Skip to content
Cyber Data Services logo
Article · 8 min read

Role of AD in IT/OT Segregation

Cyber Data Services · 2026-08-02

Active Directory is the backbone of enterprise identity — but extending it carelessly into operational technology erases the very boundary that keeps industrial systems safe. This article explains how AD should be designed, trusted, and administered to reinforce IT/OT segregation rather than undermine it.

1. Why IT/OT segregation matters

Operational technology (OT) runs the physical processes behind energy, oil & gas, utilities, manufacturing, and telecom. Unlike IT, an OT compromise can halt production or cause physical harm. Standards such as IEC 62443 and the Purdue Enterprise Reference Architecture therefore call for clear zones and conduits between enterprise IT (Levels 4-5) and control systems (Levels 0-3).

Segregation is not only a network-layer concern. Identity is the most common lateral-movement path in modern intrusions: an attacker who compromises an enterprise workstation and reaches a domain controller can often pivot straight into OT if the two share an identity fabric. Active Directory (AD), as the dominant enterprise identity provider, sits squarely on this fault line.

2. The dual role of Active Directory

AD delivers authentication, authorisation, and policy (Group Policy) at scale. Within OT it can bring real benefits: centralised accounts for HMIs and engineering workstations, consistent hardening via GPO, certificate services, and auditable access — replacing shared local logins and unmanaged credentials.

The risk is that the same directory which unifies IT also becomes a single identity plane spanning the IT/OT boundary. The design goal is to gain AD’s management benefits inside OT while ensuring a breach of enterprise AD does not automatically grant control of the plant.

3. Separate the forests

The foundational control is a dedicated OT Active Directory forest, independent of the enterprise (IT) forest. Domain controllers for OT live inside the industrial zone (typically a Level 3 / OT DMZ) and never authenticate enterprise users.

  • Give OT its own forest/domain, its own DCs, DNS, and PKI — hosted within the OT zone.
  • Do not extend the enterprise forest into OT, and do not place OT DCs in the corporate data centre.
  • Prefer no trust between the IT and OT forests. Where limited interoperability is unavoidable, use a one-way, selective-authentication trust (IT trusts nothing from OT), never a bidirectional forest trust.

4. Tiered administration and privileged access

Adopt Microsoft’s tiered administration model so that credentials never span trust boundaries. Tier 0 (identity control-plane: domain controllers, AD admins) must be isolated, and OT administration must not be performed from IT-tier machines.

  • Use dedicated Privileged Access Workstations (PAWs) for OT administration — never a general enterprise laptop.
  • Enforce a hardened jump host in the OT DMZ as the only path for interactive access into OT, with MFA and session recording.
  • Keep separate admin identities per tier; an enterprise Domain Admin should have no standing rights in OT.
  • Apply LAPS (or an equivalent) for local administrator passwords on OT endpoints.

5. Hardening OT with Group Policy

A dedicated OT forest lets you apply Group Policy tuned for industrial reliability rather than corporate convenience: application allow-listing, removable-media control, disabling unused services and legacy protocols (e.g., SMBv1, LLMNR/NetBIOS), and restricting outbound connectivity. Change windows and testing are essential — OT availability constraints mean GPO changes must be validated before rollout.

6. Monitor the directory

Treat the OT directory as a critical asset. Forward domain-controller security logs to a SIEM, alert on privileged group changes, Kerberos anomalies, and new trust creation, and baseline normal authentication so lateral movement stands out. Regular AD security assessments against recognised frameworks keep configuration drift in check.

7. Common pitfalls

  • Extending the enterprise forest into OT “temporarily” — it rarely gets undone.
  • Bidirectional or transitive trusts that let an IT compromise authenticate into OT.
  • Reusing enterprise admin accounts or PAWs for OT.
  • Placing OT domain controllers or PKI outside the OT security zone.
  • No monitoring of the OT directory, so credential abuse goes unseen.

8. Conclusion

Active Directory can strengthen IT/OT segregation — or quietly dissolve it. The difference is design: a separate OT forest, minimal and one-way trust, strict tiered administration, purpose-built Group Policy, and continuous monitoring. Implemented well, AD becomes part of the segmentation boundary rather than a bridge across it.

Cyber Data Services designs, deploys, and secures IT/OT identity architectures aligned to IEC 62443 and NIST SP 800-82. Contact info@cyberdatas.com to discuss an assessment of your environment.