Kerberoasting
Service accounts with a service principal name (SPN) and a weak password. Any domain account can request Kerberos tickets for them, from which the password can be cracked offline – especially quickly with RC4 encryption.
Security Services
Active Directory Security Assessment for Domains and Entra ID
Whoever controls AD controls the company.
Active Directory is the heart of your IT – and one of the main targets of ransomware groups. With our Active Directory security assessment, we uncover attack paths, risky permissions, and misconfigurations in AD, certificate services, and Entra ID, and show you how to close these gaps and strengthen your Active Directory security for the long term.
- Fixed price after scoping
- Free retest
- Quote within 24 hours
Definition
What is an Active Directory security assessment?
An Active Directory security assessment – also known as an AD security review – examines your Windows domains specifically from an attacker’s perspective. We review configuration, permissions, authentication, and trust relationships and answer the crucial question: How easily could someone who controls a single user account take over your entire domain?
The answer is often surprising. Active Directory environments grow over many years: responsibilities change, service accounts linger, groups get nested, and rights are delegated without anyone keeping track of the big picture. Each individual setting looks harmless – only in combination do they create attack paths, which graph-based tools such as BloodHound make visible.
In ransomware attacks, taking over Active Directory is often the decisive step. With domain admin rights, attackers push malware to every system via Group Policy, disable protective mechanisms, and deliberately target backups. If you know the paths that lead there and close them, you take away the attackers’ most important lever.
Modern environments are also hybrid: Microsoft Entra Connect synchronizes identities to the cloud, so a compromise of on-premises AD can also put Microsoft 365 and Azure at risk – and vice versa. That is why frameworks set concrete requirements for securing identities: the EU NIS2 Directive (access control and multi-factor authentication), ISO/IEC 27001:2022 (including Annex A, control 8.2 on privileged access rights), and BSI IT-Grundschutz – the baseline protection methodology of the BSI (Germany’s Federal Office for Information Security) – with its module APP.2.2 on Active Directory.
Our approach
How we assess your Active Directory
For most of the assessment, all we need is a regular domain account without administrative rights – exactly the starting position of an attacker after a successful phishing attack. With it, we use LDAP and established tools to collect the relevant data: users, groups, computers, permissions (ACLs), Group Policy, trust relationships, and certificate templates.
In the graph-based analysis, we follow every path that leads to Tier 0 objects – that is, to domain controllers, domain admins, certificate services, or the Entra Connect server. In parallel, we check the configuration against proven hardening recommendations: Kerberos and delegation, password policies, legacy protocols, LAPS, privileged groups, and administrative tiering.
In coordination with you, we validate critical findings in a controlled manner – for example, by testing Kerberos tickets offline for weak passwords or by requesting a test certificate via a vulnerable template and then revoking it. That way, you know which risks are actually exploitable – with minimal impact on your operations.
Common vulnerabilities
Common vulnerabilities in Active Directory
AS-REP roasting
Accounts with Kerberos pre-authentication disabled. Attackers obtain encrypted material that can be attacked offline – sometimes without any valid credentials at all.
Risky ACLs and DCSync rights
Rights such as GenericAll, WriteDACL, or password resets on privileged objects – or replication rights that allow attackers to pull every password hash in the domain.
Insecure delegation
Servers with unconstrained delegation store the Kerberos tickets (TGTs) of every account that logs on to them. Combined with coercion techniques such as PetitPotam, this can lead to a compromise of the entire domain; resource-based constrained delegation is also frequently abused.
AD CS misconfigurations (ESC1–ESC8 and beyond)
Certificate templates that let requesters specify the subject name themselves, overly broad permissions, or NTLM relay to web enrollment. A certificate obtained this way for a domain admin remains valid even after a password change.
Legacy protocols and relay attacks
NTLMv1, SMBv1, missing SMB and LDAP signing, or active name resolution via LLMNR and NBT-NS allow credentials to be captured and relayed.
Weak and reused passwords
Lax password policies, passwords in description fields or in scripts in SYSVOL, and identical local administrator passwords on all clients because LAPS is missing.
Missing tiering and too many admins
Domain admins who log on to clients or servers and leave credentials in memory there, overcrowded privileged groups, and service accounts with domain admin rights.
Options
Three ways to stronger Active Directory security
White box
AD configuration review
Using a read-only account, we analyze your entire directory – completely, systematically, and without making any changes.
- All objects, permissions, and Group Policy objects
- Graph-based attack path analysis up to Tier 0
- Ideal as a baseline and before restructuring
Gray box
Assumed breach simulation
We start with a regular user account on a standard client and try to take over the domain – like an attacker after a successful phishing attack.
- Validation of actually exploitable paths
- Check whether EDR and monitoring raise alerts
- Proof of real-world impact
Entra ID
Hybrid identity review
We examine the bridge between on-premises AD and the cloud – where attacks can spread in both directions.
