What Is Active Directory? A Business Guide for 2026

If you've ever worked in an office where you sign in to your Windows computer with your work account every morning, you've used Active Directory without realising it. For more than twenty-five years, Active Directory has been the quiet engine behind identity and access management in almost every corporate network. In this article we explain exactly what Active Directory is, how it relates to the modern Microsoft Entra ID, what you still need it for in 2026 and what risks come with it.

What is Active Directory?

Active Directory is Microsoft's directory service for Windows domains. A directory service is essentially a central phone book for your network: it keeps track of which users, computers, printers, groups and folders exist, who has access to what, and who is who on the network. Microsoft introduced Active Directory in 1999 and released it with Windows 2000 Server on 17 February 2000. It replaced the older Primary Domain Controller model of Windows NT.

Its technical backbone consists of three protocols you'll come across often in practice:

• LDAP (Lightweight Directory Access Protocol, versions 2 and 3) for querying and modifying objects in the directory.
• Kerberos for authentication, using tickets so that passwords don't keep travelling across the network.
• DNS for naming and for locating domain controllers.

The server that runs the directory is called a domain controller. A properly set-up network always has at least two, so sign-ins don't grind to a halt if one fails.

What Active Directory is for

Active Directory does three things every organisation needs, but which become unmanageable without a central system:

1. Authentication. Who are you? Your employee signs in once, and the domain controller checks the password, links it to an account and issues a Kerberos ticket. From then on, they don't have to keep re-entering their credentials for servers, folders or printers within the domain.
2. Authorisation. What are you allowed to do? Active Directory manages who has access to which folder, server, application and printer. You don't do this per user, but through groups.
3. Policy. What should your workstation look like? With Group Policy you can roll out rules centrally: the desktop, mapped network drives, security settings, software installation and hundreds of other settings.

In an SME with twenty employees and its own file server, that makes a huge difference: without Active Directory, an administrator would have to set permissions and settings manually for every account, every server and every workstation.

The building blocks: domain, OU, users and groups

Active Directory is organised as a logical structure. The largest unit is a forest; below that sit domains, and below those a hierarchical tree of organizational units (OUs). In practice, an OU is a folder: a department, a location or a role.

Within that structure live the objects that really matter:

• User accounts with a name, password, email address and attributes.
• Computer accounts for every workstation or server that is a member of the domain.
• Groups that bundle permissions together. A typical setup uses a role group (all finance staff) which you then add to a resource group (access to the Finance folder).
• Service accounts for applications that talk to other systems.

A good rule of thumb: never assign permissions to people, always to groups. Otherwise, six months later, nobody knows who was allowed to do what.

Which ports and which infrastructure

Active Directory relies on a number of fixed network ports. They're worth knowing, not only for administrators but for anyone thinking about firewalls and network segmentation:

• 88 for Kerberos authentication.
• 389 for LDAP, and 636 for LDAPS (over TLS).
• 445 for SMB traffic (files and SYSVOL).
• 135 for the RPC Endpoint Mapper, with dynamic RPC ports 49152 to 65535.

In most SME environments, AD traffic sits in an internal network segment that can't be reached directly from the internet. That isn't a luxury, it's a minimum requirement. Leave your LDAP port accidentally open to the outside world and you're asking for trouble.

The difference between Active Directory and Microsoft Entra ID

Everyone runs into this sooner or later: there is also something called Microsoft Entra ID (known as Azure Active Directory until 2023). The names are similar, but they are two different things.

• Active Directory Domain Services (AD DS) is on-premises. It runs on a Windows Server in your network, uses LDAP and Kerberos, and is optimised for Windows workstations on the same network.
• Microsoft Entra ID is the cloud version of identity management. It runs in Microsoft's data centres, handles access to Microsoft 365, SaaS apps and web applications, and uses modern protocols such as OAuth 2.0, OpenID Connect and SAML.

Importantly, Entra ID has no organizational units, no Group Policy and no Kerberos in the classic sense. It isn't a newer version of AD, but a different platform with a different purpose.

In practice, we see three scenarios at SMEs:

1. On-premises AD only. Businesses with lots of Windows servers, their own file server and little cloud use.
2. Hybrid. AD stays in the network for workstations and internal servers, but users are synchronised to Entra ID via Microsoft Entra Connect. That way you can use your work account to sign in to both your network drive and Microsoft 365. This is by far the most common setup.
3. Cloud-only. No more on-premises AD; everything runs through Entra ID and Microsoft Intune. For most SMEs this is where things are heading, but the switch only pays off if your older applications can handle it.

Our guide to setting up a modern workplace goes deeper into that choice, and our guide on server or cloud helps you weigh up whether to stay put or migrate further.

When do you still need Active Directory in 2026?

A fair question, given how much work now happens in the cloud. The short answer: you mainly still need classic AD if you:

• Have your own file server or application server that users need permissions on.
• Use older line-of-business software that only supports Windows authentication (think accounting, ERP or industry-specific packages).
• Use Group Policy to configure workstations and servers tightly.
• Want to manage printers, network drives or legacy systems through the domain.

Do you run purely on Microsoft 365 and SaaS applications, with your workstations managed through Intune? Then the business case for on-premises AD has become weaker. But moving fully to the cloud isn't a Friday-afternoon job: it affects printers, scanners, old apps, scripts and habits.

According to figures from Statistics Netherlands (CBS), in 2024 71 percent of Dutch businesses with more than ten employees used cloud services, as did 49 percent of businesses with two to ten employees. So the cloud is standard, but many of those businesses still have a working AD environment in-house at the same time.

Security: why Active Directory is an attractive target

Active Directory is a favourite target for attackers, and not without reason. At an estimated 95 percent of Fortune 500 and Fortune 1000 companies, it is the source of truth for identities. Whoever compromises AD generally has the whole company in their hands. According to the Verizon Data Breach Investigations Report 2025, 74 percent of breaches involved compromised identities.

At the end of 2025, Microsoft published extensive guidance on six critical threats to Active Directory Domain Services:

• Unpatched vulnerabilities. Known security flaws in domain controllers or clients that haven't been fixed in time.
• Authentication relay attacks. Abuse of NTLM and Kerberos to act as another user.
• Kerberoasting. Attacks on service accounts with weak passwords, often via offline brute-forcing.
• Excessive privileges. Accounts with more rights than strictly necessary, often a legacy leftover.
• Unconstrained delegation. An old Kerberos feature that is still enabled far too often and exposes entire ADs.
• Golden Ticket attacks. Forging Kerberos tickets using the stolen KRBTGT hash, allowing an attacker to impersonate any user indefinitely.

The practical measures we put in place in every SME environment look like this: phase out NTLM wherever possible, enforce SMB signing, use Group Managed Service Accounts (gMSA) instead of manual service accounts, reset the KRBTGT password every 180 days, and keep a tight grip on the path to Domain Admin through tiered administration. Our cybersecurity checklist for SMEs and our guide to zero trust security go further into those measures.

Common mistakes in SME AD environments

At SMEs we keep seeing the same mistakes, often dating back to the years when the business was still small:

1. A handful of people became Domain Admin and nobody ever removed them. That is a major risk factor.
2. Service account passwords stay unchanged for years. That makes Kerberoasting child's play.
3. An OU structure that no longer bears any relation to the organisation. Group Policy gets tangled and nobody dares to clean it up.
4. No second domain controller. One fails, and the whole office stops.
5. Patches that get done "at some point". Until one day a vulnerability does get exploited.

An annual AD health check by an external party catches these mistakes before they turn into an incident. See also our guide to patch management for update discipline, and our MFA implementation guide for what else you should set up around AD.

Frequently asked questions about Active Directory

What is Active Directory in simple terms?

Active Directory is the central directory that Windows networks use to keep track of who the users are, which computers they can sign in to, which groups they belong to and what they're allowed to open. Sign in once on your workstation and Active Directory automatically gives you access to the network drives, printers and internal applications you have permissions for.

Is Active Directory the same as Microsoft Entra ID?

No. Active Directory Domain Services runs on-premises in your network and uses Kerberos and LDAP. Microsoft Entra ID (formerly Azure Active Directory) runs in the cloud and uses modern protocols such as OAuth and SAML for Microsoft 365 and SaaS applications. Many SMEs have both and synchronise them via Microsoft Entra Connect.

Who needs Active Directory?

Almost every organisation with its own Windows server, a file server, older line-of-business software or a need to configure workstations centrally with Group Policy. If you work purely in Microsoft 365 with no servers of your own and no legacy software, a cloud-only setup with Entra ID and Intune may be enough.

How many domain controllers do you need?

At least two, even in the smallest SME. With a second domain controller, sign-ins keep working if one goes down because of an outage, an update or a power cut. An environment with only one controller is an outage waiting to happen.

Is Active Directory secure?

Active Directory is technically secure, but it is the most attacked part of the Windows ecosystem. Attacks such as Kerberoasting, Golden Ticket and NTLM relay are only possible when the configuration is sloppy. With tiered administration, gMSAs, MFA, a 180-day KRBTGT reset and strict patching, the risk stays manageable.

Can I get rid of Active Directory and do everything in the cloud?

Sometimes, but often not straight away. If you have your own file server, local apps or printers that run through the domain, you need to replace those first. A cloud-only workplace with Microsoft Entra ID and Intune works perfectly well for modern office-based businesses, but the move is a project involving testing, training and phasing out. We run these projects in phases so that work carries on uninterrupted.

Conclusion

Active Directory isn't an old relic; it's still the foundation many Dutch SMEs run on. Set it up well and you get central management, fast onboarding, predictable permissions and an auditable environment. Let it slide and you get excessive permissions, forgotten service accounts and an attractive target for Kerberoasting and Golden Ticket attacks. The future increasingly lies with Microsoft Entra ID and cloud-only workplaces, but for most SMEs the hybrid setup will remain the norm for the next few years.

Want to know how healthy your Active Directory is, or are you considering a move towards a hybrid or cloud-only identity platform? TRON Group carries out AD health checks, cleans up outdated permissions and service accounts, sets up Microsoft Entra Connect properly and guides migrations to the modern workplace while your business keeps running as usual. Call us on +31 85 303 5869 or visit our Cyber Security page to see what we can do for your identity and access management.