Anything that Windows OS can authenticate, including users or threads/processes. In AD these are Objects that can manage access to other resources within its Domain.