Active Directory (AD) is Microsoft’s directory service for managing users, computers, groups, and access rights in enterprise networks. It centralizes authentication and authorization, so many business systems rely on AD to decide who can log in and what they can do.
AD matters in cyber security because it is often the control plane for Windows environments and many hybrid networks. If an attacker compromises AD-related accounts or domain services, they may gain broad access, escalate privileges, or move laterally to other systems. Common attack patterns include password spraying, valid-account abuse, and unauthorized changes to group membership or privileged roles. Defenders monitor AD logs, unusual login behavior, account lockouts, and privilege changes to spot these threats early. In Microsoft-centric environments, tools such as identity threat detection platforms often focus heavily on AD telemetry because it reveals the trust relationships attackers try to exploit.