The Active Directory paths that recur in nearly every internal test are: LLMNR/NBT-NS poisoning and NTLM relay (where SMB signing isn't enforced), Kerberoasting weak service accounts, AS-REP roasting accounts without pre-authentication, AD Certificate Services misconfiguration (ESC1–ESC8), delegation abuse, over-permissive ACLs found with BloodHound, and reused local admin passwords. They chain into a well-worn route ending in DCSync and Domain Admin. All are exploiting defaults and misconfigurations, so the fix is hardening — SMB signing, LAPS, strong service-account passwords, Kerberos pre-auth, ADCS template review — not patching. An Active Directory security assessment finds them first.
// 01 Why the same paths appear every time
Active Directory is the identity backbone of most enterprises, and it ships with defaults chosen decades ago for compatibility, not security. Legacy name-resolution protocols are still enabled, SMB signing is frequently unenforced, service accounts accumulate privilege and weak passwords, and certificate services are stood up with dangerously permissive templates. None of this is a vulnerability in the CVE sense — there is no patch — which is exactly why it survives. An internal tester does not exploit a bug; they exploit configuration, and the same configuration is present almost everywhere. That is why the path to Domain Admin looks so similar from one engagement to the next.
// 02 The recurring attack paths
LLMNR / NBT-NS poisoning & NTLM relay
Legacy name resolution lets a tester answer broadcast queries, capture authentication, and relay it to hosts without SMB signing — instant footholds and hashes, no credentials needed.
AD Certificate Services misconfig (ESC1–ESC8)
Over-permissive certificate templates let a low-privileged user enrol a certificate that authenticates as a privileged account — a direct path to domain compromise.
Kerberoasting
Any domain user requests service tickets for SPN accounts and cracks them offline. Weak, high-privilege service-account passwords fall quickly.
AS-REP roasting
Accounts with Kerberos pre-authentication disabled hand out crackable material to any unauthenticated requester.
Delegation abuse
Unconstrained and constrained delegation misconfigurations let an attacker impersonate other users, including administrators, to reach sensitive services.
Over-permissive ACLs & local admin reuse
BloodHound surfaces hidden privilege-escalation edges; a single shared local admin password (no LAPS) turns one host into all of them via pass-the-hash.
// 03 How they chain to Domain Admin
Individually these are findings; together they are a kill chain. A representative path:
1. Foothold — a network port, or a low-privilege user. → 2. Poison LLMNR/NBT-NS to capture authentication. → 3. Relay that to a host without SMB signing for code execution or hashes. → 4. Escalate via Kerberoasting, AS-REP roasting, a misconfigured ADCS template, or delegation. → 5. DCSync to extract every domain hash from a Domain Controller. → Domain Admin.
Every step exploits a default or misconfiguration rather than a software flaw. Break any single link — enforce SMB signing, remove the weak service account, fix the certificate template — and the chain stalls. That is the good news: hardening is cheaper than the breach.
// 04 How to close them
| Attack | Primary fix |
|---|---|
| LLMNR/NBT-NS poisoning | Disable LLMNR & NBT-NS via Group Policy |
| NTLM relay | Enforce SMB signing everywhere; restrict NTLM |
| Kerberoasting | Long random passwords or gMSA; least privilege on service accounts |
| AS-REP roasting | Enable Kerberos pre-authentication for all accounts |
| ADCS ESC1–8 | Audit & lock down certificate templates and enrolment rights |
| Delegation abuse | Remove unnecessary delegation; use protected accounts |
| Local admin reuse | Deploy LAPS for unique per-host passwords |
These are configuration and hygiene changes, best validated by testing rather than assumed. Our Active Directory security assessment and hardening review find and close these paths, and we cover the broader picture in internal network testing.
// 05 Frequently asked questions
What are the most common Active Directory attack paths?
LLMNR/NBT-NS poisoning and NTLM relay (where SMB signing isn't enforced), Kerberoasting weak service accounts, AS-REP roasting, ADCS misconfiguration (ESC1–ESC8), delegation abuse, over-permissive ACLs found with BloodHound, and reused local admin passwords.
What is Kerberoasting?
Any authenticated domain user requests Kerberos service tickets for accounts with a Service Principal Name, then cracks them offline to recover the service account password — which is often weak and highly privileged. Fix with long random passwords or gMSA and least privilege.
How does an attacker reach Domain Admin?
Foothold, poison name resolution to capture a hash, relay it to a host without SMB signing, gather credentials, then Kerberoast or abuse a certificate template or delegation, often ending in DCSync to extract all domain hashes. Each step exploits a default, not a bug.
How do you defend Active Directory?
Enforce SMB signing and disable LLMNR/NBT-NS; use gMSA or long service-account passwords and Kerberos pre-auth; lock down ADCS templates; remove unnecessary delegation; deploy LAPS; and review privileged membership and ACLs regularly. An AD assessment finds these first.
// 06 References
- MITRE ATT&CK — Credential Access & Lateral Movement techniques (T1558 Kerberoasting, T1557 relay, and related).
- Microsoft — Best Practices for Securing Active Directory.
- Related: our AD security assessment and network penetration testing.