- Entra Connect, synchronization, and authentication method
- Privileged roles and synchronized admin accounts
- Conditional Access and legacy authentication
Process
How your Active Directory security assessment works
Structured and transparent like all our security services – and with as little effort for your team as possible.
-
01
Scoping
We clarify domains, forests, trusts, the size of the environment, the preferred option, and whether Entra ID should be included. You receive your fixed-price quote within 24 hours (on business days).
-
02
Access & data collection
You provide a standard domain account and network access – either on site or remotely via VPN or a provided test system. We collect the data with established tools, read-only and without making any changes to the directory.
-
03
Analysis
We evaluate attack paths using graph-based analysis and check Kerberos, AD CS, Group Policy, password policies, and protocols against proven recommendations from Microsoft and the BSI.
-
04
Validation
In coordination with you, we confirm selected critical findings in a controlled manner and document the evidence. We report critical vulnerabilities immediately – during the assessment, by phone or email to the agreed contact.
-
05
Report & debrief
You receive prioritized measures – from quick fixes to a tiering concept. If you wish, we discuss implementation directly with your administration team.
-
06
Retest & test certificate
Once the issues are fixed, we retest the findings free of charge. Finally, you receive a test certificate.
Reporting
Attack paths, clearly documented
Our report translates complex permission chains into clear statements: Which accounts are at risk, which path leads to domain admin, and which change breaks it? Each finding includes the affected objects, evidence, and a concrete recommendation – including notes on possible side effects in operation.
- Executive summary with a risk rating for your domain
- Visualized attack paths to your most critical accounts and systems
- Findings with CVSS ratings, evidence, and affected objects
- Concrete measures – from quick wins to a tiering concept
- Notes on dependencies and side effects of changes
- Test certificate to present to customers, partners, insurers, and auditors
How secure is your Active Directory really?
All we need to get started is a regular domain account. After scoping, you receive a fixed-price quote for your Active Directory security assessment within 24 hours (on business days).
FAQ
Frequently asked questions about the Active Directory security assessment
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
How does an AD assessment differ from an internal penetration test?
An internal penetration test examines the entire internal network – systems, services, and segmentation – and often follows the first viable path to domain admin. The Active Directory security assessment focuses on the directory itself and works through it systematically: every attack path, every risky permission, every Kerberos and AD CS configuration. The two services complement each other perfectly.
What access do you need for the assessment?
For most checks, a normal domain account without admin rights is enough, plus network access to your domain – either on site or remotely, via VPN or a provided test system. For individual checks, such as a password audit or local settings on the domain controllers, we coordinate extended rights with you on a case-by-case basis.
Will the assessment affect our operations?
As a rule, no. Data collection consists mainly of read-only queries, for example via LDAP, which put hardly any load on domain controllers and systems, and we don’t modify any objects in the directory. We perform active validations such as requesting a test certificate only after prior agreement and reverse them afterward.
Do you also review Entra ID and Microsoft 365?
Yes. In hybrid environments, Entra Connect is one of the most critical systems of all, because whoever controls it can compromise both on-premises AD and the cloud tenant. We check synchronization, authentication method, privileged roles, and Conditional Access. For a comprehensive review of your tenant, we also recommend our Microsoft 365 & Azure Review.
What is Kerberoasting – and why is it so dangerous?
In Kerberoasting, an attacker with any domain account requests Kerberos tickets for service accounts. These tickets are encrypted with a key derived from the service account’s password and can be brute-forced offline – without account lockouts and unnoticed by many monitoring solutions. Because service accounts often have weak, never-changed passwords and high privileges, the attack frequently leads straight to privileged access. Remedies include group managed service accounts (gMSA), long random passwords, and dropping RC4.
Why are Active Directory Certificate Services so critical?
Certificate services are tightly integrated with AD: a certificate can be used to log on just like a password. The 2021 research paper “Certified Pre-Owned” put numerous attack techniques in the spotlight that are cataloged as ESC1, ESC2, and onward – and the list keeps growing. A single misconfigured template can allow any user account to issue itself a certificate for a domain admin. That’s why we treat AD CS as a Tier 0 system and review it especially thoroughly.
How often should we have our Active Directory assessed?
We recommend a comprehensive assessment roughly once a year and after major changes, such as migrations, mergers, the introduction of Entra ID, or a change of IT service provider. An AD assessment also makes sense after a security incident to track down remaining backdoors and persistence mechanisms – in addition to digital forensics.
How long does an Active Directory security assessment take?
That depends mainly on the number of domains and forests, the size of the directory, and the chosen option. Data collection itself is usually done quickly; most of the effort goes into analysis, validation, and a clear report. We agree on the time frame during scoping – it is part of your fixed-price quote.
Related pages
Request an Active Directory security assessment
Give us a brief overview of your environment – number of domains, approximate number of user accounts, and whether you use Entra ID. We’ll get in touch for scoping and then send you a fixed-price quote within 24 hours (on business days).