← Penetration testing
Specialist penetration testing

Active Directory security review

We map every path from a single standard user to domain admin, then show you how to close them, before an attacker finds them.

Scope your test

Delivered under Layer 7's CREST accreditation for penetration testing, by our own in-house testers. See our accreditations

Why it matters

Why Active Directory needs its own review

Active Directory is weak by design. Out of the box, any standard user can join computers to the domain and create DNS records. Once an attacker has one ordinary account, a weak default, a misconfigured permission or an over-trusted server is often all that stands between them and the whole domain.

Years of changes leave behind permissions and accounts nobody remembers granting. An internal penetration test finds the paths it reaches in its testing window; a dedicated review maps them all.

Scope

What we look at

Privilege escalation paths

Relationships between users, groups, computers and permissions graphed to show every route to privileged access.

Weak default configurations

Active Directory lets any user join computers to the domain, create DNS records or read more than they should by default.

Relaying and legacy protocols

Legacy protocols such as LLMNR, NBT-NS, mDNS and NTLMv1 hand over credentials. Without SMB signing, LDAP signing and channel binding, authentication can be relayed over NTLM or Kerberos to take over servers.

Certificate services

Active Directory Certificate Services templates and enrolment rights that let a user request a certificate as someone more powerful.

Weak ACLs and Group Policy

Access control entries that let one account take control of another, and policies, scripts and stored credentials that anyone can read or edit.

Privileged accounts and tiering

Admin account hygiene, separation between admin tiers, and stale or over-privileged accounts.

Our approach

How we test it

  1. 01

    Assumed breach

    We start where an attacker would after phishing one user: a standard domain account on a typical workstation.

  2. 02

    Map the paths

    We collect directory data, map every route to privileged access, and review configuration against recognised hardening guidance.

  3. 03

    Prove

    Where agreed, we safely demonstrate the most serious paths, including relaying attacks, so the risk is clear rather than theoretical.

What we find

Common weaknesses

Every finding comes with evidence, a risk rating and practical remediation guidance, and a free retest once it's fixed.

  • Insecure defaults left in place

    Standard users still able to join computers to the domain and create DNS records, both building blocks for relaying and takeover attacks.

  • Kerberoastable service accounts

    Service accounts with weak passwords that can be cracked offline by any domain user.

  • Misconfigured certificate templates

    Templates that let a standard user enrol for a certificate that authenticates as an administrator.

  • Relaying left open

    SMB signing, LDAP signing or channel binding not enforced, so captured NTLM or Kerberos authentication can be relayed to take over servers.

  • Insecure delegations

    Unconstrained, constrained or resource-based delegation that lets a server or account act on behalf of other users, including administrators.

  • Weak ACLs

    Ordinary users and groups with rights to reset passwords, change group membership or edit policy.

  • Shared local administrator passwords

    The same local admin password across machines, so one compromised endpoint unlocks the rest.

FAQ

Common questions

Do you need domain admin rights?

No. Most of the review runs from a standard domain account, which is exactly the position an attacker would start from after phishing a user.

Will the review disrupt our domain?

No. Data collection is read-only. Any active demonstration of an attack path is agreed with you in advance.

How is this different from an internal penetration test?

An internal test covers your internal network as a whole and follows the paths it finds in the time available. An Active Directory review goes deep on the directory itself and maps every path to privileged access, not just the first one that works.

Specialist testing

More specialist testing

Build chainCI/CD pipeline reviewLearn moreImages and podsContainer security reviewLearn moreOrchestrationKubernetes security testingLearn moreDesktop appsThick client penetration testingLearn moreAdversary simulationOffensive security & red teamingLearn more

See all our penetration testing

Between tests: attack surface management and continuous vulnerability management.

Find out how far one compromised account could go

Tell us what you need tested and we'll give you a fixed-price quote and a clear scope, with a free retest included.

Scope your test