Lab 01 — Active Directory

Active Directory remains one of the most important identity technologies in enterprise environments.

It commonly provides centralized management for:

Users

Computers

Groups

Authentication

Authorization

Group Policy

Enterprise Resources

For a security professional, Active Directory is not simply:

User Management

It is a critical security control plane.

A useful mental model is:

IDENTITY
   ↓
AUTHENTICATION
   ↓
GROUP MEMBERSHIP
   ↓
PRIVILEGE
   ↓
POLICY
   ↓
RESOURCE ACCESS

Mission Information

Lab: Active Directory
Level: Beginner → Intermediate
Estimated Time: 150–210 minutes
Environment: Authorized Windows Server / Active Directory lab
Primary Role: Windows / Identity Administrator
Secondary Roles: Security Engineer, SOC Analyst, IAM Engineer, Incident Responder, Microsoft Security Engineer

Mission Scenario

Your organization is preparing a Windows Active Directory environment for a security review.

The environment contains:

Domain Controller

Users

Administrators

Security Groups

Organizational Units

Workstations

Service Accounts

Group Policies

The security team wants to know:

How Is the Domain Structured?

Who Has Access?

Who Has Administrative Privilege?

Which Groups Control Access?

How Are Users Organized?

Which Policies Apply?

Are Service Accounts Controlled?

Can Important Changes Be Audited?

Your task is to inspect the Active Directory environment and create a basic security assessment.

Learning Objectives

By completing this lab, you should be able to:

Explain Active Directory architecture
Identify the domain
Understand domain controllers
Review organizational units
Create and review users
Create and review security groups
Understand group scopes conceptually
Understand authentication in a domain
Review privileged groups
Understand domain administration
Review service accounts
Understand Group Policy
Identify computer objects
Understand account lifecycle
Review password and lockout concepts
Review authentication events
Understand Active Directory security risks
Produce security findings
Build a professional Active Directory assessment report

Lab Architecture

                   +----------------------+
                   |    Domain Controller |
                   |                      |
                   | Active Directory DS  |
                   | DNS                  |
                   | Group Policy         |
                   +----------+-----------+
                              |
                              |
                    Corporate Domain
                              |
             +----------------+----------------+
             |                |                |
             v                v                v
          Users            Groups         Computers
             |                |                |
             +----------------+----------------+
                              |
                              v
                         Resources

Part 01 — What Is Active Directory?

Active Directory Domain Services provides centralized identity and resource management.

It helps answer:

Who Are You?

Which Groups Are You In?

What Can You Access?

Which Policies Apply?

Active Directory Core Objects

You will commonly work with:

Users

Groups

Computers

Organizational Units

Policies

Domains

Part 02 — Understand the Domain

A domain represents an administrative and identity boundary within Active Directory.

Example:

corp.example.local

Conceptually:

Domain
  ↓
Users
Groups
Computers
Policies

Security Questions

Ask:

What Is the Domain Name?

How Many Domain Controllers Exist?

Who Administers the Domain?

Which Systems Depend on It?

Part 03 — Identify the Domain

On a domain-joined Windows system, use approved administrative tools such as PowerShell.

For example:

$env:USERDOMAIN

You can also inspect domain information using the Active Directory administrative tools available in your lab.

Part 04 — Domain Controllers

A domain controller provides critical Active Directory services.

It can participate in:

Authentication

Directory Queries

Group Policy

Domain Services

Security Importance

Domain controllers should be treated as:

Highly Critical Assets

because compromise may affect:

Users

Groups

Credentials

Policies

Enterprise Access

Domain Controller Security Questions

Who Can Log In?

Who Can Administer It?

Which Services Run?

Is It Patched?

Is Logging Enabled?

Is Network Access Restricted?

Part 05 — Organizational Units

Organizational Units, or OUs, help organize directory objects.

Example:

corp.example.local
|
+-- Users
|
+-- Workstations
|
+-- Servers
|
+-- Admins
|
+-- Service Accounts

Why OUs Matter

OUs support:

Administration

Delegation

Policy Application

Logical Organization

Security Principle

Do not create an OU structure based only on:

Company Org Chart

Think also about:

Administration

Security Requirements

Policy Boundaries

Delegation

Part 06 — Review Organizational Units

Using Active Directory Users and Computers or approved PowerShell tooling, identify existing OUs.

