What Active Directory is: domain, forest, OU
You read CORP.LAB’s root (rootDSE), set up querying without putting the password on the command line, decode the OU tree and an object’s distinguished name (DN), narrow the search scope, count objects and read group memberships; at the end you list the service accounts and the computer with an old operating system yourself.
Level 201 · 45 min
After the first audit the IT manager asks: "Can you explain the structure of this directory to me? Who is where, which computer is in which department?" For that you need to know AD’s concepts.
Analogy: AD is a company’s organisation chart. The domain (here CORP.LAB) is the company itself. A forest is a group of companies that trust each other, like a holding. An OU (organisational unit) is a department folder: it organises users and computers, and policies (GPOs) are applied to it. Every person, group and computer is an object with attributes: its name, e-mail, last logon time…
You will ask the directory questions with LDAP. LDAP is like a phone-book query: "bring me everything about the person whose name is mehmet.kaya."
What you will do in this lesson
- The directory’s front door: rootDSE
- No password on the command line: ~/.ldaprc and a password file
- The OU tree
- All attributes of an object
- Narrow the search: -b and -s
- How many objects are there?
- Who is in which group? memberOf
- The service account list
- An old operating system
- Short quiz
Skills you will earn
- Identifying the domain and functional level with the rootDSE
- LDAP queries without the password on the command line (~/.ldaprc, -y)
- Reading a secret without echoing it (read -s)
- Mapping the OU structure
- Reading a distinguished name (DN) and attributes
- LDAP search base and scope (-b, -s)
- Counting directory objects (grep -c ^dn:)
- Reading group memberships (memberOf, member)
- Finding computers with out-of-support operating systems
← First audit: get to know the domain, find the privileged accounts · Active Directory security: auditing and hardening · Domain controllers and DNS: SRV records →
Start for free