Active Directory security: what we check first

In most companies running Windows, Active Directory (AD) is the heart of the network — and that’s exactly why it’s the attacker’s main target after gaining initial access. The goal is almost always the same: take over a domain administrator account, because it’s the key to everything. In penetration tests, the path from a regular user to “Domain Admin” is often surprisingly short. Here’s what usually shortens it.

Common attack paths

• Kerberoasting. The attacker requests Kerberos tickets for service accounts and cracks their passwords offline. Service accounts with a weak password and high privileges are a gift.
• AS-REP Roasting. Accounts with Kerberos pre-authentication disabled allow crackable material to be extracted without interaction.
• Excessive privileges and misconfigured delegation. Badly set ACLs, permission delegation or overly broad groups create invisible escalation paths.
• Credential theft from memory. After compromising a workstation, the attacker collects hashes and tickets to move further (pass-the-hash, pass-the-ticket).

Tools like BloodHound map these relationships and show the shortest route to a domain admin — exactly as an attacker does.

What we check and recommend

• A tiering model. Separate domain admin accounts from everyday work. An admin should never log in with a privileged account on a regular workstation.
• Service-account hygiene. Long, random passwords (or gMSA), minimal privileges, regular review. This defuses Kerberoasting.
• Permission and group review. Remove unused accounts, limit membership of privileged groups, audit dangerous ACLs.
• LAPS for local administrator passwords — no more one password across all workstations.
• Credential protection (Credential Guard, restricting privileged logons) makes hash theft harder.

Why it matters so much

Hardening AD is one of the most effective ways to break the ransomware attack chain — because it’s domain escalation that turns a single infection into a company-wide paralysis. We cover this in more depth in our piece on defending against ransomware. If you’d like to see how far an attacker could get in your domain, book a penetration test — we’ll show the real paths and how to close them.

Privileged paths first

Microsoft notes that domain-controller compromise undermines trust in the entire forest. Begin with Domain Admins, Enterprise Admins and Administrators membership, where those accounts sign in and which systems can manage them. Separate daily and administrative identities and use dedicated hardened workstations for privileged tasks.

The review does not end with built-in groups. Delegated ACLs, object ownership, GPO modification, control of a server holding an administrator session and password-reset rights may create equivalent paths. A permission graph is a hypothesis; confirm every critical step with the system owner.

Service accounts and Kerberoasting

Kerberoasting obtains service tickets for offline attacks against a service-account secret. Defences include long random passwords, gMSA where supported, least privilege and removal of unnecessary SPNs. Frequent rotation of a weak password is not enough.

Maintain a service-account inventory with owner, service, hosts, SPNs, rights and review date. Disable an account only after dependency validation to avoid stopping a critical service.

Protocols, monitoring and recovery

Validate LDAP signing and channel binding, reduce legacy authentication and monitor group, GPO, account and delegation changes. Domain controllers require tightly controlled internet traffic, supported operating systems and separate administration. Export logs beyond the domain an attacker could alter.

Test system-state backups and forest recovery regularly. Recovery needs a clean identity, trusted images, restoration order and documentation available outside AD. An untested backup is a promise, not a control.

---

Sources: Microsoft — Securing domain controllers against attack, Microsoft — Reducing the Active Directory attack surface, MITRE ATT&CK — Kerberoasting.