Record:

OU Name

Purpose

Objects

Delegated Administrators

Policies

OU Review Table

OU	Purpose	Object Type	Security Relevance
Users	Employee identities	Users	Account policy
Workstations	User devices	Computers	Endpoint policy
Servers	Server systems	Computers	Server hardening
Admins	Privileged users	Users	High privilege
Service Accounts	Workloads	Users	Credential security

Part 07 — User Accounts

Users represent human identities or, in some environments, workload identities.

A user object may contain:

Username

Display Name

Group Membership

Account Status

Password Properties

Login Restrictions

User Lifecycle

Use:

JOIN
 ↓
CREATE
 ↓
ASSIGN ACCESS
 ↓
MONITOR
 ↓
REVIEW
 ↓
DISABLE
 ↓
REMOVE

Security Risk

The most common identity problems include:

Dormant Accounts

Excessive Group Membership

Shared Accounts

Weak Password Controls

Unreviewed Privilege

Part 08 — Create a Lab User

In an authorized training environment, create a test identity.

Example PowerShell workflow where the Active Directory module is available:

New-ADUser `
  -Name "Alice Student" `
  -GivenName "Alice" `
  -Surname "Student" `
  -SamAccountName "alice.student" `
  -UserPrincipalName "alice.student@corp.example.local" `
  -Enabled $true

Depending on your environment, password configuration may be handled separately using your lab’s approved process.

Important

Do not use production names, credentials, or domains in a training environment.

Part 09 — Review User Information

For a lab user:

Get-ADUser alice.student -Properties *

For a more focused review:

Get-ADUser alice.student -Properties Enabled,LastLogonDate,PasswordLastSet

Ask:

Is the Account Enabled?

When Was Password Changed?

When Was It Last Used?

Which Groups Does It Belong To?

Does It Still Need Access?

Part 10 — Account Status

Important account states include:

Enabled

Disabled

Locked

Expired

Security teams should understand why an account is in each state.

Part 11 — Disable a Lab Account

For an authorized test identity:

Disable-ADAccount -Identity alice.student

Verify:

Get-ADUser alice.student -Properties Enabled

Re-enable only if required:

Enable-ADAccount -Identity alice.student

Security Principle

When access must be removed quickly:

Disable

can be safer than immediately deleting the account because it preserves:

Object History

Ownership Context

Investigation Context

until the appropriate lifecycle process is complete.

Part 12 — Groups

Groups allow access to be assigned based on role.

Poor model:

Alice → Folder

Bob → Folder

Charlie → Folder

Better:

Alice
Bob
Charlie
   ↓
Finance-Users
   ↓
Finance Resource

Security Benefit

Groups provide:

Consistency

Scalability

Centralized Authorization

Simpler Reviews

Part 13 — Group Types

At a high level, Active Directory groups may be used for:

Security

Distribution

Security groups can participate in access control.

Part 14 — Group Scope

Common group scopes include:

Domain Local

Global

Universal

You do not need to memorize only definitions.

Understand the design question:

Where Can Members Come From?

Where Will Permissions Be Used?

Part 15 — Create a Lab Security Group

Example:

New-ADGroup `
  -Name "GHC-Security-Analysts" `
  -GroupScope Global `
  -GroupCategory Security

Part 16 — Add a User to a Group

Example:

Add-ADGroupMember `
  -Identity "GHC-Security-Analysts" `
  -Members "alice.student"

Verify:

Get-ADGroupMember "GHC-Security-Analysts"

Security Question

Always ask:

Does This User Need This Group?

because group membership often translates directly into:

Access

Part 17 — Review User Group Membership

Example:

Get-ADPrincipalGroupMembership alice.student |
Select-Object Name

Document:

Normal Groups

Privileged Groups

Application Groups

Legacy Groups

Privilege Creep

Privilege creep occurs when:

User Changes Role
      ↓
Old Groups Remain
      ↓
New Groups Added
      ↓
Access Accumulates

Part 18 — Privileged Groups

Certain groups should receive special security attention.

