Domain compromise is a security condition where an attacker gains enough control over an enterprise identity domain to influence authentication, authorization, or directory trust. In a Windows environment, that can mean Active Directory accounts, groups, computers, policies, or privileged credentials are exposed to attacker control. In hybrid environments, the same risk can extend into cloud identity systems that rely on the domain for sign-in or administration.
This matters because the domain is often the backbone of internal trust. Once an attacker can change permissions, reset passwords, create persistence, or impersonate privileged users, they can move from one compromised account to broad access across servers, email, files, and admin tools. In real attacks, domain compromise often follows phishing, stolen credentials, privilege escalation, or lateral movement. Defenders reduce the risk with phishing-resistant MFA, least privilege, tiered admin access, strong monitoring for directory changes, and rapid detection of unusual authentication or privilege activity.