Active › Module 2 › Lesson 1
Forest Domain OU
Forest, domain, and OU name AD hierarchy — map YOUR $LAB_AD layout; defenders use structure for tiering and blast-radius thinking.
Visual · t25_forest_domain_ou
Forest/domain/OU literacy. $LAB_AD only. Original Cyberlium.
Opening
Every AD question starts with 'which forest and which OU?' — structure literacy before any enum graph.
Forest: top security boundary sharing schema and global catalog. Domain: authentication boundary with its own domain controllers. OU (organizational unit): container for users, groups, computers, and linked GPOs — often mirrors department or tier. Cyberlium maps forest/domain/OU on YOUR $LAB_AD with read-only documentation — not LDAP dumps of stranger tenants. Next: Users Groups GPO.
1. Forest vs domain (named)
One forest can hold multiple domains with trusts between them. Schema and configuration partitions span the forest; domain partition holds domain objects. Lab tip: note root domain FQDN and any child domains in $LAB_AD notes.
On $LAB_AD, sketch a tree: forest root → child domain (if any) → default containers vs custom OUs. No live LDAP required — course diagram or GOAD map suffices.
Command guide
Try these commands — Forest vs domain (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AD forest/domain/OU — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology (structure literacy) Microsoft AD DS overview — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services (forest vs domain) adsecurity.org — https://adsecurity.org/ (AD structure security context)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
print('Forest > Domain > OU > Objects — literacy on YOUR lab naming only')
print('Example lab: lab.local forest, DC01.lab.local, OU=Servers,OU=Lab')
PYCommand — copy this
curl -sS https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology | head -8
Primary tools to practice this lesson: curl, python3. Reference sites: AD forest/domain/OU (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology); Microsoft AD DS overview (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. OU purpose (named)
OUs delegate admin and apply Group Policy. Tiering models often place Tier 0 (DCs, identity) in dedicated OUs separate from workstations. Misplaced admin accounts in workstation OUs expand blast radius.
Defenders review OU design in change control; attackers historically hunt paths to Tier 0 — your job is name the containers on YOUR lab map.
3. Literacy supports scope — not stranger recon
Forbidden: LDAP walk of production forest without authorization. Allowed: document forest/domain/OU table for $LAB_AD with one sentence per row explaining purpose.
Ship: structure table — forest, domain(s), three OUs, one-line purpose each. Next: Users Groups GPO.
4. What you ship: forest/domain/OU table for $LAB_AD
Structure table with forest FQDN, domain(s), OUs, purposes. $LAB_AD named. NO stranger LDAP. chmod 600.
5. What you record before the next lesson
Date. Structure table. $LAB_AD named. File t25-m02-l01-forest-domain-ou.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
LDAP enum a corporate forest without scope. Skip OU layer and jump to Kerberoast recipes.
Right
Write forest/domain/OU table from YOUR $LAB_AD map. Next: Users Groups GPO.
Mission: map YOUR AD hierarchy
1) Name forest root FQDN. 2) List domain(s) and three OUs. 3) One-line purpose per OU. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tier 0 OU labels on a lab map teach blast radius fast.
Knowledge Check
APPLY: Forest/domain/OU literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: OU is a container often used for delegation and GPO linking.
True or False
Knowledge Check
APPLY: Forest primarily represents:
Multiple choice