For all networks, systems administrators must keep track of who is accessing the network as well as control each user’s access to the various network resources. In most networks, information about users and their access rights are stored in a directory that provides user authentication and access control services. A directory service typically contains sensitive information about the user and service accounts that have access to the enterprise network and information regarding directory-enabled applications and services as well as other network resources. This information is sensitive in that the unregulated disclosure and/or disruption in the provision of this information and related services can interfere with business operations.
The Administrator Shortcut Guide to Active Directory Security