|
Interactive security control matrix for enterprise Active Directory, AD CS, and internal network penetration tests.
Service surface mapping, unauthenticated bind controls, account hygiene, share permissions, and attack-path graph modeling.
Identify reachable Domain Controllers, Global Catalog endpoints, DNS, Kerberos, RPC, LDAP/LDAPS, SMB, MSSQL, RDP, and remote management ports across network segments.
Evaluate domain-wide and fine-grained password policies (minimum length, complexity, lockout threshold, and observation window) for resilience against online password guessing.
Verify whether anonymous NULL sessions or unauthenticated SAMR/LSARPC bindings allow listing domain accounts or cycling Relative Identifiers (RIDs).
Audit file servers and Domain Controllers for SMB shares accessible via anonymous NULL sessions or enabled Guest accounts.
Catalogue domain user objects, computer accounts, and privileged/custom security groups from a standard authenticated domain perspective.
Audit accounts configured with PASSWD_NOTREQD, DONT_EXPIRE_PASSWORD, delegation flags, or orphaned adminCount=1 attributes.
Verify whether non-administrative users are permitted to join computer objects to the domain (default quota of 10) and identify registered Enterprise Certificate Authorities.
Review readable network shares, NETLOGON, and SYSVOL scripts/policies for hardcoded credentials, configuration files, keystores, or legacy Group Policy Preferences (cpassword) entries.
Check whether unauthenticated LDAP binds are disabled and identify directory objects where low-privileged principals hold write or creation permissions.
Assess KDC response behavior for unauthenticated username validation and verify monitoring coverage for Kerberos authentication anomalies.
Map Organizational Units (OUs), workstation/server separation, and administrative tiering boundaries across the domain.
Audit user and computer object metadata (description, info, pwdLastSet, lastLogonTimestamp) for cleartext credentials and dormant accounts with non-rotating passwords.
Evaluate domain groups granted local administrative privileges on member hosts and check whether privileged accounts log into lower-tier workstations or servers.
Catalogue active Group Policy Objects, OU links, and non-default principals holding modification rights over GPOs.
Collect directory relationships, group memberships, object ACLs, trust links, and delegation configurations for graph-based attack-path analysis.
Analyze transitive attack paths from standard domain users (Domain Users, Authenticated Users, Everyone) to Tier-0 assets and privileged groups.
Kerberos ticket encryption hygiene, authentication coercion surfaces, name resolution poisoning, NTLM relay protections, and LAPS/gMSA access controls.
Identify accounts with Kerberos pre-authentication disabled or writable UAC attributes that expose encrypted AS-REP material to offline password auditing.
Audit user accounts registered with SPNs for RC4 downgrade exposure, password age/complexity, privileged group membership, and delegated SPN write permissions.
Check whether the WebClient service is enabled or triggerable on domain-joined hosts, permitting outbound HTTP NTLM authentication coercion without SMB signing protections.
Assess Domain Controllers and critical servers for exposed RPC coercion interfaces (Encrypting File System, DFS Namespace, Print Spooler) and database UNC path traversal.
Verify whether LLMNR, NetBIOS Name Service (NBT-NS), mDNS, WPAD, and unauthenticated DHCPv6 configuration are disabled or restricted across internal VLANs.
Verify that SMB signing is required on all workstations and servers, and that Domain Controllers enforce LDAP signing and LDAPS channel binding (CBT) to prevent cross-protocol NTLM relaying.
Verify Windows LAPS / Legacy LAPS deployment across endpoints and audit directory ACLs for unauthorized principals granted read access to ms-MCS-AdmPwd or msLAPS-Password.
Audit PrincipalsAllowedToRetrieveManagedPassword on all gMSA accounts to ensure only intended server computer accounts—not broad user groups—can read managed password blobs.
Unconstrained, Constrained, and Resource-Based Constrained Delegation (RBCD), Key Credential Link (WHfB) permissions, and Kerberos ticket cryptography.
Identify member servers or service accounts configured with TRUSTED_FOR_DELEGATION where authenticating users’ TGTs are exposed in memory, and verify "Account is sensitive and cannot be delegated" flags on admins.
Audit accounts with Constrained Delegation and Protocol Transition (TRUSTED_TO_AUTH_FOR_DELEGATION) to ensure they cannot impersonate Tier-0 administrators to high-value hosts.
Audit existing RBCD configurations and identify non-administrative principals holding write permissions over computer objects that would allow unauthorized RBCD configuration.
Verify that non-privileged accounts and delegated helpdesk roles cannot modify msDS-KeyCredentialLink on user or computer objects to inject unauthorized public keys for PKINIT authentication.
Audit the password age of the krbtgt account (and Read-Only DC krbtgt_XXXX accounts) and verify that periodic double-rotation procedures and AES256 ticket encryption are enforced.
Evaluate KDC Privileged Attribute Certificate (PAC) signature validation and computer/service account password rotation to mitigate forged service and modified-PAC tickets.
Certificate Authority security, KB5014754 strong certificate binding, template misconfigurations (ESC1–ESC16), orphaned templates, and enrollment endpoint hardening.
Catalogue all Enterprise CAs, published pKICertificateTemplate objects, and orphaned template references left on CA certificateTemplates attributes alongside delegated PKI write permissions.
Verify that Domain Controllers enforce StrongCertificateBindingEnforcement = 2 (Full Enforcement) and restrict legacy weak implicit SAN mapping in Schannel (CertificateMappingMethods).
