gshc2020.com

In conversations with technology leaders over the last several years, I hear about one concern consistently: that the nearly 30-year-old Active Directory will remain in enterprises for years, but the people who know its history, exceptions and tribal knowledge are nearing retirement.

The concerns about Active Directory are one part of what Deloitte is predicting could be "the largest transfer of institutional knowledge in business history," as more than 30 million Americans turn 65 over the next four years.

I have been working with Active Directory since soon after it launched. Over the years, it has survived every prediction of its decline because it remains deeply useful to onboard employees, manage devices, enforce policy and control access.

My key takeaway from these decades of experience is simple: Technology modernizes faster than organizational knowledge does. Here is what this gap looks like in daily operations, and how leaders can preserve critical expertise before it leaves.

Passing The Active Directory Knowledge Torch

Based on my experience helping organizations manage hybrid Active Directory environments, the most valuable knowledge in an identity ecosystem often lives with the administrator who knows why a certain group policy exists, which service account should never be touched, which legacy application will fail if a permission changes and which script provisions users before anyone logs in for the day.

That context cannot be re-created from a certification course. It was built through years of incidents, fixes, migrations and handoffs. Along the way, senior administrators trained junior administrators, and tribal knowledge moved from person to person.

The next generation of IT talent has been encouraged, understandably, to focus on cloud, cybersecurity and AI. Those skills are essential, but many organizations still operate in a hybrid world where cloud identity and Active Directory work together.

Knowing Entra ID, Intune or modern security tools does not automatically prepare someone to understand decades of Active Directory design decisions.

Knowing Which Scripts Are Running Is Essential

This risk becomes especially clear with scripts.​ Administrators have long used PowerShell to make daily work easier: onboarding users, offboarding employees, creating groups, adding machines and applying policies. Over time, those scripts became part of how the business runs. When they fail, IT operations feel the pain quickly.

Because of this, the next administrator must fully understand the environment around the code. Why does the script run at that time? What system depends on the group it modifies? What happens if the wrong service account password changes? What downstream process breaks if a user lands in the wrong organizational unit?

AI can explain scripts and document processes, but it cannot recover context the organization never captured. If the only person who understood the business impact of a change has left the organization, the model is working from an incomplete map.

A poorly understood Active Directory environment makes daily operations harder to trust. In practice, this can look like new hires getting the wrong access because no one knows which script, group or organizational unit drives provisioning.

It can also make access reviews harder to defend, because teams cannot easily explain why a user has a permission, whether it is still needed or what would break if it were removed.

Hard Lessons Learned From NotPetya

A well-known example of this issue came during Maersk’s recovery from the NotPetya attack.

Its recovery depended in part on finding a single surviving domain controller in Ghana after much of the environment had been damaged. That story is usually remembered as a cybersecurity incident, but it also illustrates a broader identity lesson: When the systems that define trust, access and dependencies are disrupted, recovery depends on knowing how the environment works.

Unmapped scripts, forgotten group policies or calling a retired administrator for help are warning signs that tribal knowledge has become critical infrastructure. Executives must treat this technical debt like any other vulnerable business asset.

Steps For Collecting Active Directory Knowledge

IT operations teams should start with direct questions:

• Who can explain how our Active Directory environment actually works?

• Which scripts and manual processes are essential to daily operations?

• What would happen if our most experienced administrator left tomorrow?

• Could we recover Active Directory after a major outage, ransomware event or destructive misconfiguration?

• Do junior administrators have guardrails, or are they one mistake away from a major disruption?

The answers will reveal where the risk sits.

If no one can explain how Active Directory works, the organization has a documentation gap and should start by mapping critical scripts, groups, service accounts and dependencies.

If only one senior administrator knows the answers, it has a succession gap and should pair newer administrators with experienced owners before that knowledge leaves.

If recovery depends on assumptions instead of tested dependencies, it has an operational resilience gap and should validate recovery plans against how identity actually supports the business.

Critical automation needs ownership, documentation, review and support. Active Directory should be treated as a primary attack surface, not a forgotten legacy system. Recovery planning should reflect how identity actually functions inside the organization, including dependencies that may not appear in a standard diagram.

How Active Directory Will Live On Under New Administrators

Active Directory has lasted for decades because it became deeply useful, customized and interconnected. However, in many organizations, it is also underdocumented.

Companies that manage this transition well will not wait for a broken script, a failed recovery or a security incident to discover what they no longer know. They will capture the knowledge now. ​

To do so, organizations need to rebuild the knowledge pipeline. New administrators need more than access to modern tools. They also need fundamentals, mentorship and exposure to the systems the business still depends on.

The old Active Directory guard will retire, but their knowledge doesn't have to retire with them.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?