Cybersecurity Services
Active Directory Assessment
Find the paths from an ordinary domain user to Domain Admin — Kerberos abuse, ACL chains, delegation, credential reuse and the hybrid identity gaps that connect your forest to the cloud.
- < 3 hops
- Typical Path From Standard User To Domain Admin
- Graph-based
- Every Privilege Path Walked And Evidenced
- Hybrid
- On-Premises AD And Entra ID Assessed Together
- Deployment
- Lightweight Connector
- Start Position
- Standard Domain User
- Techniques
- Kerberos, ACL, Delegation, ADCS
- Objective
- Tier 0 / Domain Admin
- Output
- Attack Graph & Fix Order
Problem
- The Issue
- Impact
Assumed breach from a standard user, with no special rights
Every hop executed and evidenced, not inferred from an export
Fixes ranked by how many attack paths each one eliminates
Active Directory is where a foothold becomes a breach
Almost every ransomware incident follows the same arc: initial access somewhere unremarkable, then Active Directory turns that foothold into control of the estate.
AIPTx assesses that middle step by starting where an attacker starts — as one ordinary domain user — and walking every route to Tier 0 it can actually complete.
Why Assess AD
- Key Benefits
The problem: domains fall for the same reasons every time
These are not exotic conditions. They are present in most mature environments, and each is a well-worn step in a chain that ends at the domain controller.
The risk lives in relationships, not in objects. No single permission looks wrong; the path formed by twelve of them does.
- Privilege accumulates and never leavesRights granted for a migration, a support rota or a one-off project stay attached to the account long after the reason for them has gone. Normal operation only ever adds privilege, so the set of accounts that can reach Tier 0 grows quietly year on year.
- Roastable accounts open to any userAny authenticated domain user can request service tickets for every SPN account, and pull AS-REP material from any account with pre-authentication disabled. No elevated rights are involved, so the offline cracking that follows starts from the lowest position in the directory.
- ACL chains invisible object by objectGenericAll, WriteDACL, WriteOwner and AddMember grants each look defensible in isolation, and an object-by-object permissions review passes every one of them. Only the graph shows the chain they form together, running from an ordinary account through to DCSync rights on a domain controller.
- Delegation and template misconfigurationUnconstrained hosts, constrained delegation with protocol transition and RBCD entries let one compromised machine account impersonate privileged users at will. Certificate templates with permissive enrolment rights issue authentication material for accounts the requester was never meant to hold.
- Credentials shared across the estateOne local administrator password reused across a build image gives a single compromised host the run of every machine imaged alongside it. Privileged sessions left cached on ordinary workstations turn those endpoints into a supply of Tier 0 credentials.
- Hybrid identity widens the blast radiusAD Connect servers, sync accounts and federation trust make the on-premises forest and the cloud tenant a single identity plane. A path that begins with a standard domain user does not stop at the forest edge, and an assessment scoped to only one side never sees where it continues.
Key Benefits
Why an Active Directory assessment is a must for every business
Every Path, Walked
A reported route is one that worked, not a theoretical edge drawn from a permissions export.
Fixes Ordered By Impact
Remediation sorted by risk removed per change — usually a very different order from severity labels.
Repeatable On Demand
Re-run after a migration, a merger or a cleanup project, with drift since the last run highlighted.
One Hybrid View
Forest and tenant assessed as a single identity plane, so cross-plane paths do not fall between engagements.
Ransomware Stage Removed
Breaking escalation paths removes the step that turns one endpoint compromise into a domain-wide event.
Detection Gaps Named
Every technique run is compared with what your monitoring reported, giving the SOC a precise list.
How It Works
- Approach
- Workflow
How AIPTx assesses Active Directory
Assumed breach, from a standard domain user, with every hop actually executed rather than inferred from a configuration export.
- 01
Deploy & Set Position
A lightweight connector, a standard starting identity, and your Tier 0 and do-not-touch list.
- 02
Enumerate The Directory
Users, groups, SPNs, delegation, GPOs, trusts, certificate templates and LAPS coverage.
- 03
Build The Privilege Graph
Every relationship becomes an edge, and Attack Chain Analysis computes paths to Tier 0 across the whole graph.
- 04
Execute The Techniques
Roasting, ACL abuse, delegation impersonation, ADCS abuse, coercion and bounded spraying.
- 05
Rank Fixes By Paths Broken
Ordered so the first three changes remove more risk than the next thirty, mapped to the tier model.
| Technique Area | What We Assess |
|---|---|
| Kerberos | Kerberoasting, AS-REP Roasting, Encryption Downgrade |
| ACL & Permissions | DCSync Rights, Nested Group Chains, Object Takeover |
| Delegation | Unconstrained Hosts, S4U Abuse, RBCD Configuration |
| Certificate Services | ESC Template Checks, Enrolment Rights, Relay To CA |
| Credentials | GPP & Script Secrets, LAPS Gaps, Session Harvesting |
| Hybrid Identity | AD Connect Exposure, Conditional Access, Cross-Plane Pivots |
What We Cover
- Scope
Techniques covered
The assessment runs the techniques that appear in real intrusion reports, in the order real intrusions use them.