Examples may include:

Domain Admins

Enterprise Admins

Administrators

Account Operators

Server Operators

depending on environment and domain structure.

Important

Do not treat every built-in group as equally dangerous.

Assess:

Actual Privilege

Membership

Delegation

Business Requirement

Part 19 — Review Domain Admins

Example:

Get-ADGroupMember "Domain Admins"

Document:

Member

Account Type

Business Owner

Reason for Membership

Last Review

Security Principle

Membership in highly privileged groups should be:

Rare

Justified

Reviewed

Strongly Authenticated

Monitored

Finding Example

Finding:
Excessive Domain Administrative Membership

Observation:
A standard operational user retains
membership in a highly privileged
administrative group despite not requiring
domain-wide administrative access.

Risk:
Compromise or misuse of the account could
result in broad control over enterprise
identity and domain resources.

Recommendation:
Remove unnecessary high-level privilege
and assign the minimum role required for
the user's responsibilities.

Part 20 — Administrative Accounts

A mature environment may separate:

Normal User Identity

from:

Administrative Identity

Example:

alice.student

for normal work and:

adm-alice

for approved privileged activity.

Security Benefit

This can reduce exposure of:

High-Privilege Credentials

during ordinary activities such as:

Email

Web Browsing

Document Work

Part 21 — Shared Administrator Accounts

Avoid:

DomainAdmin

shared by multiple administrators.

Shared accounts reduce:

Accountability

Auditability

Attribution

Prefer:

Individual Admin Identity
      ↓
Privileged Role
      ↓
Audited Activity

Part 22 — Computer Objects

Domain-joined Windows systems are represented by computer objects.

Example:

PC-001$

SERVER-01$

Computer Security Questions

Is the Computer Still Active?

Who Owns It?

Which OU Is It In?

Which Policies Apply?

Is It a Server or Endpoint?

Is the Object Stale?

Part 23 — Review Computer Objects

Example:

Get-ADComputer -Filter * |
Select-Object Name,Enabled

For a focused view:

Get-ADComputer -Filter * -Properties LastLogonDate |
Select-Object Name,Enabled,LastLogonDate

Stale Computers

Old computer objects may represent:

Retired Systems

Rebuilt Systems

Unused Devices

Inventory Problems

They should be reviewed rather than ignored.

Part 24 — Service Accounts

Applications and services may need dedicated identities.

Examples:

Database Service

Backup Agent

Scheduled Task

Application Pool

Integration Service

Poor Model

Application
   ↓
Employee Account

or:

Application
   ↓
Domain Administrator

Better Model

Application
   ↓
Dedicated Service Identity
   ↓
Minimum Required Access

Part 25 — Service Account Security

For every service account ask:

Who Owns It?

Which Application Uses It?

Does It Need Interactive Login?

Does It Need Domain Access?

Does It Need Administrative Privilege?

How Is Its Credential Managed?

When Was It Last Reviewed?

Finding Example

Finding:
Service Account Has Excessive Privilege

Observation:
A service identity is a member of a
highly privileged administrative group
although its application requires only
limited resource access.

Risk:
Compromise of the application or service
credential could result in broad domain
privilege.

Recommendation:
Remove excessive membership and grant
only the permissions required by the
application.

Part 26 — Managed Service Accounts Concept

Where appropriate, organizations may use managed service-account technologies to reduce manual password-management burden.

The security goal is:

Service
  ↓
Dedicated Managed Identity
  ↓
Controlled Privilege
  ↓
Reduced Credential Management

Part 27 — Password Policy

Domain environments commonly define password-related policies.

Security areas may include:

Password Length

Password History

Password Age

Account Lockout

Authentication Requirements

Important

Do not assume:

Very Frequent Password Changes
=
Better Security

Password strategy should align with modern organizational policy and authentication architecture.

Part 28 — Account Lockout

Lockout controls can reduce repeated password guessing.

