BiTree
  • Search For Lessons
  • Curriculum
  • Pricing
  • For Educators
  • Become a Tutor
  • About
  • Contact
Log InGet Started

Questions, concerns, bug reports, or suggestions? We read every message, write to us at [email protected].

More ways to reach us →
BiTree

Live coding lessons for aspiring developers and security professionals.

[email protected]

(201) 785-7951

Mon–Fri, 9 AM–5 PM EST

Learn

  • Search For Lessons
  • Curriculum
  • Pricing

Company

  • About
  • For Educators & Schools
  • Become a Tutor
  • Contact Us

Legal

  • Terms of Service
  • Privacy Policy
© 2026 BiTree. All rights reserved.
Curriculum/Cybersecurity/Active Directory and Windows Security/Active Directory: The Enterprise Attack Surface
20 minIntermediate

Active Directory: The Enterprise Attack Surface

After this lesson, you will be able to: Understand what Active Directory is (domains, forests, trusts, OUs, GPOs), why it is in almost every enterprise, and why it is a primary target in real breaches.

Active Directory is the identity backbone of nearly every enterprise, and compromising it usually means owning the whole network. This subtrack covers AD structure, Kerberos and NTLM authentication, the common attack techniques, BloodHound attack-path mapping, and AD defense, with a lab AD environment.

This is a free introductory lesson. No purchase required.

💡 Authorization first

Practice AD attacks only in a lab you build (the Detection Lab project or a minimal Windows Server evaluation VM) or sanctioned platforms (TryHackMe's Active Directory rooms, HackTheBox). Attacking a real domain you do not own is a serious crime.

What Active Directory is

Active Directory is Microsoft's directory service for managing users, computers, and resources in a Windows network. A domain is an administrative boundary of users and machines; a forest is one or more domains sharing a schema; trusts let domains share access; organizational units (OUs) group objects for management; and Group Policy Objects (GPOs) push configuration and security settings across the domain. Understanding this structure is the prerequisite for everything that follows.

Why AD is the prize

Because AD controls authentication and authorization across the enterprise, an attacker who reaches Domain Admin effectively controls every machine and account. Real intrusions almost always pivot through AD: phish a user, escalate, move laterally, and grab domain dominance. That is why AD attack and defense is one of the most valuable skill sets in cybersecurity, and why this subtrack centers both sides.

Back to Active Directory and Windows Security
AD Authentication: Kerberos and NTLM→