Kerberos Attacks
Roasting every SPN account, AS-REP where pre-auth is off, ticket lifetime and downgrade analysis.
ACL & Permission Abuse
GenericAll, WriteDACL, WriteOwner, AddMember and DCSync rights chained into complete routes.
Delegation Abuse
Unconstrained hosts, constrained delegation with protocol transition, and RBCD configuration.
Certificate Services
Vulnerable templates, enrolment agent abuse, CA weaknesses and NTLM relay to enrolment.
Credential Harvesting
GPP and script secrets, LAPS coverage gaps, shared local admin passwords, cached sessions.
Coercion, Relay & Tiering
Signing enforcement, coercion paths, machine account quota, GPO edit rights and open shares.
Proven Impact
- Outcomes
What the assessment delivers
The value is in ordering: knowing which three changes break most of the paths is worth more than knowing about three hundred misconfigurations.
- Every path
- Routes to Domain Admin, walked
- Ranked
- Fixes ordered by paths eliminated
- Repeatable
- Re-run whenever the directory changes
- Hybrid
- One view across forest and tenant
- Ransomware
- The exact stage attackers rely on
- Detection
- Coverage gaps in your own alerting
Where It Fits
- Use Cases
When to run an Active Directory assessment
Across industries. Across environments. For every modern business.
Ransomware Readiness
Answer what actually happens after one laptop is compromised — in hops, not in a tabletop estimate.
M&A Integration
Assess an inherited forest and the planned trust before establishing it, not afterwards.
Identity Cleanup Programmes
Measure a tiering project by paths eliminated, remaining and newly introduced, as in our Active Directory attack path case study.
Financial Services
Evidence privileged access controls and lateral movement resistance for financial services regulators.
Manufacturing
Protect the IT domain that manufacturing OT systems depend on, without touching production controllers.
Healthcare & Public Sector
Demonstrate identity controls for healthcare underwriting, audits and public-sector citizen-data assurance.
FAQ
Active Directory assessment questions
What access is required for an Active Directory security assessment?
A lightweight connector on a domain-joined host or a VM with network reachability to the domain controllers, plus credentials for one standard domain user. Privileged access is explicitly not required, because the point is to see what an attacker could do with a standard account. Read-only access to Entra ID is required if hybrid identity is in scope.
Is it safe to run an Active Directory penetration test on a live production domain?
Yes, with the default settings. Enumeration is performed with standard LDAP and SMB queries at a configurable rate. Password spraying is kept within the bounds of your account lockout policy, or disabled entirely. The agent does not alter group memberships, ACLs or delegation settings, and does not dump NTDS.dit; where a technique would require a change to the registry or to AD, it reports the preconditions and stops.
AIPTx vs BloodHound: what's the difference in Active Directory attack path mapping?
Graph tools such as BloodHound report the paths that exist in the graph, based on the data collected. AIPTx builds the same graph and then attempts to follow every edge in it: relaying trusts, testing delegation, cracking tickets, reusing credentials where possible and confirming which certificate templates really issue. Graph edges often turn out to be stale, and a remediation plan built on them wastes time and effort on paths that simply do not exist.
Does an Active Directory assessment crack passwords, and are they stored securely?
Roastable hashes are cracked offline with a wordlist based on your password policy, within a configurable time limit. Recovered credentials are used within the assessment to demonstrate lateral movement, and are reported by account name and weakness category. Plaintext passwords are never stored in reports, and recovered material is discarded when the assessment ends.
How are Active Directory vulnerabilities prioritized for remediation?
By impact rather than severity. Every path to Tier 0 runs through a set of edges, and a single misconfigured delegation or ACL often carries dozens of paths across multiple accounts and hosts. The change that removes the greatest number of paths from the graph is ranked first, even where a standard severity rating would place another change higher, and the rest follow in the same order, mapped to your own tier model.
Can you re-test Active Directory after remediation to confirm fixes worked?
Yes, as often as needed, with comparison against the previous run built in. The re-run isolates the changes in attack surface — the paths removed, and any new ones introduced by changes to permissions, delegation or computer trust relationships — and reports how those changes affected your security posture in the context of the overall assessment.
Find out how many hops separate a laptop from your domain
Start from one standard user account and let AIPTx walk every route to Domain Admin it can complete — then fix the two or three changes that break most of them at once.
Explore other services
AI Penetration Testing
Simulate real-world attacks to test your defences.
Vulnerability Assessment
Find, rank and fix weaknesses across the whole estate.
Attack Surface Management
Discover and watch everything you expose to the internet.
Attack Chain Analysis
How a single foothold becomes lateral movement, and which four steps to break.