# 1.3 - Logical Components of AD

## **AD DS Schema**

\
The schema defines the structure and rules for objects stored in Active Directory. It is critical for maintaining consistency and ensuring the directory can adapt to organizational needs.

### **Key Features**

* **Object Classes**:\
  Define entities like users, computers, and groups. For example, a "User" object class includes attributes such as `Username`, `Email`, and `Group Membership`.
* **Attributes**:\
  Specify properties of objects. Each object class has mandatory and optional attributes.
* **Extensibility**:\
  Administrators can extend the schema to include custom attributes or object classes as business requirements evolve.
* **Replication**:\
  Schema updates are replicated across all domain controllers in the forest to ensure uniformity.
* **Practical Example**:\
  When deploying a custom application, you might extend the schema to include new attributes (e.g., "Application License Key") tied to user accounts.

<div align="left"><figure><img src="https://github.com/nverma12345/Certified-Red-Team-Professional-CRTP---Notes/blob/main/.gitbook/assets/image%20(127).png" alt=""><figcaption><p><a href="https://info.varonis.com/hubfs/Imported_Blog_Media/domain-forest@2x.png?hsLang=en">https://info.varonis.com/hubfs/Imported_Blog_Media/domain-forest@2x.png?hsLang=en</a></p></figcaption></figure></div>

## **Domains**

\
Domains are foundational units in AD, providing a centralized boundary for management, security, and replication.

### **Key Features**:

* **Organizational Boundary**:\
  Each domain groups objects under a shared namespace (e.g., `example.com`).
* **Security Boundary**:\
  Domains enforce access control and authentication policies, ensuring users only access permitted resources.
* **Trust Relationships**:\
  Enable collaboration across domains while maintaining distinct security boundaries.
* **Namespace Management**:\
  DNS integration allows resources to be easily discovered and accessed.

**Real-World Usage**:\
A multinational organization might have separate domains for each region (e.g., `europe.example.com`, `asia.example.com`), each with its administrative team and policies.

## **Trees**

\
A tree is a hierarchical structure comprising a parent domain and its child domains, sharing a contiguous namespace.

### **Key Features**

* Domains within a tree automatically trust each other through transitive trust relationships.
* Useful for managing organizations with multiple departments or geographic locations while maintaining a unified structure.

## **Forests**

\
Forests represent the top-level logical boundary in Active Directory. A forest can contain multiple trees, each with distinct namespaces, but sharing the same schema and Global Catalog.

### **Key Features**

* Acts as the ultimate security boundary; inter-forest communication requires explicit trust configurations.
* Forest-wide policies apply uniformly across all domains.

## **Organizational Units (OUs)**

<figure><img src="https://github.com/nverma12345/Certified-Red-Team-Professional-CRTP---Notes/blob/main/.gitbook/assets/image%20(124).png" alt=""><figcaption><p><a href="https://www.conceptdraw.com/examples/active-directory-policy-structure">https://www.conceptdraw.com/examples/active-directory-policy-structure</a></p></figcaption></figure>

\
OUs are containers within domains used to organize objects logically for administrative purposes.

### **Key Features**

* Allow delegation of administrative responsibilities without granting full domain-level access.
* Enable application of specific Group Policy Objects (GPOs) to subsets of users or computers.

**Example**:\
A company might create separate OUs for "Finance," "HR," and "IT," each with tailored policies and administrative controls.

## **Trusts**

<figure><img src="https://github.com/nverma12345/Certified-Red-Team-Professional-CRTP---Notes/blob/main/.gitbook/assets/image%20(125).png" alt=""><figcaption><p><a href="https://learn.microsoft.com/it-it/entra/identity/domain-services/media/concepts-forest-trust/forest-trusts-diagram.png">https://learn.microsoft.com/it-it/entra/identity/domain-services/media/concepts-forest-trust/forest-trusts-diagram.png</a></p></figcaption></figure>

\
Trusts allow users in one domain or forest to access resources in another securely.

### **Types**

* **Transitive Trusts**: Automatically established within a forest.
* **External Trusts**: Configured between forests or standalone domains.

**Practical Use**:\
Trusts are essential for mergers or partnerships where resource sharing is needed while retaining separate administrative boundaries.

## **Objects**

Objects are the individual elements within AD, representing entities like users, groups, computers, and printers.

### **Key Features**

* Each object belongs to a specific class and is identified by a unique name (e.g., a user's `samAccountName`).
* Attributes define the characteristics and functionality of objects.

## **Forests and Domain Trusts**

<figure><img src="https://github.com/nverma12345/Certified-Red-Team-Professional-CRTP---Notes/blob/main/.gitbook/assets/image%20(126).png" alt=""><figcaption><p><a href="https://learn.microsoft.com/it-it/entra/identity/domain-services/media/concepts-forest-trust/kerberos-over-forest-trust-process-diagram.png">https://learn.microsoft.com/it-it/entra/identity/domain-services/media/concepts-forest-trust/kerberos-over-forest-trust-process-diagram.png</a></p></figcaption></figure>

Trust configurations extend collaboration and resource sharing across forests.

**Complexity and Security**:\
Managing trust relationships requires careful planning to avoid unintended access or security gaps.

## Difference between OUs and Security Groups

**OUs (Organizational Units)** are used to organize and manage objects (like users and computers) within a domain. They help with delegating administrative tasks and applying group policies but don’t control access to resources.

**Security Groups** are used to manage access to resources, such as files or applications. Users are grouped based on the permissions they need, and access is granted based on group membership.

**Example**: You could have an OU called "HR" to manage HR users, while a "Finance" Security Group might control access to sensitive financial files. OUs organize, while Security Groups manage permissions.