But aggressive settings can also create:

User Lockouts

Helpdesk Load

Potential Denial-of-Service Conditions

Security configuration must balance:

Protection
+
Availability

Part 29 — Authentication in Active Directory

Active Directory environments commonly use authentication protocols such as:

Kerberos

NTLM

Modern domain authentication prefers stronger and more current mechanisms where possible, while legacy applications may still create compatibility requirements.

Kerberos Mental Model

At a high level:

USER
  ↓
DOMAIN AUTHENTICATION
  ↓
TICKET
  ↓
SERVICE ACCESS

Security Importance

Identity administrators should understand:

Authentication Source

Account

Service

Ticket / Session

Privilege

without treating authentication as a black box.

Part 30 — DNS and Active Directory

Active Directory depends heavily on DNS.

A simplified model:

Client
  ↓
DNS
  ↓
Locate Domain Service
  ↓
Domain Controller
  ↓
Authentication

Critical Lesson

Many Active Directory problems that appear to be:

Authentication Problems

can actually involve:

DNS

Part 31 — Group Policy

Group Policy provides centralized Windows configuration.

Conceptually:

DOMAIN / OU
      ↓
GROUP POLICY OBJECT
      ↓
USERS / COMPUTERS
      ↓
CONFIGURATION

Group Policy Can Control

Security Settings

Desktop Configuration

Firewall

Authentication

Scripts

Administrative Templates

Windows Components

Part 32 — Why Group Policy Matters for Security

A single policy can influence:

Hundreds

Thousands

Tens of Thousands

of systems.

Therefore:

GPO Modification

can be a high-impact administrative action.

Part 33 — Review Group Policy Objects

Using Group Policy Management in your authorized lab, identify:

GPO Name

Linked Location

Purpose

Security Relevance

Owner

GPO Review Table

GPO	Linked To	Purpose	Security Impact
Domain Baseline	Domain	Baseline settings	High
Workstation Security	Workstations OU	Endpoint policy	High
Server Security	Servers OU	Server policy	High
Admin Policy	Admin OU	Privileged controls	High

Part 34 — GPO Precedence Concept

Policies may apply at different levels.

Conceptually:

Site
 ↓
Domain
 ↓
OU
 ↓
Nested OU

Actual policy processing can also involve:

Inheritance

Enforcement

Security Filtering

WMI Filtering

Troubleshooting Question

When a setting is unexpected, ask:

Which GPO Applied It?

Part 35 — Security Filtering

Not every policy must necessarily apply to every object.

Security filtering and targeting should be controlled carefully.

Security Risk

A GPO that is:

Correctly Configured

but:

Incorrectly Scoped

may still create security problems.

Part 36 — Delegation

Active Directory administration can be delegated.

Example:

Helpdesk Team
      ↓
Reset User Passwords
      ↓
Users OU

without granting:

Domain Admin

Delegation Principle

Use:

RIGHT TASK
   ↓
RIGHT ADMINISTRATOR
   ↓
RIGHT SCOPE

Part 37 — Delegation Security

Ask:

Who Can Create Users?

Who Can Reset Passwords?

Who Can Modify Groups?

Who Can Manage Computers?

Who Can Modify GPOs?

Who Can Change Privileged Accounts?

Part 38 — Least Privilege in Active Directory

Poor model:

IT Team
   ↓
Domain Admin

Better:

Helpdesk
   ↓
Password Reset Delegation

Endpoint Team
   ↓
Computer Management Delegation

Identity Team
   ↓
User / Group Administration

Domain Admins
   ↓
Restricted High-Level Administration

Part 39 — Active Directory Logging

Security teams need visibility into:

Authentication

Account Creation

Account Disablement

Group Membership Changes

Privilege Changes

Policy Changes

Logging Mental Model

IDENTITY EVENT
      ↓
WINDOWS SECURITY EVENT
      ↓
LOG COLLECTION
      ↓
SIEM
      ↓
ALERT / INVESTIGATION

Part 40 — Review Windows Security Logs

On an authorized domain controller, use Event Viewer or approved PowerShell tooling to review security events.

