Active Directory Explained like you are ...

#architecture #beginners #computerscience #security

LIKE YOU ARE 5

Imagine Active Directory is a giant Theme Park World:

Forest (The Theme Park World): This is the entire park (like Disney World). Everything inside shares the same master rules, ticket systems, and main security gates.

Domain (The Specific Parks): These are the individual parks inside (like Magic Kingdom or Epcot). Each park has its own manager, but if your ticket works for the World, you can visit them all.

OU / Organizational Unit (The Specific Land/Rides): These are sections inside a single park, like Fantasyland. The manager groups similar rides together here so they can set rules for that whole area at once (like "everyone in Fantasyland must wear hats").

Group (The VIP Clubs): These are wristband groups. Instead of checking every single kid one by one to see if they're tall enough or have a VIP pass, the park puts matching wristbands on a bunch of kids so they can all ride the roller coaster together.

LIKE YOU ARE 10

Forest The Concept: The entire video game world (like Minecraft or Roblox).
The Tech: It holds the Schema (the game's code rules that say what a "player" or "block" is) and the Global Catalog (a cheat map showing where every item in the game is). It uses Transitive Trusts, meaning if Server A trusts Server B, and Server B trusts Server C, then Server A automatically trusts Server C.

Domain The Concept: A specific game server inside that world (like a Survival Server or Creative Server).
The Tech: Controls Security Principals—anything that gets an ID card (SID), like user accounts or computer accounts. It sets the local rules, like how long your password has to be or how Kerberos login tickets work.

OU (Organizational Unit) The Concept: A specific team folder or guild room inside that server.
The Tech: Used for GPO Scoping (sending specific mod settings to just one team) and Delegation of Control (giving a helper mod permission to kick people only in their specific room, instead of giving them full admin power).

Group The Concept: A VIP role badge.
The Tech: Used for RBAC (Role-Based Access Control). Instead of typing every single player's name into a secret door's access list (ACL), you give the door access to the "VIP Badge" group, and just give players the badge.

GPO (Group Policy Object) The Concept: The Server Admin's master remote control.
The Tech: Automatically pushes settings and scripts to computers. Split into two pieces: GPC (the settings listing inside Active Directory) and GPT (the actual script/config files stored in a shared folder called SYSVOL). It processes rules in LSDOU order (Local, Site, Domain, OU)—and whatever rule runs last overrides the older ones.

Red Team Hack ⚡ If you find a user account that has Write Access to a GPO, you win the game. You can inject a secret command into that GPO, wait for the target computers to restart, and the GPO will run your code as the highest level authority (SYSTEM) on every machine in that folder!

LIKE YOU ARE 13

Alright kid, let's break down the actual tech, the jargon, and the acronyms so you know what’s really going on under the hood:

Forest What it is: The top dog. The highest security border in Active Directory.

The Tech: It holds the Schema (the database blueprint defining what objects can exist) and the Global Catalog (GC) (a searchable master index of every object in the whole network). It uses Transitive Trusts, meaning if Domain A trusts Domain B, and Domain B trusts Domain C, Domain A automatically trusts Domain C.

Domain What it is: A boundary for control and login rules.

The Tech: Houses Security Principals—anything the system can authenticate and slap a SID (Security Identifier) onto, like User accounts, Computer accounts, and Service accounts. It enforces a single set of security rules (like Kerberos ticket lifetimes and password length).

OU (Organizational Unit) What it is: A logical folder inside a domain used to group stuff together.

The Tech: Used specifically for GPO Scoping (pointing policies at specific groups of machines/users) and Delegation of Control (giving a low-level admin permission to reset passwords only in that specific folder, without making them a full Domain Admin).

Group What it is: A bucket of Security Principals used for access control.

The Tech: Used for RBAC (Role-Based Access Control). Instead of adding a single user to a file share's Access Control List (ACL), you throw the user into a Group, and give the Group the permissions.

GPO (Group Policy Object) What it is: The remote control for the whole network.

The Tech: A set of configurations pushed out by admins. It splits into two parts: the GPC (Group Policy Container, stored in Active Directory metadata) and the GPT (Group Policy Template, actual files and scripts stored in the SYSVOL network share). Applied via LSDOU order (Local, Site, Domain, OU)—where the last rule applied overwrites the ones before it.

Red Team Pro-Tip 🏴‍☠️
If you ever compromise an account that has Write permissions on a GPO, you win. You can attach a malicious startup script to that GPO, wait for the target machines to reboot, and instantly get system-level shell access across every box linked to that OU.