AUTHENTICATION METHODS IN ACTIVE DIRECTORY AND THEIR IMPACT ON CORPORATE ENVIRONMENT SECURITY

The article provides a comparative analysis of NTLM and Kerberos authentication mechanisms in the Active Directory environment, focusing on their architecture, typical vulnerabilities, and impact on the security of corporate IT infrastructure. A critical review of the main threats and attacks on Active Directory authentication methods is provided, providing the main characteristics and mechanisms for achieving the attacker's goal, which is largely associated with the use of outdated protocols such as NTLM, in particular Pass-the-Hash and Relay attacks. Potential risks associated with incorrect Kerberos configuration are considered, including attacks such as Kerberoasting, Golden Ticket, and access delegation. Based on the analysis of authentication methods in Active Directory, taking into account their features, vulnerabilities and current threats, recommendations have been formulated to strengthen the security of the corporate environment in terms of improving authentication policies, abandoning NTLM, implementing modern approaches to protection (strengthening Kerberos protection), implementing the Zero Trust model, using multi-factor authentication, conducting audits and continuous security monitoring, conducting regular penetration testing and Active Directory configuration audits, focusing on training administrators on secure Active Directory configuration and updates in the field of cyber threats. The proposed measures can be used as a basis for increasing the level of security of domain environments in large organizations. It has been proven that Kerberos is a more secure protocol that provides mutual authentication and uses modern cryptographic algorithms, but in case of incorrect configuration, attacks such as Kerberosting, delegation attacks and ticket manipulation are possible. So,. Effective Active Directory configuration requires a comprehensive approach to the security of authentication mechanisms.