Focus on categories such as:

Logon

Account Management

Group Changes

Policy Changes

Privilege Use

Important

Do not memorize event IDs without understanding:

What Happened

Which Identity

Which System

When

What Changed

Part 41 — Account Creation Investigation

When a new user appears, ask:

Who Created It?

When?

Why?

Which Groups Were Assigned?

Was It Approved?

Investigation Model

ACCOUNT CREATED
      ↓
CREATOR
      ↓
TIME
      ↓
GROUP MEMBERSHIP
      ↓
PRIVILEGE
      ↓
BUSINESS CONTEXT

Part 42 — Group Membership Investigation

A privileged group change deserves particular attention.

Example:

User Added
      ↓
Domain Admins
      ↓
Privilege Increase

Ask:

Who Made the Change?

Was It Approved?

How Long Did Membership Last?

What Did the User Do Afterwards?

Part 43 — Account Lockout Investigation

When a user repeatedly locks out, investigate:

Current Password

Old Stored Credentials

Mapped Drives

Services

Scheduled Tasks

Mobile Devices

Applications

Do not assume:

Lockout
=
Attack

Part 44 — Authentication Failure Scenario

Scenario:

User Cannot Log In

Use:

Account Exists?
      ↓
Enabled?
      ↓
Locked?
      ↓
Password Correct?
      ↓
DNS Working?
      ↓
Domain Controller Reachable?
      ↓
Policy?
      ↓
Authentication Logs?

Part 45 — Group Access Scenario

Scenario:

User Authenticates
but Cannot Access Shared Resource

This may indicate:

Authorization

rather than authentication.

Check:

Group Membership

Resource Permission

Token Refresh / Session

Policy

Resource Availability

Part 46 — GPO Scenario

Scenario:

Security Setting Applies
to Some Computers
but Not Others

Investigate:

OU Location

GPO Link

Security Filtering

Inheritance

Device Membership

Policy Refresh

Resultant Policy

Part 47 — Stale Account Scenario

Scenario:

Employee Left Organization
60 Days Ago

Account Still Enabled

Potential risk:

Unauthorized Future Access

Remediation:

Validate Employment Status
      ↓
Disable Account
      ↓
Remove Access
      ↓
Preserve Required Data
      ↓
Complete Offboarding

Part 48 — Privileged Account Scenario

Scenario:

Helpdesk User
Is Domain Admin

Ask:

Is Domain-Wide Access Required?

If not:

Remove Excessive Privilege
      ↓
Delegate Required Task

Part 49 — Service Account Scenario

Scenario:

Backup Service Uses
Personal Employee Account

Risk:

Credential Lifecycle Problem

Ownership Problem

Password Change Failure

Accountability Problem

Better:

Dedicated Service Identity
      ↓
Documented Owner
      ↓
Minimum Access

Part 50 — Active Directory Security Assessment

Your assessment should review:

Domain Structure

Domain Controllers

Users

Groups

Privileged Accounts

Service Accounts

Computers

OUs

Delegation

Group Policy

Authentication

Logging

Security Assessment Workflow

DOMAIN
  ↓
IDENTITIES
  ↓
GROUPS
  ↓
PRIVILEGE
  ↓
POLICIES
  ↓
COMPUTERS
  ↓
AUTHENTICATION
  ↓
LOGGING
  ↓
FINDINGS

Part 51 — Build an Identity Inventory

Create:

Identity	Type	Enabled	Privileged	Owner	Review
alice.student	User	Yes	No	Training	Current
adm-bob	Admin	Yes	Yes	IT	Review
svc-backup	Service	Yes	Review	Backup Team	Review

Part 52 — Build a Privileged Group Matrix

Group	Members	Purpose	Review Frequency
Domain Admins	Review	Domain administration	Frequent
Administrators	Review	Administrative access	Frequent
Custom Admin Group	Review	Delegated role	Periodic

Part 53 — Build a Service Account Matrix

Account	Application	Owner	Privileged	Interactive Login
svc-backup	Backup	Infra	No/Review	No
svc-app	Application	App Team	No/Review	No

Part 54 — Build a Computer Inventory

Computer	OU	Enabled	Last Seen	Owner
PC-001	Workstations	Yes	Current	User Team
SRV-001	Servers	Yes	Current	Infra
OLD-PC	Workstations	Yes	Old	Review

Part 55 — Build a GPO Inventory

GPO	Scope	Security Purpose	Owner
Domain Baseline	Domain	Baseline	Security
Workstation Baseline	Workstations	Endpoint security	Endpoint Team
Server Baseline	Servers	Server security	Infra

Part 56 — Finding: Dormant User Account

Finding:
Dormant Active Directory Account

Observation:
An account associated with a user who no
longer requires domain access remains
enabled.

