Explain like I'm five · Security

What is Active Directory?

Active Directory (a directory service) and how to keep it safe, told as a story about the roster office that writes every person, room, and key in one ledger.

kitchen doorkitchen rostercook: may enterstoreroom doorstoreroom rostercook: removedvault doorvault rostercook: may enter?!the cook left the castle last monthevery door keeps its own roster — nobody knows who still holds a key

The castle grew, and now every door keeps its own roster.The cook left last month, but the vault door's roster still has her name. Nobody knows who still holds a key. We need a roster office.

THE CASTLE LEDGERwhoroomkeycookkitchen○maidstoreroom○kingvault○cook (left)—×one ledger at the roster officea one-day passstamped by the officeevery door asks the ledgerpeople, rooms, keys in one ledger — every door trusts only thisone pass stamped in the morning opens doors all day

Active Directory is the office that holds every name and every key at once.People, rooms, and keys go in one ledger, and every door asks it. One one-day pass stamped by the office in the morning opens doors all day.

One ledgerevery person, room, key
Every door asksno guard keeps his own
A one-day passone stamp, all day
So thieves want it mosthold the ledger, hold the castle
the keeper's keythe one key that rewrites the ledgerthe whole castle openswrite thief = king in the ledger, and it is overthe first key every thief goes after

The first thing a thief goes after is the keeper's key.Only one key can rewrite the ledger. Whoever holds it writes himself in as the king, and the whole castle opens. It is the same key as the master key in the vault.

yesterday'spicking up an old passopens doors with someone else's passstealing the stamp itselfprints any pass he likes — even as the kingcopying the whole ledgerwalks out with everyone's password printsno keeper's key needed — a pass or the stamp will dono bell rings: every one of them carries a real stamp

Even without the keeper's key, a pass or the stamp will do.Pick up someone else's pass (a cousin of stealing the wristband), steal the stamp itself and print passes as the king, or copy the whole ledger and walk out with everyone's password prints. Every one carries a real stamp, so no bell rings.

keeper's key in the vaulttwo people, brieflyonly the keys you needthe cook gets no vault keyLOG03:00 king+1watching the office loga new king at 3 a.m. rings the bellchecking the ledger's shapea path from kitchen to vault?guard the keeper's key, and the castle holdsone ledger is handy — and one ledger is the biggest risk

Guard the keeper's key, and the castle holds.The keeper's key lives in the vault, everyone gets only the keys they need, the guard room screen and the gait-watcher read the office log, and we check the ledger's shape for a path from a kitchen key to the vault.

In one breath

Active Directory = the roster office that writes the castle's people, rooms, and keys in one ledger and lets every door ask it. As handy as it is, the keeper's key, the passes, and the stamp become a thief's first target.

An organization's users, computers, groups, and permissions live in one directory (a domain), authenticated with Kerberos tickets. Domain-admin abuse, pass-the-hash/ticket, golden tickets, and directory dumps are the classic attacks, so it is defended with tiering, least privilege, log monitoring, and attack-path analysis.

When grown-ups say it

Directory service
The one ledger. The roster office that writes every person, room, and key in one place. → the castle's roster office
Domain
One ledger's castle. The set of doors and people that trust this one ledger. Several castles, several ledgers.
Domain admin
The keeper's key. The key that rewrites the ledger. A thief's first target. → the master key in the vault
Kerberos ticket
The stamped one-day pass. Get it once in the morning and no door asks again. → the village pass
Group Policy
Castle rules written in the ledger. Rules the office sends to every room at once. In a thief's hands, the rules change too. → the castle's rule scroll
Pass-the-hash / pass-the-ticket
Picking up someone else's pass. Opening doors with a pass or a password print left lying around. → the thief who steals the wristband
Golden ticket
Stealing the stamp itself. With the office stamp, a thief prints passes even as the king. It is not over until the stamp is replaced.
Tiering model
The keeper's key stays in the keeper's room. The keeper's key is never used in an ordinary room like the kitchen, so a thief can never pick it up there. → only the keys you need
Next story
The Note That Borrows the Guest's Wristband →
Want another term as a picture book? Request →