Active Directory Attack Surface

Active Directory (AD) is the identity backbone of most enterprises. It governs authentication, authorization, and policy for users, computers, and services. Because nearly every resource trusts AD, a single domain compromise often equals full network compromise.

From a red-team perspective, AD is attractive because trust is transitive and misconfigurations accumulate over years. Blue teams must understand the same surface to defend it.

• One forest can contain multiple domains linked by trusts.
• Domain Controllers (DCs) hold the authoritative copy of all secrets.
• Group Policy pushes configuration to every joined host.

To reason about attacks you must know the objects involved. AD stores everything as objects with attributes in a hierarchical LDAP database.

• Users and computers are security principals with SIDs.
• Groups grant rights transitively (nested membership).
• Organizational Units (OUs) structure objects and bind GPOs.
• krbtgt account holds the key that signs all Kerberos tickets.

The krbtgt account is the crown jewel: its hash enables Golden Ticket forgery.

AD supports two main authentication protocols, and both have abuse paths.

• NTLM is a challenge-response scheme based on the user password hash. It enables relay and pass-the-hash attacks.
• Kerberos is ticket-based and preferred, but exposes Kerberoasting, AS-REP roasting, and ticket forgery.

Defenders should disable NTLMv1, monitor NTLM usage, and enforce SMB signing to blunt relay attacks.

Authenticated enumeration is usually the first step after gaining any domain foothold. Even a low-privileged user can read most of the directory by default.

Tools query LDAP to map users, groups, ACLs, and trust paths.

Beyond group membership, AD objects carry Access Control Lists (ACLs). Misconfigured ACLs grant attack paths that are invisible to traditional audits.

• GenericAll / GenericWrite let a principal reset passwords or set SPNs.
• WriteDacl lets an attacker rewrite an object ACL and grant themselves rights.
• DCSync rights (Replicating Directory Changes) let you pull all hashes remotely.

BloodHound visualizes these as graph edges, exposing the shortest path to Domain Admin.

Trusts link domains and forests so principals in one can access resources in another. They are a major lateral-movement vector.

• Parent-child trusts are bidirectional and transitive within a forest.
• External and forest trusts cross security boundaries.
• SID History abuse and inter-realm TGTs allow crossing trust boundaries.

The forest, not the domain, is the true security boundary. Trusting a weaker domain can expose the whole forest.

Most AD compromises exploit configuration drift, not zero-days. Recurring issues include:

• Service accounts with weak passwords and SPNs (Kerberoastable).
• Accounts with DONT_REQ_PREAUTH set (AS-REP roastable).
• Excessive nested group membership granting hidden admin rights.
• Passwords stored in GPP cpassword or in SYSVOL scripts.
• Unconstrained delegation on non-DC servers.

Kerberos delegation lets a service act on behalf of a user. Misused, it becomes a privilege-escalation primitive.

• Unconstrained delegation caches user TGTs on the server; compromising it yields any authenticating user, including admins.
• Constrained delegation limits targets but can be abused via S4U2Self/S4U2Proxy.
• Resource-Based Constrained Delegation (RBCD) can be configured by anyone with write rights on a computer object.

Defenders reduce the attack surface with tiering and monitoring.

• Implement the tiered admin model: Tier 0 (DCs, identity) credentials never touch lower tiers.
• Use Protected Users group and disable NTLM for sensitive accounts.
• Monitor event IDs 4768/4769 (TGT/TGS requests), 4662 (DCSync), and 4624 logon types.
• Deploy LAPS so local admin passwords are unique and rotated.

A typical AD engagement follows a repeatable lifecycle. Knowing it helps both attack simulation and detection engineering.

• Foothold: phishing or exposed service yields a low-priv account.
• Enumerate: BloodHound maps paths.
• Escalate: Kerberoast, ACL abuse, or delegation.
• Dominate: DCSync, then Golden/Diamond tickets for persistence.

When authorized to test AD, scope and logging matter. Capture a baseline, get written authorization, and avoid destructive actions like password resets on production accounts.

Run collectors during agreed windows and store loot encrypted. Always reset any temporary objects (lab users, RBCD entries) you create during the test.

Test your understanding of the AD attack surface.

You explored why AD is a high-value target and the surface that makes it abusable.

• AD trust is transitive; the forest is the real security boundary.
• NTLM and Kerberos each expose distinct abuse paths.
• ACLs, delegation, and stale service accounts create hidden privilege paths.
• BloodHound maps these paths; tiering, LAPS, and event monitoring defend them.

Next, we drill into Kerberos and Kerberoasting.