If you’ve ever wondered why so many real-world breaches end in “domain admin,” it’s because Active Directory is still the backbone of identity and access management for the vast majority of enterprise networks — and it’s riddled with default configurations that quietly enable privilege escalation. Active Directory penetration testing is arguably the single most valuable specialization an internal network pentester can develop, because almost every internal engagement eventually leads back into AD.
This guide walks through the core attack path methodology — enumeration, credential attacks, lateral movement, and privilege escalation — with practical commands and the reasoning behind each technique.
What Is Active Directory Penetration Testing?
Active Directory penetration testing evaluates the security of a Windows domain environment by simulating how an attacker, starting from either an unauthenticated or low-privilege foothold, could escalate to Domain Admin or equivalent control. Unlike general network penetration testing, AD testing centers heavily on identity, trust relationships, and misconfigured permissions rather than unpatched software alone.
Why Active Directory Is Such a High-Value Target
AD manages authentication and authorization for nearly every resource in a Windows-based enterprise — file shares, servers, applications, and often cloud identity through Azure AD/Entra ID hybrid setups. A handful of default behaviors make it exceptionally attack-friendly if not deliberately hardened:
- Every domain user can query most AD objects by default
- Service accounts often run with excessive privileges and weak passwords
- Legacy protocols (NTLM, LLMNR, NBT-NS) remain enabled for backward compatibility
- Delegation and ACL misconfigurations accumulate over years of organizational change, rarely getting cleaned up
This combination means a single compromised low-privilege account frequently provides enough visibility to map a complete path to Domain Admin.
Building an Active Directory Lab
Practice this methodology in an authorized lab environment before ever applying it professionally:
- GOAD (Game of Active Directory) — a free, deliberately vulnerable multi-domain AD lab covering realistic attack paths
- DetectionLab — combines a vulnerable AD environment with logging/monitoring, useful for understanding both attack and defense
- Hack The Box / TryHackMe — offer dedicated AD-focused machines and learning paths
The Attack Path Methodology
Phase 1: Initial Enumeration (Unauthenticated or Low-Privilege)
Start by identifying the domain structure and available services.
nmap -p 389,445,88,135 -sV 192.168.1.0/24
- Scans for common AD-related ports: LDAP (389), SMB (445), Kerberos (88), and RPC (135), quickly identifying domain controllers on the network
Null session and anonymous SMB enumeration:
crackmapexec smb 192.168.1.10 -u '' -p '' --shares
- Attempts a null (empty) credential session against SMB to check for anonymous share access — a legacy misconfiguration that still appears surprisingly often; see the full CrackMapExec guide for the tool’s broader capabilities
Phase 2: Credential Capture Without Authentication
Even before obtaining valid credentials, several techniques can capture them passively.
LLMNR/NBT-NS poisoning with Responder:
responder -I eth0 -wrf
-Ispecifies the network interface to listen on-wstarts the WPAD rogue proxy server-renables answering to NetBIOS requests for the local workstation name-ffingerprints the OS of hosts that send broadcast requests- This captures NTLM hashes from hosts making misconfigured broadcast name resolution requests, which can then be cracked offline or relayed
Password spraying (using known valid usernames):
crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Winter2026!' --continue-on-success
- Tests a single, commonly used password against a full list of usernames — spraying one password across many accounts avoids account lockout thresholds that a traditional brute-force attempt would trigger
Phase 3: Enumeration With Valid Credentials
Once any valid domain credential is obtained — even a low-privilege one — enumeration depth increases dramatically.
BloodHound data collection:
bloodhound-python -u username -p 'password' -d corp.local -ns 192.168.1.10 -c All
-u/-psupply valid domain credentials-dspecifies the target domain-nspoints to the domain controller’s IP for name resolution-c Allcollects all available data categories (sessions, ACLs, group memberships, trusts) for graph analysis
Load the resulting data into BloodHound’s interface to visually map privilege escalation paths — this single step often reveals the fastest route to Domain Admin more clearly than hours of manual enumeration.
Phase 4: Kerberos-Based Attacks
Kerberoasting — requesting service tickets for accounts with Service Principal Names (SPNs), then cracking them offline:
GetUserSPNs.py corp.local/username:password -dc-ip 192.168.1.10 -request
- Requests TGS tickets for all discoverable SPN accounts and outputs them in a crackable hash format
- Service accounts are frequently configured with weak, rarely rotated passwords, making this one of the highest-yield AD attacks
AS-REP Roasting — targeting accounts with Kerberos pre-authentication disabled:
GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip 192.168.1.10 -format hashcat
- Attempts to request authentication data for accounts that don’t require pre-authentication, producing a crackable hash without needing any valid credentials at all
Crack captured hashes offline:
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt
-m 13100specifies the Kerberoast (TGS-REP) hash mode- Runs the captured hashes against a wordlist to recover plaintext service account passwords
Phase 5: Lateral Movement
With additional credentials or hashes captured, move across the environment:
crackmapexec smb 192.168.1.0/24 -u username -H ntlm_hash --exec-method wmiexec -x "whoami"
-Hpasses an NTLM hash directly rather than a plaintext password (Pass-the-Hash)--exec-method wmiexecuses WMI for remote command execution-xspecifies the command to run, useful for quickly confirming access before deeper post-exploitation
Phase 6: Privilege Escalation to Domain Admin
Common paths, all visualized clearly by BloodHound:
- Unconstrained/constrained delegation abuse — compromising a machine configured for delegation can allow impersonation of any user who authenticates to it, including Domain Admins
- ACL abuse — misconfigured permissions (e.g.,
GenericAllrights over a privileged group) allow direct privilege escalation without any exploit at all - DCSync attack — once sufficient replication rights are obtained, extract password hashes for any domain account directly from the domain controller:
secretsdump.py corp.local/username:password@192.168.1.10
- Simulates a domain controller replication request to pull password hashes for all domain accounts, including
krbtgt— a finding that, if achieved, demonstrates complete domain compromise
Phase 7: Reporting
AD engagement reports should include a clear attack path narrative — typically a BloodHound-generated graph showing the exact chain from initial low-privilege foothold to Domain Admin — alongside specific ACL, delegation, or credential findings and remediation guidance for each step in the chain.