Audit published templates for enrollee-supplied Subject Alternative Names (ENROLLEE_SUPPLIES_SUBJECT) combined with Client Authentication/Any Purpose EKUs or Enrollment Agent capabilities without manager approval.
Inspect DACLs on all certificate templates and the CN=Public Key Services container for non-Tier-0 principals holding WriteOwner, WriteDacl, GenericAll, or GenericWrite.
Verify that EDITF_ATTRIBUTESUBJECTALTNAME2 is disabled on all CAs, ManageCA/ManageCertificates roles are restricted to Tier-0 admins, and szOID_NTDS_CA_SECURITY_EXT (1.3.6.1.4.1.311.25.2) is not in DisableExtensionList.
Verify that HTTP Web Enrollment is disabled or hardened with HTTPS + Extended Protection for Authentication (EPA) (ESC8), and that IF_ENFORCEENCRYPTICERTREQUEST is enabled on CA RPC interfaces (ESC11).
Confirm that Domain Controllers and Enterprise CAs validate dNSHostName uniqueness and embed SID security extensions to prevent machine account SAN spoofing (CVE-2022-26923).
Audit SChannel client certificate authentication over LDAPS and review explicit altSecurityIdentities mappings on privileged accounts.
Discretionary Access Control Lists (DACLs), delegated administrative rights, AdminSDHolder/SDProp integrity, and Group Policy Object (GPO) security.
Audit domain root, OU, user, group, and computer DACLs for non-Tier-0 principals holding GenericAll, WriteDacl, WriteOwner, or replication rights.
Ensure helpdesk and delegated service roles with User-Force-Change-Password, AddMember, or WriteProperty (scriptPath) are strictly scoped to non-privileged OUs and cannot target administrative tiers.
Verify that the AdminSDHolder template object contains only baseline Tier-0 ACEs and review which operator groups (Account, Server, Backup, Print Operators) are excluded from SDProp.
Verify that non-Tier-0 accounts cannot edit existing GPOs, write to SYSVOL Policy folders, create unlinked GPOs with linking rights, or modify gPLink attributes on OUs containing servers or Domain Controllers.
Intra-forest and cross-forest trust architecture, SID filtering enforcement, Selective Authentication, and cross-domain privilege boundaries.
Document all intra-forest, external, and forest trusts, evaluate whether Selective Authentication (TRUST_ATTRIBUTE_CROSS_ORGANIZATION) is enabled, and audit foreign principals placed into local security groups.
Assess how administrative compromise of a child domain impacts the forest root domain via sIDHistory / ExtraSids (Enterprise Admins -519 / Key Admins) and verify that the forest — not the domain — is treated as the security boundary.
Verify SID Filtering Quarantine (TREAT_AS_EXTERNAL) on external/forest trusts, evaluate cross-forest SPN exposure, and check whether unconstrained delegation hosts are reachable across trust boundaries.
Domain Controller protocol patching (Netlogon, KDC), MECM/SCCM hierarchy security, WSUS update integrity, and MSSQL linked server boundaries.
Confirm that all Domain Controllers enforce secure Netlogon RPC (FullSecureChannelProtection) and reject unauthenticated cryptographic downgrade attempts.
Verify that Domain Controllers enforce sAMAccountName trailing-dollar validation and KDC PAC requestor SID verification.
Audit Microsoft Endpoint Configuration Manager (MECM/SCCM) for legacy Network Access Accounts (NAA), automatic Client Push installation accounts, PXE boot media secrets, and SQL Site Database TLS/signing enforcement.
Verify that Windows Server Update Services (WSUS) endpoints use HTTPS (port 8531) with valid certificates and that WSUS servers are managed within the appropriate administrative tier.
Audit SQL Server instances for excessive domain group logins, bidirectional linked server chains executing under sysadmin context, is_trustworthy_on = 1 databases owned by sa, and enabled xp_cmdshell.
Host-to-host segmentation, remote management protocol hardening, local administrator isolation, and directory/endpoint credential protection.
Validate host firewall rules and VLAN segmentation restricting peer-to-peer WinRM (5985/5986), SMB (445), RPC/WMI/DCOM (135), and RDP (3389) between endpoints.
Verify unique local administrator credentials across endpoints, check LocalAccountTokenFilterPolicy / FilterAdministratorToken, and confirm Tier-0 accounts are members of the Protected Users security group.
Audit the domain root DACL for non-DC principals holding directory replication rights (DCSync) and verify physical/virtual disk and backup encryption for NTDS.dit.
Evaluate Windows Defender Credential Guard deployment, CachedLogonsCount policies, and whether high-privilege domain accounts are configured to run Windows Services or Scheduled Tasks on member servers.
Internal network segmentation validation, endpoint detection & script logging telemetry, and formal engagement closeout verification.
Identify dual-homed servers or management jumpboxes bridging user VLANs and restricted server/OT/Tier-0 subnets, and validate firewall filtering across routing boundaries.
Verify RunAsPPL enforcement on lsass.exe, PowerShell Script Block / Module Logging (Event IDs 4103/4104), SACL auditing on sensitive AD objects (Event ID 4662), and SOC detection coverage.
Confirm that all temporary testing accounts, scheduled tasks, modified directory attributes, certificate template configurations, and test files created during validation have been completely restored.
Need an independent Active Directory assessment or senior subcontracting capacity?
Every engagement validates multi-step attack paths across these 9 domains and delivers production-safe remediation guidance for engineering and identity teams.