Active Directory pentesting

What is Active Directory pentesting

Active Directory pentesting is an authorized simulation of real attacks against your AD infrastructure. You're trying to find exploitable weaknesses before adversaries do, chaining vulnerabilities together into full attack paths that show how an attacker moves from initial foothold to domain admin.

A typical AD pentest covers domain controllers, user accounts, service accounts, Group Policy Objects, trust relationships, delegation settings, and credential hygiene across the environment. The difference between this and a vulnerability scan is worth understanding clearly. A scanner identifies individual weaknesses in isolation.

A pentester chains them together.

A scanner might flag a weak service account password. A pentester cracks that password, uses it to move laterally, escalates privileges through misconfigured delegation, and compromises the entire domain. Same weakness, vastly different story.

Organizations pentest AD because it remains the most targeted identity system in enterprise breaches. Compliance requirements reinforce this: PCI-DSS Requirement 11.3 requires periodic penetration testing of the cardholder data environment, and ISO 27001 control A.12.6 calls for technical vulnerability management including testing.

AD pentesting methodology

A structured AD pentest progresses through four phases. Each phase builds on information or access gained in the previous one.

Phase 1: Reconnaissance and enumeration

Reconnaissance begins before the pentester has any credentials. The goal is to map the AD environment, identify naming conventions, discover accounts, and understand trust relationships.

Passive reconnaissance involves gathering information without directly interacting with the target domain: OSINT, DNS record enumeration, and LinkedIn employee discovery for username pattern identification.

Active reconnaissance involves direct interaction: network scanning with Nmap, LDAP enumeration, SMB enumeration, and SPN discovery. Tools like Kerbrute validate usernames against the domain without triggering account lockouts. BloodHound and SharpHound map attack paths by ingesting AD relationship data and visualizing the shortest path from any compromised user to Domain Admin.

At this stage, pentesters look for:

• Naming conventions that predict usernames
• Password policy configurations (minimum length, lockout threshold, complexity requirements)
• Domain trust relationships
• Service accounts with registered SPNs

Phase 2: Initial exploitation

With enumeration complete, the pentester attempts to gain initial credentials or a foothold.

LLMNR/NBT-NS poisoning. When a Windows host cannot resolve a name via DNS, it broadcasts the request on the local network using Link-Local Multicast Name Resolution or NetBIOS Name Service. A pentester running Responder intercepts these broadcasts, poses as the intended server, and captures the requesting user's NTLMv2 hash.

SMB relay attacks. If SMB signing is not enforced, the pentester relays captured NTLM authentication to another host, gaining code execution without ever cracking the hash.

Password spraying. The pentester tries one or two common passwords against every discovered account, staying below the lockout threshold. This works more often than it should because even a single weak password among hundreds of accounts gives a foothold.

AS-REP roasting. Accounts configured without Kerberos pre-authentication can have their authentication responses requested by anyone. The pentester captures the encrypted AS-REP and cracks it offline.

Phase 3: Privilege escalation

Once the pentester holds valid credentials for a low-privilege account, the next goal is escalating to higher-privilege access.

Kerberoasting is one of the most reliable escalation techniques. The pentester requests Kerberos service tickets for accounts with registered SPNs. These tickets are encrypted with the service account's password hash, and the pentester cracks them offline.

If the service account's password is weak, the pentester gets its plaintext credentials. This entire process happens without generating a single failed logon event.

Unconstrained and constrained delegation abuse allows the pentester to impersonate any user who connects to a compromised delegation host. With unconstrained delegation, every connecting user's TGT is cached on the host.

ACL abuse exploits overly permissive Access Control Lists. Permissions like GenericAll, WriteDACL, and ForceChangePassword on sensitive objects give a low-privilege user the ability to reset passwords, modify group memberships, or grant themselves additional rights.

Active Directory Certificate Services (ADCS) abuse exploits misconfigured certificate templates (ESC1 through ESC8). A vulnerable template can allow any authenticated user to request a certificate that grants domain admin access.

Phase 4: Lateral movement and domain dominance

With elevated privileges, the pentester moves toward full domain compromise.

Pass-the-hash uses a stolen NTLM hash to authenticate to other systems without knowing the plaintext password. Pass-the-ticket does the same with a stolen Kerberos ticket.

DCSync is a technique where the pentester, using an account with directory replication rights, requests credential replication from a domain controller. The DC responds with the password hashes of every account in the domain, including the krbtgt account.

Golden Ticket attacks use the compromised krbtgt hash to forge Ticket Granting Tickets for any user. A Golden Ticket grants unrestricted access to every resource in the domain, and because the krbtgt password rarely changes, the persistence lasts until it is rotated twice.

