Active Directory compromise means an attacker has gained control over the core Windows identity system used to authenticate users, computers, and services. In practice, this can involve stealing privileged credentials, taking over domain controllers, changing group policy, or creating new accounts and trust relationships that let the attacker move freely through a network.
This matters because Active Directory sits at the center of enterprise access control. If it is compromised, defenders may lose the ability to trust logins, permissions, and security settings across the domain. In real attacks, intruders often reach Active Directory after compromising an internet-facing appliance or a single workstation, then escalate privileges and pivot to broader control. Defenses focus on protecting privileged accounts, monitoring directory changes, restricting lateral movement, and quickly detecting unusual authentication, replication, or admin activity.