Directory services are the master list of a company's users, computers, groups and permissions, which other systems check whenever someone logs in or opens a shared file. The best-known directory is Microsoft's Active Directory, which most large companies have run for decades. A directory is also called an identity store.
Each entry in the directory describes one user or one device. For an employee, it holds the name, the login name, the password in the form of a hash, the department, and the groups that the employee belongs to. A group is a named list of users, such as "Accounts" or "Plant engineers". Instead of giving access to each person one by one, the company gives access to a group and adds people to it. When an employee logs in to a company Windows laptop, the laptop sends the login to a domain controller, the server that holds the directory. The domain controller checks the password and issues a ticket. The laptop then shows this ticket to file servers and printers, to prove who is asking.
Consider a textile mill group in Coimbatore with 1,200 office users and four mills. Every user in the "Accounts" group can open the accounts folder on the file server. When a new accountant joins, an IT employee adds one entry to the directory and puts it in that group. The laptop, the file server, the printer and the office Wi-Fi all accept him at once, because each of them checks the same directory. In larger companies, identity governance and administration (IGA) creates these entries automatically. Single sign-on (SSO) reads the same users and groups when people log in to cloud applications.
Because everything checks the directory, attackers aim at it. An attacker who gets into one laptop next tries to take a domain administrator account, which can change any entry. With that account, the attacker can create new accounts, switch off security software and send ransomware to every computer at once. So companies protect their administrator accounts with privileged access management (PAM). They also keep a separate, protected backup of the directory. After a ransomware attack, the directory must be restored first, because nobody can log in to anything else without it. This is part of ransomware recovery.
Many newer companies never had a Windows server. They use a cloud directory, which holds the same list of users and devices as an online service, often with single sign-on and device management built in. Unified endpoint management (UEM) reads the directory to know which device belongs to which user.