Silver Ticket attacks forge service tickets for individual services rather than domain-wide access. DCShadow registers a rogue domain controller to inject malicious changes directly into the AD replication stream. Skeleton Key installs a master password on a domain controller, allowing the attacker to authenticate as any user while legitimate passwords continue to work normally.

Common AD vulnerabilities exploited in pentests

The following table summarizes the weaknesses pentesters find most frequently and the impact each has on the engagement.

Security risks when pentest findings go unresolved

Pentest reports that sit unresolved in a shared drive become a roadmap for attackers who find the same weaknesses independently. The techniques pentesters use are identical to those used in real breaches, so unpatched findings are just open doors with a map taped to them.

Kerberoasting in production environments

Kerberoasting remains one of the most exploited AD attack techniques because it requires only a single valid domain account and produces no failed logon events. The attack is entirely offline after the service ticket is requested, which makes it invisible to threshold-based detection. In environments where service accounts hold domain admin privileges and use weak passwords, a successful Kerberoasting attack jumps from low-privilege access to full domain compromise in minutes.

Pass-the-hash in ransomware campaigns

Ransomware operators routinely use pass-the-hash for lateral movement after gaining initial access. Once a single workstation is compromised and a local admin hash is extracted from memory, the attacker replays that hash across every machine sharing the same local admin password. Without LAPS deployed, a single compromised workstation can give an attacker access to hundreds of machines within the same network segment.

DCSync as a precursor to full domain compromise

DCSync requires an account with directory replication permissions, which pentesters often obtain through ACL abuse or by compromising an overprivileged service account. In real breaches, DCSync is the step between "elevated access" and "complete domain ownership." Once an attacker replicates the krbtgt hash, they can forge Golden Tickets and maintain persistence indefinitely, surviving password resets for every other account in the domain.

ADCS exploitation

Misconfigured certificate templates are one of the highest-impact findings in modern AD pentests. Exploiting a vulnerable template (ESC1, for example) allows any authenticated user to request a certificate as a domain admin, then use that certificate to authenticate. Unlike credential-based attacks, certificate-based persistence survives password resets because the certificate itself grants access independently of the account's current password.

ADAudit Plus detects these attack techniques through its Attack Surface Analyzer, which identifies Kerberoasting, Golden Ticket, DCSync, pass-the-hash, and pass-the-ticket activity in real time using event correlation and behavioral analysis.

Detecting pentest-like activity with native tools

Windows generates specific Event IDs for every pentest technique. The challenge is not the absence of data; it is finding signals in the noise.

Why native Windows auditing falls short

Native auditing has several practical limitations that make it difficult to act on pentest findings in any sustained way.

No centralized view. Security event logs reside on individual domain controllers. You have to check each DC separately or deploy Windows Event Forwarding infrastructure before any correlation is possible.

No behavioral baselining. Native tools cannot tell the difference between a pentester requesting 50 service tickets in one minute and normal Kerberos activity. There is no per-user or per-host baseline to compare against.

No cross-event correlation. Linking a spike in Event ID 4769 (Kerberoasting) to a subsequent Event ID 4624 (lateral movement logon) requires manual log review across multiple DCs.

Limited log retention. Security logs have fixed size limits. In busy environments, logs overwrite within hours. Once the data is gone, forensic investigation becomes impossible.

No real-time alerting on attack patterns. Windows Task Scheduler can trigger on individual Event IDs, but it cannot evaluate patterns like "more than 20 service ticket requests from the same account within 60 seconds."

No automated response. When native tools detect suspicious activity, they cannot disable the offending account, terminate the session, or create a ticket for the security team.

No MITRE ATT&CK® technique mapping. Event Viewer displays raw events without any classification. Determining whether a cluster of 4769 events constitutes Kerberoasting requires the analyst to know the technique definition and manually evaluate the evidence.

Monitoring AD attack surface with ADAudit Plus

What ADAudit Plus detects

The Attack Surface Analyzer has named detection rules for the AD attacks pentesters use most frequently: Kerberoasting, Golden Ticket attack, Silver Ticket attack, pass-the-hash attack, pass-the-ticket attack, DCSync attack, DCShadow attack, Skeleton Key attack, brute force attacks, and AD password spray attacks.

Real-time alerts deliver notifications through email and SMS the moment an attack pattern is detected. Each alert includes drill-down forensics: who performed the action, from which machine, at what time, and what they did before and after the detected event.

Mapping pentest findings to ADAudit Plus reports

Native tools versus ADAudit Plus for pentest finding remediation

FAQ