Active Directory and domain controllers: attacks, tiering, hybrid sync and recovery

What a domain controller does in Active Directory

AD DS stores information about user accounts, such as names and passwords, and about shared resources such as servers, printers and computer accounts. A global catalog holds information about every object in the directory.^5,6,7

Domain controllers also run sign-in. In Windows Server, the Kerberos Key Distribution Center (KDC) runs on every domain controller and uses the AD DS database as its account database. A user who signs in gets a ticket-granting ticket from the KDC.^8,9

Changes replicate. Every domain controller in a domain takes part in replication, and any change to directory data reaches all of them.^2,10

Why ransomware groups target Active Directory

Microsoft says credential theft techniques built to take over privileged access were adopted by ransomware attackers, fueling the growth of human-operated ransomware. It calls privileged access the top security priority at every organization.^11,12

Microsoft says an attacker with privileged access to Active Directory can do irreparable damage in minutes or hours, not days or weeks.¹³

The advisories ask defenders to review domain controllers, servers, workstations and directories for new or unrecognized accounts.²¹

The Australian Signals Directorate wrote the joint guide "Detecting and mitigating Active Directory compromises" with CISA and the NSA, and with the national cyber security agencies of Canada, the UK and New Zealand. It covers the 17 most common techniques used to compromise Active Directory.^22,23,24

Active Directory tiering and privileged access

Three built-in groups hold the highest privilege in Active Directory: Enterprise Admins, Domain Admins and Administrators. Microsoft says that in a well-designed delegation model, Domain Admins membership is needed only in break-glass scenarios.^25,26

Microsoft's enterprise access model builds on the older AD tier model, which focused on containing escalation of privilege in on-premises Active Directory. Tier 0 becomes the control plane and covers all aspects of access control. The model asks for a hierarchy that keeps lower planes from controlling higher ones.^27,28,29

The control plane includes more than the domain controllers. Microsoft says the Microsoft Entra Connect server must be treated as a Tier 0 component.³⁰

Microsoft's hardening guidance for domain controllers and the hosts that manage them:

• Never administer a trusted system from a less-trusted host, and require multifactor authentication for privileged accounts and administrative tasks.³¹
• Allow RDP connections to domain controllers only from authorized users and systems such as jump servers.³²
• Use no web browser on a domain controller. Where Active Directory must stay on-premises only, restrict internet access to and from domain controllers entirely.^33,34
• Patch domain controllers separately from the general Windows estate, because a compromised systems management tool can reach everything it manages.³⁵
• Install domain controllers with the Server Core option, on the newest Windows Server version the organization supports.^36,37

Hybrid identity: Microsoft Entra Connect vs Cloud Sync

Microsoft encourages organizations to migrate from Active Directory to Microsoft Entra ID. It also says most organizations run a hybrid identity model during that transition, with part of their on-premises Active Directory synchronized to the cloud.^38,39

Microsoft offers two sync tools. Entra Connect is an on-premises application. It handles password hash synchronization and pass-through authentication. Cloud Sync is cloud-managed: it synchronizes users, groups and contacts from Active Directory to Entra ID through an on-premises agent.^40,41,42,43

Microsoft calls Cloud Sync the future of synchronization and says it replaces Entra Connect. Its agents need only outbound connections, run in multiples for failover, and synchronize every two minutes. Cloud Sync also handles several disconnected forests without extra sync instances. Microsoft says this supports mergers and acquisitions.^{44,45,46,47,48}

Microsoft says to migrate with its guided tool or a documented manual procedure, and where neither fits, to keep using Connect Sync.⁴⁹

Dates and rules for Entra Connect, from its version history:

• Upgrade to version 2.6.84.0 or later and configure application-based authentication by April 7, 2027. Synchronization stops working after that date if these are not done.^50,51
• Each 2.x version retires 12 months after a newer version is released.⁵²
• All 1.x versions are unsupported, and synchronization on them does not function.⁵³

Windows Server end of support dates for domain controllers

Microsoft recommends running all domain controllers on the newest Windows Server version the organization supports, and decommissioning legacy operating systems first. Each version below follows the Fixed Lifecycle Policy.^37,54,55,56

A domain controller on Windows Server 2016 reaches the end of extended support in January 2027. Mainstream support for Windows Server 2022 ended in October 2026.^55,58

What Active Directory and Entra ID cost

Domain controllers run Windows Server, which Microsoft licenses per core and with Windows Server client access licenses (CALs). Entra Connect is free with an Azure subscription. Entra Connect Health, which monitors the on-premises identity servers, requires Entra ID P1 licenses.^37,59,60,61

Active Directory backup, forest recovery and common mistakes

Microsoft's AD Forest Recovery Guide covers a forest-wide failure in which no domain controller can function normally. It says forest recovery should in many cases be the last option. It also says there is no end-to-end automation for the process.^67,68,69

Recovery restores each domain to its state at the last trusted backup. Users, computers and changes added after that backup are lost.⁷⁰

What Microsoft says to have in place before a failure:

• A documented recovery plan for forest, domain, object and SYSVOL recovery, tested in a lab with production backups and reviewed routinely, for example annually.^71,72
• A practice run in a simulated test environment at least once a year.⁷³
• Regular backups of at least two writeable domain controllers in each domain. A read-only domain controller's backup cannot restore a writeable one.^74,75
• The password of a domain admin account for each domain, and the DSRM password needed for a system state restore.^76,77
• BitLocker recovery keys and other emergency information, available during the recovery.⁷⁸
• Daily logs of AD DS health, so the approximate time of a failure can be found.⁷⁹

Where forest recovery goes wrong:

• Restoring the newest backup. Microsoft recommends backups taken a few days before the failure, because a more recent one can bring dangerous data back into the restored forest.^80,81
• Relying on virtual machine snapshots. Microsoft recommends regular backups as the main means of recovery.⁸²
• Restoring to new hardware from a system state backup. Microsoft does not support restoring a system state backup to a new Windows Server installation.⁸³
• Resetting the krbtgt password once. Microsoft says to reset it twice, with 10 hours between resets.⁸⁴
• Dropping security under pressure. Microsoft warns that the urgency of forest recovery can lead teams to overlook security practices when handling backups.⁸⁵