What is Active Directory in Cybersecurity?

Identity & AccessAD
ByDecipherU Editorial
Version 1.0 · Published April 2026 · Last verified April 2026

Active Directory is Microsoft's directory service for Windows domain networks. It stores objects like users, computers, and groups in a forest-and-domain hierarchy. AD handles authentication via Kerberos and NTLM, enforces Group Policy, and is the backbone of identity management in most enterprise environments.

Why Active Directory Matters for Your Cybersecurity Career

Active Directory is the number one target in enterprise penetration tests. Attacks like Kerberoasting, Pass-the-Hash, and DCSync exploit AD weaknesses. SOC analysts monitor AD logs for lateral movement. Security engineers harden AD configurations. AD expertise is highly sought in cybersecurity hiring.

Which Cybersecurity Roles Use Active Directory?

Related Cybersecurity Terms

Related Cybersecurity Certifications

Citation index · auto-derived from course content

Where Active Directory is used across DecipherU

8 public surfaces on the platform reference this term in a meaningful way. Sorted by relevance.

Related glossary entries · 8

Other glossary terms whose definition cites this one.

Kerberoasting2 mentions

"An Active Directory attack that extracts service account ticket-granting servic…"

Directory Services2 mentions

"…directory services in enterprise environments are Microsoft Active Directory and LDAP-based directories."

Pass-the-Hash1 mention

"…he-hash is a critical lateral movement technique in Windows Active Directory environments. Penetration testers use it in nearly every in…"

LDAP1 mention

"…rotocol for communicating with directory servers, including Active Directory and OpenLDAP."

OSCP1 mention

"…x, buffer overflows, web attacks, privilege escalation, and Active Directory exploitation."

Cybersecurity Home Lab1 mention

"…virtual machines, or cloud instances. Common setups include Active Directory domains for defense practice, vulnerable VMs (DVWA, Metaspl…"

Cloud IAM Platforms1 mention

"…s native to major cloud providers, including AWS IAM, Azure Active Directory (Microsoft Entra ID), and Google Cloud IAM. These platforms…"

Identity Threat Detection and Response1 mention

"…ory that detects attacks targeting identity infrastructure (Active Directory, Entra ID, Okta, identity providers) and the misuse of comp…"

Active Directory is Microsoft's directory service for Windows domain networks. It stores objects like users, computers, and groups in a forest-and-domain hierarchy. AD handles authentication via Kerberos and NTLM, enforces Group Policy, and is the backbone of identity management in most enterprise environments.

Active Directory is the number one target in enterprise penetration tests. Attacks like Kerberoasting, Pass-the-Hash, and DCSync exploit AD weaknesses. SOC analysts monitor AD logs for lateral movement. Security engineers harden AD configurations. AD expertise is highly sought in cybersecurity hiring.

Cybersecurity professionals who work with Active Directory include Penetration Tester, SOC Analyst, Security Engineer, Incident Responder. These roles apply Active Directory knowledge within the Identity & Access domain.

Last verified: April 2026?Report an inaccuracy

This role lives inside a packaged path

Want the curriculum, comp delta, and recommended courses for this role?

DecipherU bundles cybersecurity roles into a small set of packaged paths. Each path has the curriculum sequence, the compensation delta it unlocks, and the recommended courses, all pre-set. Two ways in: