Cybersecurity Services
Active Directory Assessment
Find the paths from an ordinary domain user to Domain Admin — Kerberos abuse, ACL chains, delegation, credential reuse and the hybrid identity gaps that connect your forest to the cloud.
- < 3 hops
- Typical Path From Standard User To Domain Admin
- Graph-based
- Every Privilege Path Walked And Evidenced
- Hybrid
- On-Premises AD And Entra ID Assessed Together
- Deployment
- Lightweight Connector
- Start Position
- Standard Domain User
- Techniques
- Kerberos, ACL, Delegation, ADCS
- Objective
- Tier 0 / Domain Admin
- Output
- Attack Graph & Fix Order
Problem
- The Issue
- Impact
Assumed breach from a standard user, with no special rights
Every hop executed and evidenced, not inferred from an export
Fixes ranked by how many attack paths each one eliminates
Active Directory is where a foothold becomes a breach
Almost every ransomware incident follows the same arc: initial access somewhere unremarkable, then Active Directory turns that foothold into control of the estate.
AIPTx assesses that middle step by starting where an attacker starts — as one ordinary domain user — and walking every route to Tier 0 it can actually complete.
Why Assess AD
- Key Benefits
The problem: domains fall for the same reasons every time
These are not exotic conditions. They are present in most mature environments, and each is a well-worn step in a chain that ends at the domain controller.
The risk lives in relationships, not in objects. No single permission looks wrong; the path formed by twelve of them does.
- Privilege accumulates and never leavesRights granted for a migration, a support rota or a one-off project stay attached to the account long after the reason for them has gone. Normal operation only ever adds privilege, so the set of accounts that can reach Tier 0 grows quietly year on year.
- Roastable accounts open to any userAny authenticated domain user can request service tickets for every SPN account, and pull AS-REP material from any account with pre-authentication disabled. No elevated rights are involved, so the offline cracking that follows starts from the lowest position in the directory.
- ACL chains invisible object by objectGenericAll, WriteDACL, WriteOwner and AddMember grants each look defensible in isolation, and an object-by-object permissions review passes every one of them. Only the graph shows the chain they form together, running from an ordinary account through to DCSync rights on a domain controller.
- Delegation and template misconfigurationUnconstrained hosts, constrained delegation with protocol transition and RBCD entries let one compromised machine account impersonate privileged users at will. Certificate templates with permissive enrolment rights issue authentication material for accounts the requester was never meant to hold.
- Credentials shared across the estateOne local administrator password reused across a build image gives a single compromised host the run of every machine imaged alongside it. Privileged sessions left cached on ordinary workstations turn those endpoints into a supply of Tier 0 credentials.
- Hybrid identity widens the blast radiusAD Connect servers, sync accounts and federation trust make the on-premises forest and the cloud tenant a single identity plane. A path that begins with a standard domain user does not stop at the forest edge, and an assessment scoped to only one side never sees where it continues.
Key Benefits
Why an Active Directory assessment is a must for every business
Every Path, Walked
A reported route is one that worked, not a theoretical edge drawn from a permissions export.
Fixes Ordered By Impact
Remediation sorted by risk removed per change — usually a very different order from severity labels.
Repeatable On Demand
Re-run after a migration, a merger or a cleanup project, with drift since the last run highlighted.
One Hybrid View
Forest and tenant assessed as a single identity plane, so cross-plane paths do not fall between engagements.
Ransomware Stage Removed
Breaking escalation paths removes the step that turns one endpoint compromise into a domain-wide event.
Detection Gaps Named
Every technique run is compared with what your monitoring reported, giving the SOC a precise list.
How It Works
- Approach
- Workflow
How AIPTx assesses Active Directory
Assumed breach, from a standard domain user, with every hop actually executed rather than inferred from a configuration export.
- 01
Deploy & Set Position
A lightweight connector, a standard starting identity, and your Tier 0 and do-not-touch list.
- 02
Enumerate The Directory
Users, groups, SPNs, delegation, GPOs, trusts, certificate templates and LAPS coverage.
- 03
Build The Privilege Graph
Every relationship becomes an edge, and paths to Tier 0 are computed across the whole graph.
- 04
Execute The Techniques
Roasting, ACL abuse, delegation impersonation, ADCS abuse, coercion and bounded spraying.
- 05
Rank Fixes By Paths Broken
Ordered so the first three changes remove more risk than the next thirty, mapped to the tier model.
| Technique Area | What We Assess |
|---|---|
| Kerberos | Kerberoasting, AS-REP Roasting, Encryption Downgrade |
| ACL & Permissions | DCSync Rights, Nested Group Chains, Object Takeover |
| Delegation | Unconstrained Hosts, S4U Abuse, RBCD Configuration |
| Certificate Services | ESC Template Checks, Enrolment Rights, Relay To CA |
| Credentials | GPP & Script Secrets, LAPS Gaps, Session Harvesting |
| Hybrid Identity | AD Connect Exposure, Conditional Access, Cross-Plane Pivots |
What We Cover
- Scope
Techniques covered
The assessment runs the techniques that appear in real intrusion reports, in the order real intrusions use them.
Kerberos Attacks
Roasting every SPN account, AS-REP where pre-auth is off, ticket lifetime and downgrade analysis.
ACL & Permission Abuse
GenericAll, WriteDACL, WriteOwner, AddMember and DCSync rights chained into complete routes.
Delegation Abuse
Unconstrained hosts, constrained delegation with protocol transition, and RBCD configuration.
Certificate Services
Vulnerable templates, enrolment agent abuse, CA weaknesses and NTLM relay to enrolment.
Credential Harvesting
GPP and script secrets, LAPS coverage gaps, shared local admin passwords, cached sessions.
Coercion, Relay & Tiering
Signing enforcement, coercion paths, machine account quota, GPO edit rights and open shares.
Proven Impact
- Outcomes
What the assessment delivers
The value is in ordering: knowing which three changes break most of the paths is worth more than knowing about three hundred misconfigurations.
- Every path
- Routes to Domain Admin, walked
- Ranked
- Fixes ordered by paths eliminated
- Repeatable
- Re-run whenever the directory changes
- Hybrid
- One view across forest and tenant
- Ransomware
- The exact stage attackers rely on
- Detection
- Coverage gaps in your own alerting
Where It Fits
- Use Cases
When to run an Active Directory assessment
Across industries. Across environments. For every modern business.
Ransomware Readiness
Answer what actually happens after one laptop is compromised — in hops, not in a tabletop estimate.
M&A Integration
Assess an inherited forest and the planned trust before establishing it, not afterwards.
Identity Cleanup Programmes
Measure a tiering project by paths eliminated, remaining and newly introduced.
Financial Services
Evidence privileged access controls and lateral movement resistance for regulators.
Manufacturing
Protect the IT domain that OT systems depend on, without touching production controllers.
Healthcare & Public Sector
Demonstrate identity controls for underwriting, audits and citizen-data assurance.
FAQ
Active Directory assessment questions
What access do you need to run an assessment?
A lightweight connector on a domain-joined host or a VM with network reachability to the domain controllers, plus credentials for one standard domain user. Elevated rights are deliberately not required — the point is to see what an attacker achieves from an ordinary account. Read-only Entra ID access is needed if you want hybrid identity included.
Is it safe to run against production Active Directory?
Yes, with the defaults. Enumeration uses standard LDAP and SMB queries at a configurable rate. Password spraying is bounded well inside your lockout threshold, or disabled entirely. The agent does not modify group membership, ACLs or delegation settings and does not dump NTDS.dit; where a technique would require a change, it reports the preconditions and stops.
How is this different from running BloodHound?
Graph tooling shows paths that exist according to collected data. AIPTx computes the same graph and then attempts the hops — cracking the tickets, testing the credential reuse, exercising the delegation, confirming the certificate template really does issue. Graph edges are frequently stale, and a plan built on unwalked paths wastes effort on routes that never worked.
Do you crack passwords, and what happens to them?
Roastable hashes are cracked offline against a wordlist derived from your own password policy, within a bounded time budget. Cracked credentials are used within the assessment to prove lateral movement and are reported by account name and strength category. Plaintext passwords are never stored in reports, and recovered material is destroyed when the assessment ends.
How do you decide which fix comes first?
By counting paths rather than severities. Every proven route to Tier 0 runs through a set of edges, and one misconfigured delegation or inherited ACL usually carries a great many of them at once, so the change that removes the most paths is ranked first even where a severity queue had it well down the list. The result is an order in which the first three changes remove more risk than the next thirty, mapped to your own tier model.
Can we re-run it after remediation?
Yes, as often as you want, and comparison against the previous run is built in. The re-run confirms which paths are genuinely closed, identifies any new ones introduced by the changes themselves, and produces the evidence that the programme achieved what it set out to.
Find out how many hops separate a laptop from your domain
Start from one standard user account and let AIPTx walk every route to Domain Admin it can complete — then fix the two or three changes that break most of them at once.
Explore other services
AI Penetration Testing
Simulate real-world attacks to test your defences.
Vulnerability Assessment
Find, rank and fix weaknesses across the whole estate.
Attack Surface Management
Discover and watch everything you expose to the internet.
Attack Chain Analysis
How a single foothold becomes lateral movement, and which four steps to break.