Active Directory is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was used only for centralized domain management.
Active Directory (AD) is a database and set of services that connect users with the network resources they need to get their work done.
The database (or directory) contains critical information about your environment, including what users and computers there are and who’s allowed to do what. For example, the database might list 100 user accounts with details like each person’s job title, phone number and password. It will also record their permissions.
The services control much of the activity that goes on in your IT environment. In particular, they make sure each person is who they claim to be (authentication), usually by checking the user ID and password they enter, and allow them to access only the data they’re allowed to use (authorization).
Read on to learn more about the benefits of Active Directory, how it works and what’s in an Active Directory database.
Active Directory is a central repository of information related to all resources in the organization’s network ranging from employees to devices to documents, ensuring efficient management of information. AD has a Windows server, working in compatibility with the Windows Operating System to provide centralized management, scalability and security.
How does Active Directory work?
The main Active Directory service is Active Directory Domain Services (AD DS), which is part of the windows server operating system The servers that run AD DS are called domain controllers (DCs). Organizations normally have multiple DCs, and each one has a copy of the directory for the entire domain. Changes made to the directory on one domain controller — such as password update or the deletion of a user account — are replicated to the other DCs so they all stay up to date. A Global Catalog server is a DC that stores a complete copy of all objects in the directory of its domain and a partial copy of all objects of all other domains in the forest; this enables users and applications to find objects in any domain of their forest. Desktops, laptops and other devices running Windows (rather than Windows Server) can be part of an Active Directory environment but they do not run AD DS. AD DS relies on several established protocols and standards, including LDAP (Lightweight Directory Access Protocol), Kerberos and DNS (Domain Name System).
It’s important to understand that Active Directory is only for on-premises Microsoft environments. Microsoft environments in the cloud use Azure Active Directory, which serves the same purposes as its on-prem namesake. AD and Azure AD are separate but can work together to some degree if your organization has both on-premises and cloud IT environments (a hybrid deployment).
How Active Directory is structured?
AD has three main tiers: domains, trees and forests. A domain is a group of related users, computers and other AD objects, such as all the AD objects for your company’s head office. Multiple domains can be combined into a tree, and multiple trees can be grouped into a forest.
Keep in mind that a domain is a management boundary. The objects for a given domain are stored in a single database and can be managed together. A forest is a security boundary. Objects in different forests are not able to interact with each other unless the administrators of each forest create a trust between them. For instance, if you have multiple disjointed business units, you probably want to create multiple forests.
Benefits of Active Directory
Active Directory simplifies life for administrators and end users while enhancing security for organizations. Administrators enjoy centralized user and rights management, as well as centralized control over computer and user configurations through the AD group policy feature. Users can authenticate once and then seamlessly access any resources in the domain for which they’re authorized (single sign-on). Plus, files are stored in a central repository where they can be shared with other users to ease collaboration, and backed up properly by IT teams to ensure business continuity.
As organizations are adapting to industry demands and standards, the proportion of resources like employees, databases, or servers being managed gives rise to questions around accountability. Also, given the scattered structure of managing the infrastructure and its processes, it becomes difficult for organizations to keep track of the employee activities, making it easier for attackers to gain access to the network’s resources, thereby resulting in a huge loss of sensitive information.
To manage organizational resources in the network, Windows started the AD Domain Service in Windows Server 2000 and evolved through Windows Server 2012. It is a repository of all such contents of the organization databases, including resources, shared documents, service accounts, and domain admin accounts, allowing for centralized policy creation, user management, and authentication control.
- Managing all resources and policies of the organizational network is simplified from a centralized space.
- Allowing secure authentication by following the Kerberos protocol that is used in Windows Server 2012.
- Leveraging the scope and scalability of the AD to enable organizations to tackle growing needs by making changes to the policy properties and user management.
WHAT IS ACTIVE DIRECTORY AUTHENTICATION
How does authentication work in Active Directory?
When an endpoint client connects to the endpoint server, an authentication process identifies the client and the user currently working on that computer.
Here’s how the authentication process goes:
- The client requests an authentication ticket from the AD server.
- The AD server returns the ticket to the client.
- The client sends this ticket to the Endpoint Server.
- The Server then returns an acknowledgment of authentication to the client.
Which type of authentication is used in Active Directory?
AD Authentication is a process that typically follows Kerberos protocol where users have to login using their credentials to gain access to resources. Kerberos is a security protocol where users are required to login only once to gain access to organization’s resources; instead of passing on the user’s credentials over the network, a session key is created for the user that lasts for a designated time period allowing for a flexible authentication. Along with the session key, a token information is created that contains all the access rights and policies attached to the user, ensuring that the user is accessing resources that he/she is entitled to.
Windows Active Directory (AD) authentication protocols authenticate users, computers, and services in AD, and enable authorized users and services to access resources securely.
LM is among the oldest authentication protocols used by Microsoft. However, its hashes were relatively easy to crack. By capturing hashes and cracking them to obtain account logon credentials, attackers could easily authenticate to other systems on the network. NTLM, which succeeded LM, is an encrypted challenge/response based authentication protocol used for network logons by client devices, yet it’s still easy to crack. NTLMv2 was a significant improvement compared to NTLM in terms of both authentication and session security mechanisms. It enhanced the security of NTLM by adding the ability for a server to authenticate to a client.
Kerberos authentication is a vast improvement over the previous technologies. Kerberos provides identity authentication by exchanging messages between the client, authentication server, and application server. Compared to NTLMv2, Kerberos’ use of strong cryptography and third-party ticket authorization makes it much more difficult for cybercriminals to infiltrate the network, providing an additional layer of security.
Drop your comment
