Penetration Testing Hub › Penetration Testing Explained
Active Directory Penetration Testing: What Attackers Look For
Only test Active Directory environments you own or have explicit written permission to test. Unauthorised access to a computer system is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017. Everything below assumes you are testing your own domain or one you are formally authorised to assess.
If an attacker gets a foothold inside a Windows network, Active Directory is almost always the target. It's the keys to the building: control the domain and you control every machine, every share, every account. Most real-world breaches don't stop at one phished laptop — they escalate through AD to domain admin. This page shows how that escalation works, what you can harden yourself, and where you need help.
1. How it's done
Enumeration
From any domain-joined machine or a single low-privilege account, a tester maps the domain: users, groups, computers, trusts, group policies, and the relationships between them. Tools like BloodHound turn that into a graph showing the shortest path from 'nobody' to 'domain admin' — a path defenders often don't know exists. This is the AD equivalent of our Attack Canvas: the value is in the chain, not the node.
Credential attacks
The recurring techniques: Kerberoasting (requesting service tickets and cracking them offline to recover service-account passwords), AS-REP roasting (accounts with pre-authentication disabled), password spraying (one common password against many accounts to avoid lockout), and harvesting credentials left in memory, scripts, or group policy. The detail of dumping credentials with Mimikatz lives in our Hack Log; the point here is that weak service-account passwords and cached credentials are what make these work.
Lateral movement and escalation
With one set of credentials, the tester moves sideways — pass-the-hash, NTLM relay, abusing local admin reuse — and looks for the misconfiguration that grants a jump in privilege: an over-permissioned group, a misconfigured ACL, an unconstrained delegation, a writable GPO. The endgame is usually DCSync (impersonating a domain controller to pull every password hash) or a golden ticket.
What it usually finds
In real environments: service accounts with weak passwords and domain-admin rights, local admin passwords reused across every workstation, far too many people in Domain Admins, legacy protocols (LLMNR, NBT-NS) enabling relay attacks, and old accounts nobody disabled. None of it is exotic. All of it is a chain waiting to be walked.
2. What to look for — the self-check
- Domain Admins membership is tiny — ideally single digits, and no service accounts.
- Service accounts have long, random passwords and use managed service accounts (gMSA) where possible.
- LAPS (or equivalent) randomises the local admin password on every machine — no reuse.
- LLMNR and NBT-NS are disabled; SMB signing is enforced.
- No accounts have Kerberos pre-authentication disabled without good reason.
- Unconstrained delegation is removed or tightly justified.
- Old, disabled and stale accounts are cleaned up regularly.
- Tier-0 assets (DCs, admin workstations) are isolated from ordinary user machines.
- You've run BloodHound against your own domain and looked at the shortest paths to DA.
Do this one thing first
Run BloodHound against your own domain and look at 'Shortest Paths to Domain Admins'. It is the single most eye-opening hour most Windows admins will spend — and it's free to do on a network you own.
3. What to expect if you hire out
Scoping: usually grey box — the tester starts from a standard domain user account, because that's the realistic post-phish position. You'll agree whether they may attempt full domain compromise and how far post-exploitation may go.
Access: a domain-joined foothold (a VM or device on the network) and one low-privilege account. White-box adds documentation and a map of tier-0 assets.
Duration: typically part of a broader internal test; AD-focused work is often several days.
Production risk: enumeration is safe; some credential and relay techniques can lock accounts or generate noise, so they're agreed in advance and often run in a window. A careful tester avoids anything that risks DC stability.
The report: the attack paths that mattered, rated by severity, with the specific misconfigurations to fix and the order to fix them in.
4. When you need a pro
You can safely enumerate your own domain and run BloodHound — do that today. Stop before actively cracking service tickets, running relay or pass-the-hash attacks against live systems, or attempting DCSync — these can lock accounts, destabilise domain controllers, and in the wrong hands cause real damage. Full AD compromise testing belongs with a professional who knows how to do it without breaking the domain, and who can tell you which of the dozen findings actually matters.
Download: Active Directory Hardening Checklist
A printable one-page version of the self-check above. No email required. Open the Active Directory Hardening Checklist
Common questions
How do attackers get domain admin?
Rarely in one step. They typically start from a phished user or compromised laptop, enumerate the domain (often with BloodHound), then escalate through weak service-account passwords, reused local admin credentials, or misconfigurations like unconstrained delegation — walking a chain to domain admin. Fixing the chain, not just individual accounts, is what stops it.
Can I test my own Active Directory safely?
You can safely enumerate it and run BloodHound to see your own attack paths — that's genuinely useful and low-risk. Stop before active credential attacks, relaying, or DCSync against live systems, which can lock accounts or destabilise domain controllers. Those belong in a professional engagement with agreed rules of engagement.
What is Kerberoasting?
A technique where an attacker requests Kerberos service tickets for accounts running services, then cracks them offline to recover the service-account password. It works when those passwords are weak. The defence is long, random, managed service-account passwords — which also happens to be good practice for every reason.
If you'd rather we tested your Active Directory properly — safely, and with a report that tells you which paths to close first — here's how a CyberLabs engagement works.
No prices on this page and no hard sell.
This page is educational and not legal advice. Only test systems you own or are explicitly authorised to test. · ↑ Back to top