Active Directory Security Assessments Explained
How Active Directory assessments work: attack paths, assumed-breach testing, common weaknesses such as Kerberoasting and AD CS, and how tests stay safe.
Infrastructure testing
Internal Network & Active Directory Testing
We start from a single foothold inside your network and map, safely and by hand, the paths an attacker would take to domain admin.
- PTES
- NIST SP 800-115
Overview
Most serious breaches don’t stop at the first machine. An attacker who gets one set of credentials, through phishing, a reused password or an exposed service, will try to move through your network and take over Active Directory. Once they control the domain, they control almost everything.
Our assumed-breach testing answers one practical question: if an attacker got a foothold today, how far could they go? We deliver the test remotely, work within agreed testing windows, and show each attack path step by step with clear fixes, so your team can close the routes that matter most.
Scope
What we test
- Assumed-breach access from a standard user account and workstation
- Active Directory misconfigurations and attack paths
- Kerberos attacks, including Kerberoasting and AS-REP roasting
- Unconstrained, constrained and resource-based delegation abuse
- Dangerous ACLs and permissions on AD objects
- Active Directory Certificate Services (AD CS) misconfigurations
- Credential exposure in shares, scripts and Group Policy
- Lateral movement between hosts and services
- Local and domain privilege escalation
- Network segmentation between sensitive zones
- Legacy protocols such as LLMNR, NBT-NS and SMB without signing
- Entra ID and hybrid identity sync, where in scope
Findings
Common issues we find
Generic examples of what this kind of testing tends to uncover. Every engagement is different, and we never share client findings.
High
Service accounts with weak, crackable passwords
Accounts with SPNs and old passwords can be Kerberoasted offline and often hold high privileges.
Critical
Misconfigured certificate templates
AD CS templates that let any user request a certificate as someone else, including a domain admin.
High
Excessive rights hidden in ACLs
Helpdesk or legacy groups that can reset passwords or modify group membership for privileged accounts.
High
Credentials left in shares and scripts
Passwords in logon scripts, Group Policy preferences, config files or old deployment folders.
High
Same local admin password everywhere
One cracked local password unlocks lateral movement across many machines.
Medium
Name-resolution poisoning
LLMNR and NBT-NS still enabled, letting an attacker capture password hashes on the local network.
Medium
Flat network with weak segmentation
User workstations can reach servers, management interfaces and backups they never need.
Severity shown is typical, not fixed. We rate each finding on its real impact in your environment.
Approach
How we test it
Agree scope and safety rules
We confirm in-scope ranges, sensitive systems, testing windows and stop conditions in writing before any traffic is sent.
Connect remotely
We test through a VPN, a jump host or a small virtual machine you deploy, so there's no need for anyone to travel or plug in hardware.
Map the domain
From a standard user account, we enumerate Active Directory and the network to build a picture of users, groups, trusts and attack paths.
Follow the attack paths
We exploit the most realistic paths to high privilege, carefully and without disruptive techniques unless you approve them first.
Show the chain and the fix
The report shows each path step by step, with the specific configuration changes that break it.
Deliverables
What you receive
Every finding comes with proof-of-concept evidence, so your engineers can reproduce it and your auditors can trust it.
Executive summary
A plain-English view of risk for leadership, boards and customers.
Technical findings
Each issue with impact, evidence, reproduction steps and a clear fix.
Free retest
Once you’ve fixed the findings, we retest them and update the report.
Attestation letter
A letter you can share with customers and auditors to show testing was done.
Preparation
What we need from you
We'll confirm the details during scoping. Having these ready helps testing start on time.
- VPN access, a jump host, or a virtual machine on your network
- A standard domain user account for assumed-breach testing
- In-scope IP ranges and any systems that must not be touched
- Agreed testing windows and an emergency contact
- Details of any hybrid identity setup, if Entra ID is in scope
FAQ
Internal & Active Directory testing questions
Do you need to be on site?
No. We deliver internal tests remotely through a VPN, jump host or a virtual machine you deploy inside your network. This keeps setup simple and avoids any travel.
What does assumed breach mean?
We start as if an attacker already controls one ordinary user account and workstation, for example after a phishing email. It focuses the test on what happens next, which is where most real damage occurs.
Could testing disrupt our network?
We avoid denial-of-service and destructive techniques, test during agreed windows, and stop immediately if you ask. Anything with a risk of disruption is discussed and approved before we run it.
Do you test Entra ID (Azure AD) as well?
Yes, where it's in scope. Hybrid setups often let an on-premises compromise reach cloud identities, or the reverse, so we test the sync and trust paths between them.
How long does an internal test take?
It depends on the size of the network, the number of domains and sites, and whether cloud identity is included. We confirm the tester-days in your proposal after scoping.
Guides
Related services
External Network Penetration Testing
Testing of everything you expose to the internet, from forgotten admin panels to VPN gateways, with every finding manually validated.
Cloud Security Testing (AWS, Azure, GCP)
Configuration review and authenticated attack-path testing of your AWS, Azure or GCP environment, focused on how small permissions become full control.
Phishing Simulation
Authorised phishing campaigns with templates and target lists you approve, clear metrics, and training that teaches rather than shames.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.