Active Directory is Microsoft's directory service for Windows networks. It stores information about an organization's user accounts, groups and computers, and it handles authentication and authorization, so users can sign in once and reach the resources they are permitted to use. Domain controllers are the servers that hold and serve this directory.
Because it is central to access across a network, Active Directory is a frequent target once an attacker has a foothold. Stolen or guessed credentials, weak passwords and overly broad administrator rights can let an attacker move from one system to others, and control of the directory can mean control of much of the environment.
A compromise of one server does not automatically mean Active Directory has been compromised. It depends on whether the server is joined to the domain, which accounts and credentials are present on it, what network paths exist to the domain controllers, and how privileged accounts are managed. A web server that is not domain-joined and holds no domain credentials presents a different risk than one that is.
Defenders can reduce risk by limiting administrator accounts and separating their use from daily accounts, enforcing multi-factor authentication where possible, patching domain controllers promptly, restricting network access to them and monitoring for unusual sign-ins and changes to privileged groups. After an intrusion on a domain-connected system, assess whether any domain credentials could have been exposed and reset them as part of the response.