Risk:
Unused credentials may provide an
unnecessary path into enterprise resources.

Recommendation:
Validate business ownership and disable
accounts promptly when access is no longer
required.

Part 57 — Finding: Excessive Privilege

Finding:
Excessive Privileged Group Membership

Observation:
A user has membership in a high-privilege
group beyond the requirements of their
documented role.

Risk:
Account compromise or misuse could provide
broader control over domain resources than
necessary.

Recommendation:
Remove unnecessary privileged membership
and use delegated administration aligned
to least privilege.

Part 58 — Finding: Shared Administrator

Finding:
Shared Administrative Identity

Observation:
Multiple administrators use a common
privileged domain account.

Risk:
Administrative activity cannot be reliably
attributed to an individual and credential
exposure affects multiple administrators.

Recommendation:
Use individually attributable privileged
accounts with controlled administrative
permissions.

Part 59 — Finding: Stale Computer Object

Finding:
Stale Active Directory Computer Object

Observation:
An enabled computer object has not shown
expected activity and no current owner can
be identified.

Risk:
Stale directory objects can weaken asset
inventory and may retain unnecessary trust
or policy relationships.

Recommendation:
Validate ownership and retire or disable
unused computer objects through the
approved asset lifecycle process.

Part 60 — Finding: Weak Service Account Governance

Finding:
Service Account Governance Gap

Observation:
A service account does not have a clearly
documented owner, purpose, or periodic
access review.

Risk:
The identity may retain unnecessary access
or credentials beyond the lifecycle of the
application.

Recommendation:
Assign an owner, document purpose, enforce
least privilege, restrict interactive use,
and review periodically.

Part 61 — Active Directory Security Report

Your report should contain:

1. Executive Summary

Document:

Domain Assessed

Overall Identity Posture

Highest-Risk Issues

Priority Recommendations

2. Domain Overview

Include:

Domain Name

Domain Controllers

Environment Purpose

Criticality

3. User Review

Include:

Active Users

Disabled Users

Dormant Users

Administrative Users

4. Group Review

Document:

Security Groups

Privileged Groups

Group Ownership

Excessive Membership

5. Service Accounts

Document:

Account

Application

Owner

Privilege

Authentication Requirement

6. Computer Objects

Document:

Active Computers

Stale Computers

Server Objects

Workstation Objects

7. Organizational Units

Document:

Structure

Purpose

Delegation

Policy Alignment

8. Group Policy

Document:

GPO Name

Scope

Purpose

Owner

Security Relevance

9. Authentication

Document:

Domain Authentication

Password / Lockout Controls

Authentication Issues

Logging

10. Privileged Access

Document:

Domain Admins

Other High-Privilege Groups

Delegated Administration

Shared Accounts

11. Findings

For each:

Title

Severity

Observation

Evidence

Risk

Recommendation

Active Directory Security Checklist

Domain

Identified domain
Identified domain controllers
Understood domain purpose
Documented criticality

Organizational Units

Reviewed OU structure
Reviewed object placement
Reviewed delegated administration
Reviewed policy alignment

Users

Groups

Privileged Access

Reviewed Domain Admins
Reviewed other privileged groups
Reviewed administrative identities
Reviewed shared privileged accounts
Applied least-privilege thinking

Service Accounts

Computers

Reviewed computer inventory
Reviewed server objects
Reviewed workstation objects
Identified stale computer objects

Authentication

Understood domain authentication
Understood Kerberos concept
Reviewed password policy concepts
Reviewed lockout concepts
Understood DNS dependency

Group Policy

Logging

Reviewed authentication events
Reviewed account-management events
Reviewed group changes
Reviewed privileged activity concepts
Understood SIEM integration

Reporting

Career Connection

This lab supports roles such as:

Windows Administrator

Active Directory Administrator

IAM Engineer

Identity Security Engineer

SOC Analyst

Security Engineer

Microsoft Security Engineer

Incident Responder

Interview Scenario 01

What is Active Directory?

