Active Directory

What is Active Directory?

Active Directory (AD) is Microsoft’s directory service that centrally controls, within a Windows domain, who may sign in (authentication), what that user or computer is allowed to do (authorisation) and which settings apply to devices (management). AD arrived in February 2000 with Windows 2000 and has since been the backbone of identity management in almost every Windows-based IT environment. Because HMIs, SCADA servers, historians and engineering stations usually run Windows as well, AD increasingly sits at the heart of OT networks. That makes it a powerful management tool, but also one of the most attractive targets for attackers.

🧠 How does Active Directory work?

An AD environment runs on one or more domain controllers: Windows servers with the Active Directory Domain Services (AD DS) role. They hold the directory database and replicate changes between themselves, so that any domain controller can authenticate users. The process in five steps:

1. Sign-in - a user signs in with a domain account. A domain controller checks the password, smart card or Windows Hello for Business credential.
2. Kerberos ticket - the domain controller issues a Ticket Granting Ticket. The computer then uses it to request service tickets for file shares, SQL servers or SCADA applications without sending the password again.
3. Authorisation - group memberships carried in the ticket determine which rights the user receives. This is the basis for RBAC.
4. Policy - through Group Policy Objects (GPOs), AD enforces settings such as password policy, screen locking, firewall rules or blocking USB storage.
5. Lookup - applications query the directory over LDAP, and clients locate domain controllers through DNS records. That is why the DNS role often runs on the domain controller itself.

Kerberos is sensitive to time differences: by default, a client clock may deviate by no more than 5 minutes from the domain controller’s clock. A reliable time source via NTP is therefore not a detail. The older NTLM protocol only remains as a fallback. Microsoft removed NTLMv1 from Windows 11 24H2 and Windows Server 2025, and NTLMv2 is deprecated.

🧱 What are the building blocks of Active Directory?

AD has a logical and a physical structure. The main building blocks:

AD is largely multi-master: every domain controller accepts changes. Five tasks, however, are assigned to a single server: the FSMO roles. Per forest these are the schema master and domain naming master; per domain the RID master, PDC emulator and infrastructure master. The first domain controller holds all five by default. The PDC emulator of the forest root domain is also the top time source for the entire forest.

Alongside AD DS there are related roles such as AD CS (certificate services, see Certificate Management), AD FS (federation and single sign-on) and AD LDS (a lightweight LDAP directory without a domain). The cloud service Entra ID, formerly Azure AD, is a different product that can synchronise with AD.

🔍 What is the difference between Active Directory and LDAP?

AD therefore speaks LDAP: an HMI package, firewall or VPN gateway that supports “LDAP authentication” can authenticate directly against AD. Use LDAPS (or StartTLS): with a plain LDAP simple bind, the password otherwise crosses the network in readable form. LDAP signing and channel binding on the domain controllers additionally protect against relay attacks.

🏭 How is Active Directory used in OT networks?

In factories, water treatment plants and energy installations, AD is mainly used for:

• Personal accounts on engineering stations - instead of a shared operator or admin account, so that logging shows who changed a PLC program.
• Access management for SCADA and HMI - many SCADA packages map user roles to AD groups, so that an operator can only operate while an engineer can also configure.
• Network access - with 802.1X, a RADIUS server (for example Microsoft NPS) checks the AD account or computer certificate before a switch port opens.
• Group Policy - centrally enforcing hardening settings on dozens of Windows stations in line with security baselines.
• Remote access - remote access for suppliers through a jump server with AD accounts and temporary group memberships.

The common design choice is a separate OT domain in its own forest at level 3 of the Purdue Model, without a trust relationship with the corporate domain. Users then have two accounts, but a compromised IT domain does not give a direct route into the control systems. Systems that must still talk to IT sit in the IDMZ.

⚠️ Why is Active Directory such a popular target?

Whoever becomes domain administrator controls every computer in the domain. Attackers therefore use AD for lateral movement and to deploy ransomware in a single sweep. In September 2024, ASD’s ACSC, CISA, NSA and the Canadian, UK and New Zealand cyber security centres jointly published Detecting and Mitigating Active Directory Compromises, covering 17 common techniques. Some of them:

Two examples show the impact. In the NotPetya outbreak of 2017, the malware used a modified version of Mimikatz to extract credentials from memory and spread via PsExec and WMI all the way to domain controllers; even fully patched systems fell. In December 2019, ransomware at Maastricht University in the Netherlands encrypted 267 servers in the Windows domain, after attackers got in through phishing and gained full administrative rights via a server that lacked a recent security update. The university eventually paid a ransom of 30 bitcoin.

