Active Directory governs identity across most enterprise Windows networks, so compromising it usually means compromising everything — which is why, in nearly every internal network penetration test, the path to Domain Admin runs through AD. An AD security assessment maps the real attack paths a low-privileged foothold could take to domain dominance: Kerberoasting and AS-REP roasting, Pass-the-Hash, unconstrained and constrained delegation abuse, dangerous ACL and permission chains, and credential exposure. We present the findings as an attack graph — showing which specific links to break to collapse the paths — and, where hybrid identity is in scope, assess the Entra ID (Azure AD) synchronisation that connects on-premises AD to the cloud.
// 01 What is an Active Directory security assessment?
An Active Directory security assessment is a focused examination of your AD environment for the weaknesses that let an attacker turn a small foothold into full domain control. Where a general network test covers many things, an AD assessment goes deep on the one system that, once compromised, hands over the entire Windows estate. It answers a specific and important question: if an attacker landed on one ordinary workstation with one ordinary user's access, could they reach Domain Admin — and if so, how?
The answer is almost always yes in an unassessed environment, and the value of the engagement is in showing exactly how. Rather than a flat list of misconfigurations, we map the paths — the specific chains of permissions, credentials and trust that connect a low-privileged account to the keys of the domain — because breaking one link in a path can neutralise it entirely.
// 02 Why Active Directory is the crown jewel
Active Directory is uniquely valuable to an attacker because it is uniquely central. It holds the identities, group memberships, permissions and trust relationships for the whole environment, so control of AD is control of the network. And it is uniquely vulnerable because it is uniquely complex and long-lived: decades of accounts, service configurations, group nesting, delegated permissions and legacy compatibility settings accumulate into a web of relationships that no one fully tracks — and within which attackers find reliable escalation paths. This combination is why AD is the target in the overwhelming majority of real intrusions, and why testing it specifically is worth doing.
// 03 The attacks we test
Kerberos attacks
Kerberoasting and AS-REP roasting to recover crackable service- and user-account credentials, plus ticket-based attacks.
Credential theft & reuse
Pass-the-Hash, Pass-the-Ticket, and credential exposure on hosts, in shares and in scripts.
Delegation abuse
Unconstrained, constrained and resource-based constrained delegation misconfigurations that enable impersonation.
Permission & ACL chains
Dangerous access-control entries and group-nesting chains that grant a path to privileged objects.
// 04 What we commonly find
Kerberoastable admin service accounts
Privileged service accounts with weak passwords whose tickets can be requested by any user and cracked offline — a direct route to high privilege.
Unconstrained delegation on a reachable host
A server configured for unconstrained delegation that lets an attacker capture and reuse privileged tickets.
Dangerous permission chains
Ordinary users or groups holding write permissions over privileged objects, forming an escalation path through the ACL graph.
Exposed credentials & privilege sprawl
Passwords in scripts, GPP or shares, and far more accounts with high privilege than the environment needs.
// 05 Hybrid identity: AD and Entra ID
Most organisations no longer run Active Directory in isolation — they synchronise it with Microsoft Entra ID (Azure AD) for cloud services, which creates a new and often poorly-understood attack surface: paths that lead from on-premises AD into the cloud tenant, and sometimes back again. A compromise of the synchronisation account or a misconfigured hybrid trust can bridge the two worlds. Where hybrid identity is in scope, we assess that configuration as part of the engagement, complementing our Azure penetration testing so you understand the full identity attack surface, not just half of it.
// 06 Frequently asked questions
What is an AD security assessment?
A focused examination of Active Directory for the misconfigurations that let an attacker escalate from a standard user to Domain Admin, mapped as real attack paths with remediation.
Why is AD such a common target?
It governs identity across the Windows estate, so compromising it means compromising everything — and its accumulated complexity provides reliable escalation paths.
What attacks do you test?
Kerberoasting, AS-REP roasting, Pass-the-Hash/Ticket, delegation abuse, dangerous ACL chains and credential exposure, mapped from foothold to domain dominance.
Do you assess Entra ID too?
Yes, where hybrid identity is in scope — the on-prem-to-cloud paths that AD-to-Entra ID synchronisation creates.