Running Active Directory is as easy as it gets. Protecting the Golden Ticket is not.