🔐 How do you secure Active Directory in an OT environment?

A practical approach in seven steps:

1. Separate IT and OT - a dedicated OT forest with no trust, behind a firewall, separate VLANs and network segmentation, following the zones and conduits model.
2. Limit administrative rights - apply least privilege, keep the Domain Admins group almost empty and use separate admin accounts. In its Enterprise Access Model, Microsoft calls domain controllers and their administrators the control plane (formerly Tier 0).
3. Manage privileges - use PAM and workstations dedicated to administration; place suppliers in time-limited groups.
4. Strong authentication - smart cards, Windows Hello for Business or MFA on the jump server; put administrators in the Protected Users group.
5. Local passwords - deploy Windows LAPS, built into Windows since the 11 April 2023 updates, so that every station has a unique local administrator password.
6. Monitor - forward domain controller events to a SIEM, for example 4771 (Kerberos pre-authentication failed), 4776 (NTLM credential validation), 4769 (Kerberos service ticket request) and 4728 (member added to a security-enabled group).
7. Practise recovery - make offline or immutable backups of the system state of at least two domain controllers and test restoration as part of disaster recovery.

Watch the lifecycle too. Windows Server 2012 and 2012 R2 stopped receiving regular updates after 10 October 2023, and extended support for Windows Server 2016 ends on 12 January 2027. Domain controllers belong in regular patch management, even when the HMIs around them do not yet.

🧭 What do IEC 62443 and Dutch law require?

IEC 62443-3-3 requires, under Foundational Requirement 1, identification and authentication of users (SR 1.1) and account management (SR 1.3); FR 2 requires authorisation enforcement (SR 2.1). A well-designed OT domain is often the simplest way to meet these for Windows systems. For PLCs and network devices that do not support AD, local or RADIUS-based account management remains necessary.

In the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet) has been in force since 15 August 2026. It transposes NIS2 and requires essential and important entities to take appropriate measures covering, among other things, access control, MFA and backups. A compromised domain almost always affects continuity and may therefore fall under the reporting obligation.

❓ Frequently asked questions

What is the difference between Active Directory and Entra ID?

Active Directory is the on-premises directory service that uses domain controllers, Kerberos, LDAP and Group Policy. Entra ID, formerly Azure AD, is Microsoft’s cloud service that works with modern protocols such as OAuth 2.0, OpenID Connect and SAML. Many organisations synchronise their Active Directory to Entra ID, but isolated OT networks usually keep a local Active Directory.

Does an OT network need its own Active Directory?

A dedicated Active Directory for OT, in a separate forest with no trust to the corporate domain, is the recommended setup in most OT security guidance. That way, a breach of the IT domain does not automatically hand over administrative rights on HMIs and engineering stations. Small installations with only a few stations can sometimes manage with well-administered local accounts.

Which ports does Active Directory use?

Active Directory uses, among others, port 88 (Kerberos), 389 (LDAP), 636 (LDAPS), 3268 and 3269 (Global Catalog), 53 (DNS), 445 (SMB) and 135 plus the dynamic RPC range 49152–65535. Firewalls between OT zones and the domain controllers therefore often need more open ports than for other services. Restrict those rules to the domain controllers and the systems that genuinely need them.

What are FSMO roles in Active Directory?

FSMO roles are five tasks in Active Directory that are always performed by a single domain controller: schema master, domain naming master, RID master, PDC emulator and infrastructure master. The first two exist once per forest, the other three once per domain. If that domain controller fails, you can transfer or seize the roles on another domain controller.

Why must the krbtgt password be reset twice?

Active Directory stores both the current and the previous password of the krbtgt account so that existing Kerberos tickets remain valid. After a single reset, a forged Golden Ticket therefore still works. Only after a second reset, separated by at least the maximum ticket lifetime of 10 hours by default, are old tickets invalidated.

Is NTLM still safe in Active Directory?

In Active Directory, NTLM is only a fallback for legacy systems and is vulnerable to pass-the-hash and relay attacks, among others. Microsoft has removed NTLMv1 from Windows 11 24H2 and Windows Server 2025 and deprecated NTLMv2. In OT, inventory which older HMIs or applications still rely on NTLM before you block it.

📌 In summary

Active Directory centrally controls who may sign in to a Windows environment, what that person may do and which settings apply, making it both the key to administration and the prime target for attackers. In OT, AD works best as a separate forest with no trust to IT, with strict segmentation, minimal administrative rights, Windows LAPS, security monitoring through a SIEM and tested backups of the domain controllers. That way AD supports the requirements of IEC 62443 and the Dutch Cybersecurity Act instead of becoming a highway for ransomware.