NSA warns that Active Directory is an “exceptionally difficult to defend” attack surface