Active Directory reconnaissance is the process of mapping an organization’s identity environment, including user and service accounts, groups, computers, permissions, and trust relationships. Attackers use this information to identify valuable accounts and possible routes to additional access. Defenders also perform similar discovery to audit permissions and reduce exposure.
During an intrusion, an attacker with access to a connected system may query directory services or use built-in administrative tools to collect identity data. The findings can guide credential abuse or attempts to move between systems, but reconnaissance alone does not prove that further access or data theft occurred. Defenders can monitor unusual directory queries, review excessive permissions, and investigate unexpected account or group enumeration.