A centralized directory and identity-management platform commonly used to manage:

Users

Computers

Groups

Authentication

Authorization

Policies

Interview Scenario 02

Why are Domain Admin accounts sensitive?

Because they can have broad administrative authority over domain resources and identity infrastructure.

Interview Scenario 03

What is the purpose of an OU?

To organize objects and support:

Administration

Delegation

Group Policy

Interview Scenario 04

Why use groups instead of assigning permissions directly to users?

Groups improve:

Scalability

Consistency

Access Reviews

Role-Based Authorization

Interview Scenario 05

Why is DNS important to Active Directory?

Active Directory relies heavily on DNS for locating domain services and supporting domain operations.

40 Active Directory Interview Questions

What is Active Directory?
What is a domain?
What is a domain controller?
Why are domain controllers critical?
What is an OU?
Why are OUs used?
What is a user object?
What is a computer object?
What is a group?
What is a security group?
What is group scope?
What is privilege creep?
What is Domain Admins?
Why should Domain Admin membership be limited?
Why should shared admin accounts be avoided?
What is delegated administration?
What is least privilege?
What is a service account?
Why should service accounts be dedicated?
What is a managed service-account concept?
What is domain authentication?
What is Kerberos?
What is NTLM?
Why is DNS important for Active Directory?
What is Group Policy?
What is a GPO?
How do OUs relate to Group Policy?
What is GPO inheritance?
What is security filtering?
What is account lockout?
Why are stale accounts risky?
Why are stale computer objects important?
What is an administrative identity?
Why separate admin and normal user accounts?
What should be logged in Active Directory?
How would you investigate a new account?
How would you investigate a privileged group change?
How would you troubleshoot user authentication?
How would you review service-account security?
How would you assess Active Directory security?

Final Active Directory Mental Model

Remember:

DOMAIN
  ↓
DOMAIN CONTROLLER
  ↓
USERS + COMPUTERS
  ↓
GROUPS
  ↓
AUTHENTICATION
  ↓
AUTHORIZATION
  ↓
GROUP POLICY
  ↓
LOGGING
  ↓
SECURITY REVIEW

For identity security:

WHO EXISTS?
    ↓
WHO CAN LOGIN?
    ↓
WHICH GROUPS?
    ↓
WHO IS PRIVILEGED?
    ↓
WHICH POLICIES APPLY?
    ↓
WHO CHANGED WHAT?

Mission Accomplished

You have completed the first Microsoft security lab.

You can now connect:

Active Directory Architecture

Users

Groups

Computers

Organizational Units

Authentication

Privilege

Service Accounts

Group Policy

Security Logging

into a single enterprise identity-security model.

The key lesson is:

Active Directory Security
Is Primarily About
Controlling Identity and Privilege

not merely creating users.

What’s Next?

➡️ Lab 02 — Endpoint Security

In the next lab, you will move from centralized directory identity into the devices users actually work from.

You will assess:

Windows Endpoint
      ↓
Device Identity
      ↓
Accounts
      ↓
Local Administrators
      ↓
Updates
      ↓
Disk Encryption
      ↓
Firewall
      ↓
Endpoint Protection
      ↓
Applications
      ↓
Security Logs
      ↓
Compliance
      ↓
Security Findings

Your Microsoft lab sequence continues:

Lab 01 — Active Directory
        ↓
Lab 02 — Endpoint Security
        ↓
Lab 03 — Identity Security
        ↓
Lab 04 — Microsoft 365 Security
        ↓
Lab 05 — Windows Security
        ↓
Runbook 01 — Active Directory Assessment
        ↓
Runbook 02 — Microsoft 365 Security Review
        ↓
Runbook 03 — Windows Security Assessment