Active Directory (AD) is the backbone many enterprises lean on for their IT environments. Yet, most organizations rarely govern the directory with the scrutiny necessary.
This was the throughline of a recent webinar with Nitish Deshpande, senior analyst at KuppingerCole, and Robert Kraczek, global strategist at One Identity. The pair made a strong case for mediating admin access to AD, emphasizing just how easily compromised credentials can beget full-blown incidents.
An old punchline that stopped being funny
Rob opened with a line every longtime IT admin would recognize in some version or another: The most secure AD environment is the one with the network cable yanked out of the wall.
With the modern marvel of Wi-Fi, the joke’s lost steam. But not the security risk behind it. Inherited or longstanding environments tend to carry rogue permissions that no one can trace, orphaned accounts with standing privileges no one’s willing to touch.
That unawareness and overpermissioning is exactly where threat actors play and, consequently, lateral movement gets a leg up. Once a single credential is compromised, how far an attacker can travel from there says everything about how well that environment is managed.
This joke also sets up the session’s real argument: Since AD itself can't be taken offline, the practical version of that isolation is air-gapping the administrative layer around it, keeping the directory live while cutting off the direct, unmediated access that makes one compromised account a company-wide problem.
Why the usual solutions fall short
Both Rob and Nitish agreed that native AD tools are built for day-to-day operations but are sorely lacking in risk evaluation and mitigation capabilities, especially since native tools weren’t designed with cloud-app awareness.
Privileged access management (PAM) fills part of this gap, but only to a point: It governs the request for a credential or session but hits a wall in what an admin does once that access is granted. As was explored during the session, tools like multi-factor authentication (MFA) and endpoint security do a good job locking the front door, yet neither eliminates the internal privilege paths available to someone who's already inside, nor gives a complete view of the attack surface.
Native tools and full IGA: Where’s the middle ground?
A useful thread in the conversation explored when identity governance and administration (IGA) tools stop being effective on their own. Nitish described a real gap for organizations in the 500 to 2,000 user range: too far along to rely on native tooling, not quite large enough to justify a full governance deployment.
Rob added that even mature IGA connectors for AD tend to stick to attribute mapping and group syncing without going deep enough to support meaningful delegation.
For deeper AD awareness, products like Active Roles by One Identity prove their worth. The solution is built to pull multiple domains under a centralized view so people can do their jobs without ever touching native AD tools directly, which in turn cleans up the access sprawl that any downstream governance platforms would otherwise have to untangle.
“Agentic AI hit our industry by storm.”
The hot button topic occupying IT teams, conference panels and boardrooms is non-human identities (NHIs). They’re outpacing human users by a significant margin, and shadow IT now exists in these older AD environments, among orphaned service accounts no one knows what to do with, quietly holding privileges most people haven’t realized are exposed. It’s giving AD environments a whole new layer of worry.
Paired with the rapid adoption of agentic AI and unsanctioned tool use across teams, this is pushing groups that used to ignore AD entirely to treat it as a critical resource and genuine business risk.
That’s not to suggest AI is only a liability here. Rob noted how AI can strengthen an organization’s identity posture, moving it closer to the ideal of Zero Trust adoption. But that all hinges on the tech being used properly, with human oversight.
Like onions, AD has layers
Rob fittingly likened modern AD environments to layers of an onion. They start small, accumulating more layers every year until eventually almost no one remembers what’s at their core.
For teams unsure how to move forward, the recommendation was straightforward: “Understand what you don’t know.” Point a tool at your domains and let it run a full audit. Without cleaning anything up yet, use that snapshot to peel back the layers of your AD footprint. Only once that’s done will you be well equipped to establish broader governance measures in your IGA program.
The consistent message from both speakers was that lateral movement is fundamentally an identity problem dressed up as a network one. Unrestricted, standing access to the directory is the exposure most organizations haven't priced in, and closing it off permission by permission may be one of the more realistic steps toward Zero Trust still sitting on the table.
