Active Directory · Learn

Active Directory security, in plain terms.

Active Directory controls who can log in to what across a Windows network, which makes it the prize in almost every enterprise breach. This section explains, in plain language, how AD actually gets attacked: the enumeration, the credential attacks, the permission abuse, and the end-game techniques that lead to full domain control.

TopicsAll services
TL;DR

Active Directory is the identity backbone of most Windows networks, and the path attackers take through it is well-worn: enumerate the directory, harvest or crack credentials, abuse over-broad permissions, and chain it all up to Domain Admin. This section breaks each step into a plain-language explainer with the real technical names a defender needs to recognise. Start with the foundations, then follow the attack chain.

By John Dill, Red Team Lead, SecureLayer7Updated

Topics

Key terms explained

Plain-language definitions of the names that come up across these attacks. Each page covers what the term is, the attack it enables, and how to defend.

Kerberos and tickets

Credentials and lateral movement

Recon, permissions and delegation

AD Certificate Services (ESC series)

Defenses

How to read this section

The articles are ordered the way a real attack unfolds.

  • Foundations first: what AD is and how Kerberos and NTLM work.
  • Reconnaissance next: enumeration and BloodHound, the map every attacker draws.
  • Credential attacks: Kerberoasting, AS-REP Roasting, and the NTLM hash and relay attacks.
  • Permission and trust abuse: ACL and delegation paths, and AD Certificate Services.
  • The end-game: DCSync and ticket forgery, which mark full compromise.

Each explainer ends with how a penetration test surfaces that specific weakness in your own environment.

References

  1. [1]MITRE ATT&CK Enterprise Matrix(MITRE)
  2. [2]Microsoft: Best Practices for Securing Active Directory(Microsoft)
  3. [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)
Related terms

Scope an engagement

Test your Active Directory before an attacker does.

We run internal and Active Directory penetration tests that follow the real path from one low-privilege user to Domain Admin, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.