AD Named
Active Directory vocabulary for YOUR $LAB_AD — domains, forests, and trust literacy, not stranger-domain attacks.
Visual · t19_ad_named
AD = Microsoft directory for users, groups, computers, policies. $LAB_AD only. Original Cyberlium.
Learn what a domain controller is on a lab forest you built — not on your employer's production without a ticket.
Active Directory (AD) stores identity and policy for Windows enterprises: domains, domain controllers (DCs), organizational units (OUs), users, groups, computers, Group Policy, and trusts between domains/forests. Pentest literacy requires naming these objects on YOUR intentional $LAB_AD lab — e.g., lab.local with disposable VMs you snapshot. You will NOT enumerate real university AD, neighbor offices, or internet-exposed LDAP without signed scope. Defender view: AD is crown jewels — protect DCs, tier admin model, and monitor identity events.
1. Core objects
Domain, DC, user, group, computer account, OU, GPO — map to YOUR $LAB_AD lab diagram.
Forest vs domain: forest holds domains; trusts link them — literacy for lab topology only.
Command guide
Try these commands — Core objects
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: dig, curl. Reference sites: AD literacy; MITRE Kerberos (https://attack.mitre.org/techniques/T1558/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why AD matters in pentest
Engagement goals often include assessing identity blast radius — under written RoE on $LAB_AD.
Misconfigurations (weak service accounts, excessive privileges) are findings — not excuses to touch stranger domains.
3. Scope boundary
All AD practice on $LAB_AD VMs you deploy — isolated lab network per course brief.
No LDAP binds, password sprays, or BloodHound imports against organizations you do not own.
4. What you ship: AD vocabulary sheet
Domain/DC/user/group/OU/GPO definitions + $LAB_AD topology sketch + NEVER stranger AD sentence.
5. What you record before the next lesson
AD vocabulary path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run ldapsearch against university AD 'to learn objects.'
- Right: Name AD core objects on $LAB_AD. Next: Enum Concepts.
Mission: AD vocabulary
1) Define domain and DC. 2) Name user, group, computer, OU, GPO. 3) Sketch YOUR $LAB_AD lab topology. 4) Write NEVER stranger production AD.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum $LAB_AD VMs for literacy lab?”
APPLY: Active Directory primarily stores:
APPLY: True or False: Enumerating real employer AD without ticket is lab.
APPLY: Domain controller role includes: