Microsoft Active Directory is a software solution used to manage resources in an organizational environment. The foundational elements of an AD system are its users, computers or servers, and the main server dubbed the Domain Controller. Within Active Directory, administrators are given the leverage to organize their objects in a hierarchical manner, as well as to granularly control and enforce policies on the objects’ behaviour using group policies (Group Policy Objects, GPO). The main structural components of an AD environment are the organizational units, domains, trees and forests which form an organized unit. Alongside the on-premises version of Active Directory, there exists a modern, cloud-based version of AD dubbed Azure Active Directory. Authentication in AD is handled by two protocols: the older NTLM and the more modern Kerberos. Authorization within an AD environment is not handled by the mentioned network protocols, but rather a model of Access Control Lists is used. Due to their implementation flaws and the nature of AD on-premises solution, attacks to these protocols are impossible to mitigate and it is possible for an attacker with little knowledge to persist deep within the network. One of the most famous toolkits for performing AD attacks and, more specifically, attacking the authentication protocols within is Mimikatz, a tool used to extract hashes and tickets from memory and abuse them later. The main principle for defending from these types of attacks is the Principle of Least Privilege model, since it is the defenders’ goal to make the attacker’s path to sensitive information and highly-privileged accounts as difficult as possible. Alongside this, it is necessary to have an up-to-date asset inventory, use firewalls and intrusion prevention systems, as well as per-computer Endpoint Detection and Response (EDR) agents. By combining the aforementioned methodologies and toolsets it is possible to significantly reduce the attack surface, however it is impossible to mitigate it completely.