Active Directory & Domain Penetration Testing
Assess your Windows domain infrastructure security and eliminate attack paths
What this engagement covers
The service
Active Directory is the primary identity store and access control engine for modern enterprises—and the prime target for ransomware operators and advanced adversaries. Our Active Directory penetration testing simulates real-world attacker tradecraft starting from an unprivileged domain foothold or external network access to discover, exploit, and remediate all hidden attack paths leading to full Domain Admin and enterprise compromise.
What we test
We assess your entire Active Directory and Microsoft Entra ID (Azure AD) hybrid infrastructure: domain controllers, trust relationships, Group Policy Objects (GPOs), Kerberos/NTLM authentication protocols, Active Directory Certificate Services (AD CS), service account SPNs, unconstrained/constrained delegation, ACL hierarchies, and credential hygiene across all domain joined assets.
Scoping & Assessment Depth
Assumed Foothold (Standard Domain User)
Most PopularSimulates a compromised endpoint (workstation, VPN contractor, or phishing victim) with a standard domain user account to identify immediate privilege escalation vectors to Domain Admin.
Zero-Knowledge Network Access
Network LayerSimulates an adversary connected to an internal network port, conference room drop, or guest Wi-Fi segment, probing for unauthenticated LDAP/RPC, LLMNR/NBT-NS poisoning, and relay paths.
Hybrid Entra ID / Cloud Pivot
Hybrid ScopeAssesses identity synchronization (Entra Connect / AAD Connect), seamless SSO, Pass-Through Authentication, and cloud-to-on-prem or on-prem-to-cloud lateral movement and token abuse.
Attack Surface & Vulnerability Vectors
Kerberoasting & AS-REP Roasting
Extracting Service Principal Name (SPN) Kerberos TGS tickets and AS-REQ pre-auth responses for offline cracking to compromise high-privilege service account credentials.
AD Certificate Services (AD CS) Abuse
Exploiting misconfigured certificate templates (ESC1 through ESC8) to forge client authentication certificates and impersonate Domain Controllers or Domain Admins.
BloodHound Graph & ACL Abuse
Uncovering complex, nested permission chains (GenericAll, WriteDacl, AllExtendedRights) across security groups, organizational units (OUs), and user accounts.
Delegation & Ticket Manipulation
Abusing Unconstrained Delegation, Constrained Delegation with Protocol Transition, and Resource-Based Constrained Delegation (RBCD) to impersonate privileged identities.
GPO & Script Poisoning
Auditing writable Group Policy Objects (GPOs), scheduled tasks, logon scripts, and SYSVOL permissions that allow malicious code execution on domain-joined machines.
DCSync & Domain Persistence
Validating domain replication rights (DS-Replication-Get-Changes-All) to simulate DCSync credential extraction, Golden/Silver Ticket persistence, and AdminSDHolder tampering.
How we run it
Starting from an assumed-breach foothold or low-privileged user account, we emulate adversary tactics aligned with the MITRE ATT&CK framework. Using graph analysis tools like BloodHound alongside manual post-exploitation techniques, we uncover nested privilege escalation chains, test for credential dumping and kerberoasting, abuse misconfigured ACLs, and demonstrate exploit chains without causing enterprise downtime.
Internal Reconnaissance & Graph Mapping
LDAP enumeration, BloodHound graph ingestion, trust topology mapping, and identifying misconfigured security groups and high-privilege accounts.
Credential Harvesting & Protocol Poisoning
Capturing and relaying netNTLM hashes via LLMNR/NBT-NS/mDNS, evaluating SMB signing requirements, and testing LDAP signing/channel binding enforcement.
Kerberos & Service Account Exploitation
Targeting Kerberoastable SPNs, AS-REP roastable accounts, and evaluating password complexity standards applied to service accounts.
AD CS & PKI Infrastructure Audit
Scanning all Active Directory Certificate Authority servers for exploitable certificate templates, enrollment agent permissions, and NTLM relay endpoints.
Privilege Escalation & Domain Dominance Chains
Chaining identified ACL misconfigurations, GPO write access, and delegation vulnerabilities to demonstrate realistic paths to Enterprise/Domain Admin.
Remediation Roadmap & Hardening Debrief
Delivering prioritizing fixes, GPO hardening templates, Tiered Administration guidance (ESA/PAW), and conducting a live technical walkthrough with your team.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Complete attack path visualization and BloodHound analysis
- Privilege escalation and domain compromise vulnerability findings
- Active Directory Certificate Services (AD CS) misconfiguration audit
- Kerberos security analysis (Kerberoasting, AS-REP roasting)
- Trust relationship and cross-forest security analysis
- GPO and misconfigured ACL privilege escalation breakdown
- Hybrid Azure AD / Entra ID synchronization security findings
- Executive presentation, risk scoring, and step-by-step remediation guide
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2, AC-3, IA-2, CA-8 | Independent technical testing of account management, access enforcement, multi-factor identification, and penetration testing controls. |
| CIS Controls v8 | Control 5 & 6 (Account & Access Control) | Auditing enterprise credential hygiene, administrative privileges, and Active Directory access control lists to meet CIS benchmarks. |
| PCI DSS v4.0 | Req 7.1, 7.2, 8.2, 11.4 | Validation of least privilege domain segmentation, strong password/Kerberos enforcement, and annual internal penetration testing. |
| SOC 2 Type II | CC6.1, CC6.2, CC6.3 | Verifying logical access controls, domain segregation, and credentials management for trust services criteria audits. |
Findings are mapped to NIST 800-53, CIS Benchmarks, PCI-DSS, HIPAA, ISO 27001, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
No. We operate with strict Rules of Engagement designed specifically to protect enterprise continuity. We never execute automated brute-force attacks that could trigger account lockout policies, nor do we run denial-of-service payloads against domain controllers. All ticket extraction and graph analysis activities are non-destructive and transparently coordinated.
For the standard and most effective engagement (Assumed Breach), we request a single standard unprivileged domain user account on a domain-joined machine (or VPN access). This accurately reflects what an attacker achieves through a phishing email, malicious USB, or compromised contractor device.
Yes. AD CS misconfigurations represent one of the most prolific privilege escalation vectors in enterprise Windows environments today. We audit certificate templates for ESC1 through ESC8 flaws, NTLM relayable HTTP endpoints on CA servers, and enrollment permissions.
Yes. Most modern organizations operate hybrid environments. We inspect the synchronization boundary (Microsoft Entra Connect), Seamless Single Sign-On, Pass-Through Authentication, and attack paths allowing adversaries to pivot between on-premises Active Directory and cloud Entra ID tenants.
You receive an executive summary for leadership, an auditor-ready compliance report, raw BloodHound graph files showing your exact attack paths, and a remediation workbook detailing PowerShell/GPO fixes, Tiered Administration architecture recommendations, and free retesting.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
