Active Directory (AD)
Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions. For Cyber Essentials the servers running it are in scope, and domain administrator accounts count as administrator accounts: A7.6 asks how separate accounts are used for local, domain and cloud admin work.
- Term
- Active Directory
- Also known as
- Active Directory, AD, Windows domain, Active Directory Domain Services
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.6
- Reviewed against
- Requirements v3.3
What does the term Active Directory mean in Cyber Essentials?
Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
How does Active Directory apply to Cyber Essentials?
In plain terms
Active Directory is the central staff register and key cabinet for an office network. When you log in to a work PC with your work username, the PC asks Active Directory whether you are who you say you are and what you are allowed to open. Many organisations now use Microsoft Entra ID, the cloud service that used to be called Azure AD, alongside it or instead of it.
What Cyber Essentials asks
The scheme does not name Active Directory, but it runs through the user access control questions:
- The NCSC requirements say administrator accounts include "domain administrators and local administrators".
- A7.6 asks how separate accounts are used for admin tasks and says it "applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts".
- A7.3 asks how leavers' accounts are deleted or disabled, which for most on-premises networks means disabling them in Active Directory.
- A7.10 and A7.11 cover brute-force protection and password quality. On a Windows domain these are usually set through group policy.
The domain controllers that run Active Directory are servers, so they must be on supported software and patched within 14 days for high-risk and critical updates like any other in-scope server.
Common mistakes
- Domain administrators using their admin account for email and browsing.
- Old accounts for leavers, test users or former suppliers still enabled.
- A password policy that meets none of the three quality options, such as an 8-character minimum with no deny list and no MFA.
See why admin accounts must be separate and A7.6. Related: group policy, LAPS, administrator account.
Related terms
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
Frequently asked questions
Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
In the 2026 Danzell question set, Active Directory comes up at A7.6. Read those questions against the definition above so your answers use the term the way the assessor will.
Active Directory relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.