Active Directory compromise

In the vast majority of companies, a directory centralizes user, computer and service accounts, along with each one's rights: it decides who can log in where and do what. Whoever controls the directory controls the network. That is why an attacker's progression, after initial access, almost always aims at domain administrator rights. Once at that level, the attacker can create accounts, disable protections, deploy ransomware to every machine in a single operation, and even forge valid authentication tokens at will, so-called golden tickets, allowing a return after an apparent cleanup. Remediation is then heavy: restoring backups is not enough; the directory must be rebuilt from a clean state, all secrets reset, and checks made that no backdoor remains, which can take weeks. Cybersecurity agencies publish hardening guides, and notably recommend tiering administrator accounts, limiting their use and monitoring sensitive changes. For insurance, the state of the directory is one of the best indicators of an intrusion's potential severity: a poorly administered directory turns a local incident into a total loss.