Forest Domain OU

Forest, domain, and OU name AD hierarchy — map YOUR $LAB_AD layout; defenders use structure for tiering and blast-radius thinking.

Forest Domain OU• Audio Walkthrough

00:00/03:35

Visual · t25_forest_domain_ou

Forest/domain/OU literacy. $LAB_AD only. Original Cyberlium.

Every AD question starts with 'which forest and which OU?' — structure literacy before any enum graph.

Forest: top security boundary sharing schema and global catalog. Domain: authentication boundary with its own domain controllers. OU (organizational unit): container for users, groups, computers, and linked GPOs — often mirrors department or tier. Cyberlium maps forest/domain/OU on YOUR $LAB_AD with read-only documentation — not LDAP dumps of stranger tenants. Next: Users Groups GPO.

1. Forest vs domain (named)

One forest can hold multiple domains with trusts between them. Schema and configuration partitions span the forest; domain partition holds domain objects. Lab tip: note root domain FQDN and any child domains in $LAB_AD notes.

On $LAB_AD, sketch a tree: forest root → child domain (if any) → default containers vs custom OUs. No live LDAP required — course diagram or GOAD map suffices.

Command guide

Try these commands — Forest vs domain (named)

═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══

Check current user, domain context, and security privileges

Command — copy this

whoami /user /groups /priv

Query active Domain Controller and trust relationships

Command — copy this

nltest /dsgetdc:$env:USERDOMAIN
nltest /domain_trusts

List password policy across the domain

Command — copy this

net accounts /domain

Check Kerberos ticket cache

Command — copy this

klist

═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services

Command — copy this

dig _ldap._tcp.dc._msdcs.lab.local SRV +short
dig _kerberos._tcp.dc._msdcs.lab.local SRV +short

Primary tools to practice this lesson: curl, python3. Reference sites: AD forest/domain/OU (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology); Microsoft AD DS overview (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. OU purpose (named)

OUs delegate admin and apply Group Policy. Tiering models often place Tier 0 (DCs, identity) in dedicated OUs separate from workstations. Misplaced admin accounts in workstation OUs expand blast radius.

Defenders review OU design in change control; attackers historically hunt paths to Tier 0 — your job is name the containers on YOUR lab map.

3. Literacy supports scope — not stranger recon

Forbidden: LDAP walk of production forest without authorization. Allowed: document forest/domain/OU table for $LAB_AD with one sentence per row explaining purpose.

Ship: structure table — forest, domain(s), three OUs, one-line purpose each. Next: Users Groups GPO.

4. What you ship: forest/domain/OU table for $LAB_AD

Structure table with forest FQDN, domain(s), OUs, purposes. $LAB_AD named. NO stranger LDAP. chmod 600.

5. What you record before the next lesson

Date. Structure table. $LAB_AD named. File t25-m02-l01-forest-domain-ou.txt chmod 600.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: LDAP enum a corporate forest without scope. Skip OU layer and jump to Kerberoast recipes.
Right: Write forest/domain/OU table from YOUR $LAB_AD map. Next: Users Groups GPO.

Hands-on Exercise