsync.com/glossary/active-directory" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/active-directory", "name": "Active Directory", "alternateName": [ "AD", "AD", "AD DS", "Microsoft Active Directory" ], "description": "Active Directory (AD) is Microsoft's on-premises directory service — a combination of LDAP, Kerberos, and DNS — that has authenticated and authorized users, computers, groups, and policies inside Windows networks for 25+ years and remains the identity backbone of most enterprises.", "url": "https://idsync.com/glossary/active-directory", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Active Directory Architecture # Active Directory (AD) Active Directory (AD) is Microsoft's on-premises directory service — a combination of LDAP, Kerberos, and DNS — that has authenticated and authorized users, computers, groups, and policies inside Windows networks for 25+ years and remains the identity backbone of most enterprises. Last reviewed 3 months ago Key points - AD DS is the on-prem product; Entra ID (formerly Azure AD) is the cloud product — they are different services that interoperate via Entra Connect. - Stores users, computers, groups, OUs in a forest of domains, applies policy via Group Policy Objects (GPOs). - Authentication: Kerberos primarily, NTLM as legacy fallback. Queries: LDAP/LDAPS. - Compromise of AD = total enterprise compromise. Almost every major breach in the last decade pivoted through AD. - Modern strategy: harden + tier AD on-prem, integrate with Entra ID for cloud SSO, eventually retire on-prem AD where feasible. ## What is Active Directory? **Active Directory (AD)** is Microsoft's on-premises directory and authentication system. It's been the default identity backbone of Windows networks since 2000 and still authenticates users, computers, and services for the vast majority of enterprises worldwide. AD is really a bundle: - **AD DS (Domain Services)** — the directory itself: users, computers, groups, OUs, GPOs. - **Kerberos KDC** — the authentication engine. - **LDAP server** — the query interface. - **DNS** — service location for domain controllers. - **Group Policy** — policy distribution to domain-joined machines. ## AD vs Entra ID | | AD DS (on-prem) | Entra ID (cloud) | | --- | --- | --- | | Protocols | Kerberos, NTLM, LDAP | SAML, OIDC, OAuth, SCIM | | Scope | Windows endpoints, on-prem apps, file shares | SaaS, Microsoft 365, modern apps | | Management | Domain controllers, GPO | Entra portal, Intune, Conditional Access | | Sync | Entra Connect synchronizes selected attributes | — | They are different products. Entra ID is **not** "AD in the cloud." Many enterprises run both: AD for the on-prem footprint, Entra ID for everything cloud. ## Why AD is the #1 attacker target AD compromise = enterprise compromise. The attacker playbook is mature: - **Initial access** — phishing, password spray, exposed RDP. - **Recon** — BloodHound enumerates the AD graph. - **Privilege escalation** — Kerberoasting, unconstrained delegation abuse, ACL abuse, GPO abuse. - **Persistence** — Golden Tickets, DCShadow, AdminSDHolder backdoors, skeleton key. - **Lateral movement** — Pass-the-Hash, Pass-the-Ticket, WMI / WinRM with admin creds. Almost every ransomware case in the last five years (Conti, LockBit, BlackCat, Cl0p) involved AD compromise at some stage. ## Hardening priorities 1. **Tier model** — Tier 0 (DCs, ADFS, PKI) isolated from Tier 1 (servers) and Tier 2 (workstations). Admin accounts pinned to their tier. 2. **Rotate KRBTGT** twice on a schedule (kills latent Golden Tickets). 3. **Disable RC4, NTLMv1**; minimize NTLM usage; require LDAP signing and channel binding. 4. **MFA on admins via Entra ID** — federate AD admin sign-in through Entra Conditional Access where possible. 5. **Tier-0 admin workstations** (PAWs) — separate hardware for DC admins. 6. **ITDR for AD** — Microsoft Defender for Identity, Silverfort, Semperis, Quest. ## Editorial note There's a tempting narrative that "AD is going away." For most enterprises, it isn't — not this decade. The realistic strategy is harden + tier + ITDR for on-prem AD, while moving net-new workloads to Entra ID / cloud IdPs. IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [iam platforms](/directory/category/iam-platforms)[itdr](/directory/category/itdr) ### Related terms [ldap](/glossary/ldap)[kerberos](/glossary/kerberos)[identity provider](/glossary/identity-provider)[itdr](/glossary/itdr) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the iam platforms category. [Explore tools](/directory/category/iam-platforms) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.