Active Directory & Identity Security
Learn how Active Directory authenticates and authorises users, then audit it the way a defender does: privileged groups, stale accounts, password policy, delegation and service accounts. Government networks run on AD, so a clean AD is the foundation of every other control.
- Level
- Intermediate
- Study time
- 8 hours
- Lessons
- 5
- Practice labs
- 5
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Explain domains, OUs, groups, GPOs, Kerberos and NTLM at concept level
- Identify excessive privilege, stale accounts and weak password policy from an exported listing
- Detect password spraying and Kerberoasting from Windows event extracts
- Recommend tiered administration, MFA and PAM controls
- Produce a prioritised AD hardening plan with fixes and owners
Before you start
Basic Windows administration and networking; familiarity with reading logs
Tools you will use
Course outline
5 lessons in 2 modules.
Module 1: How Active Directory works
- AD building blocks: domains, users, groups and GPOs
- Kerberos and NTLM at concept level
Module 2: Securing and monitoring identities
- Least privilege and tiered administration
- Misconfigurations defenders must find
- MFA, PAM and detection: events and ATT&CK
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
5 practice labs
- Audit the group-membership and user export Beginner, 25 min
- Review the password policy and GPO extract Intermediate, 30 min
- Simulated domain audit console Intermediate, 30 min
- Detect spraying and Kerberoasting in event logs Intermediate, 35 min
- Final: prioritised AD hardening recommendations Advanced, 40 min, final lab
2 assessments
- Active Directory knowledge check
- Active Directory final quiz
The pass mark is 70%. You can retake an assessment.
Take Active Directory & Identity Security
Request access and your instructor will set up your account.