Essential Tools
- BloodHound — attack path visualization and analysis, the centerpiece of modern AD assessments
- CrackMapExec / NetExec — credential validation, enumeration, and lateral movement across the domain
- Impacket — Python toolkit covering Kerberoasting, secretsdump, and remote execution
- Responder — LLMNR/NBT-NS poisoning for credential capture
- Rubeus — advanced Kerberos abuse toolkit (ticket requests, pass-the-ticket, delegation abuse)
- smbmap — quick SMB share permission enumeration (full guide)
Common Mistakes and Troubleshooting Tips
- Skipping BloodHound early — many testers manually enumerate for hours before realizing BloodHound would have surfaced the same attack path in minutes
- Password spraying without checking lockout policy first — always confirm the domain’s lockout threshold before spraying to avoid locking out legitimate users
- Ignoring Kerberoasting/AS-REP roasting because “it probably won’t work” — these consistently succeed in real environments due to weak service account password hygiene
- Not cleaning up test artifacts — created accounts, modified group memberships, or dropped files should be documented and reverted per engagement rules
- Overlooking hybrid Azure AD/Entra ID trust relationships — modern AD environments frequently extend into cloud identity, expanding the attack surface beyond the on-prem domain alone
Security Risks and Defensive Recommendations
- Enforce strong, unique passwords on service accounts, ideally using Group Managed Service Accounts (gMSA) to eliminate static passwords entirely
- Disable LLMNR and NBT-NS via Group Policy where not explicitly required for legacy compatibility
- Implement a tiered administration model, ensuring Domain Admin credentials are never used to log into lower-tier workstations
- Audit and minimize delegation configurations, particularly unconstrained delegation, which should be eliminated wherever possible
- Regularly audit ACLs on privileged groups and objects using tools like BloodHound proactively, not just during pentests
- Enable Kerberos pre-authentication for all accounts to prevent AS-REP roasting
- Monitor for DCSync-style replication requests from non-domain-controller sources, a strong indicator of active compromise
Practical Checklist
- Domain structure and domain controllers identified via enumeration
- Null session and anonymous SMB access tested
- Password spraying performed only after confirming lockout policy
- BloodHound data collected and analyzed for attack paths
- Kerberoasting and AS-REP roasting attempted against discoverable accounts
- Captured hashes cracked offline where feasible
- Lateral movement tested using valid credentials or hashes (Pass-the-Hash)
- Delegation and ACL misconfigurations reviewed for escalation paths
- Full attack chain documented from initial foothold to highest privilege achieved
- Test artifacts cleaned up or documented per engagement rules
Frequently Asked Questions
Do I need to be a Windows expert to learn Active Directory penetration testing? Strong familiarity with Windows networking and AD concepts (domains, OUs, GPOs, trusts) is essential, but you don’t need deep Windows administration experience — most of what you need is learnable through dedicated AD labs.
What’s the single most valuable tool for AD pentesting? BloodHound, by a wide margin — it transforms hours of manual enumeration into a visual, actionable attack path graph.
Is Kerberoasting always successful? No, but it succeeds often enough in real environments (due to weak service account passwords) that it should be a standard step in nearly every AD assessment.
What certification best validates Active Directory pentesting skills? CRTP (Certified Red Team Professional) and CRTE (Certified Red Team Expert) focus specifically and deeply on AD attack paths; OSCP also covers foundational AD exploitation.
How is AD penetration testing different from general internal network testing? General internal testing covers the broader network and host-level vulnerabilities; AD-specific testing focuses on identity, trust, delegation, and ACL-based privilege escalation paths unique to Windows domain environments.
Can these techniques be practiced legally? Yes, extensively — GOAD, DetectionLab, and Hack The Box/TryHackMe all provide authorized lab environments specifically built around realistic AD attack paths.
What’s the fastest path to Domain Admin in most real engagements? It varies, but Kerberoasting combined with weak service account passwords, or ACL misconfigurations surfaced by BloodHound, are consistently among the fastest and most common paths observed in real assessments.
Conclusion
Active Directory penetration testing rewards a structured attack-path mindset: enumerate broadly, let BloodHound surface the graph of possibility, and chain credential attacks, delegation abuse, or ACL misconfigurations into a demonstrated path from low-privilege foothold to Domain Admin. This remains one of the most consistently in-demand skills in internal network security testing, precisely because so many organizations still run AD with default, attacker-friendly configurations. Build this methodology deliberately in authorized lab environments like GOAD before ever applying it to a signed, scoped engagement.
References
- BloodHound Documentation — bloodhound.readthedocs.io
- Impacket Project — github.com/fortra/impacket
- Microsoft Active Directory Security Documentation — learn.microsoft.com
- MITRE ATT&CK — attack.mitre.org