Important Definitions

Domain Controller - The domain controller is a physical machine within a active directory and it contains all information with respect to that domain. This contains all the users and their password hashes, so if one were to compromise the DC, then the entire domain will be compromised.

Domain - Every instance of active directory has a domain. The domain has a name such as particle42.com. Various types of objects can be added to a domain.

Organizational Unit - These are comparable to file system folders in which objects can be grouped and contained. These help domains to keep th objects organized.

Objects - There can be a variety of objects such as user objects, computer objects.

Attributes - The objects can have various attributes such as a user object can have first name, last name, username, password, etc.

DNS - Every active directory has a DNS hosted within the domain controller. This DNS is authoritative for that domain.

Groups - Groups are used for organizing the users and their permissions. In order to compromise a domain, its best to target the users that belong to the high value groups.

LocalSystem Account - The LocalSystem account is a predefined local account used by the service control manager.It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects.

LocalService Account - The LocalService account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network.

NetworkService Account - The NetworkService account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has minimum privileges on the local computer and acts as the computer on the network.

Service Principle Name (SPN) - A service principal name (SPN) is a unique identifier of a service instance such as MSSQL, IIS, etc. This is important as SPNs can be enumerated to eliminate the process of running a broad scan across a network.