## Active Directory (AD)

If you work in a corporate environment, you use AD. It allows centralized management of users and computers.
*   **Domain Controller (DC)**: The server running AD (usually Windows Server). It holds the database (`ntds.dit`).

### Core Concepts
1.  **Domain**: A security boundary. e.g., `corp.local`.
2.  **Object**: Anything in the domain (User, Computer, Printer, Group).
3.  **OU (Organizational Unit)**: Folders to organize objects (Sales, HR, IT). You apply policies (GPO) to OUs.
4.  **Forest**: A collection of Domain Trees. The top level container.

### Authentication: Kerberos vs NTLM
*   **NTLM**: The old, challenge-response protocol. Vulnerable to "Pass the Hash".
*   **Kerberos**: The standard. Uses "Tickets".
    *   **TGT (Ticket Granting Ticket)**: Proof you are essentially authenticated.
    *   **TGS (Ticket Granting Service)**: Proof you can access a specific service (like a File Share).
    *   **Attacks**: Golden Ticket (Forging TGTs), Kerberoasting (Stealing Service Account hashes).

### BloodHound
A tool used by both Red and Blue teams to visualize AD relationships. It finds "Attack Paths" (e.g., User A is Admin on Computer B, where Admin C is logged in...).