HTB Academy - Active Directory

Active Directory Hierarchy — Forests, Domains, OUs & Policy Objects

🎯 Quick Map (What lives in AD)

• Domain Computers – machine accounts that join the domain
• Domain Users – human/principal identities
• Domain Groups – security & distribution groups for access scoping
• Organizational Units (OUs) – admin/rbac boundaries; GPO link targets
• Default Domain Policy – domain-wide baseline (password/Kerberos policy)
• Functional Levels (Forest/Domain) – feature gates tied to Windows Server versions
• Password Policy – complexity/length/lockout; domain or fine‑grained
• Group Policy Objects (GPOs) – configuration/constraints linked to sites/domains/OUs
• Domain Trusts – auth/authz relationships across domains/forests
• Access Control Lists (ACLs) – permissions on directory objects (DACL/SACL)

🌲 The Hierarchy

Active Directory is a tree of containers and objects:

• Forest = security boundary that contains one or more domains.
• Domains can have child domains (forming trees); they hold identities and policies.
• OUs nest inside domains to delegate administration and link GPOs granularly.
• Objects (users/computers/groups) live within OUs or default containers.

Forest is the trust/administration boundary. Domains segment namespaces and replication. OUs provide delegation + policy scoping.

🧭 Example Layout (namespaced)

INLANEFREIGHT.LOCAL/
├── ADMIN.INLANEFREIGHT.LOCAL
│   ├── GPOs
│   └── OU
│       └── EMPLOYEES
│           ├── COMPUTERS
│           │   └── FILE01
│           ├── GROUPS
│           │   └── HQ Staff
│           └── USERS
│               └── barbara.jones
├── CORP.INLANEFREIGHT.LOCAL
└── DEV.INLANEFREIGHT.LOCAL

Reading it:

• Three domains in the forest: ADMIN, CORP, DEV under the root INLANEFREIGHT.LOCAL.
• In ADMIN, an OU hierarchy groups employees, computers, groups, and users.
• GPOs are separate objects linked to sites/domains/OUs (not “stored” inside OUs).

🛡️ Policy & Control

• Default Domain Policy applies at the domain (e.g., password/Kerberos). Avoid stuffing random settings here—use dedicated GPOs.
• GPO Processing order: Local → Site → Domain → OU (LSDOU). Lower scope can override via link order and Enforced/Block Inheritance.
• ACLs on AD objects govern who can read/modify/create child objects (delegate safely via OUs).

🤝 Trusts

• Intra‑forest trusts are transitive (parent/child, tree‑root). Auth flows across domains automatically.
• Inter‑forest/external trusts can be explicit, one‑way or two‑way, selective or forest‑wide.

📎 Admin Crib

• Put identities in OUs, not default containers, so you can link GPOs and delegate cleanly.
• Raise functional levels only after verifying DC OS versions meet requirements.
• Keep password policy in default domain policy or use fine‑grained PSOs via Password Settings Objects.
• Regularly review ACLs and GPO link order; audit with advanced security on containers.

✅ TL;DR

Forest (boundary) → Domain (namespace) → OU (delegation & policy) → Objects (users/computers/groups). GPOs configure; ACLs control; trusts connect.