Most breaches aren't break-ins. They're logins — and in most Windows estates, the thing that decides whether a login turns into a full takeover is Active Directory.
AD has usually been running for fifteen or twenty years. It has outlived the people who built it, absorbed two or three mergers, and been extended to sync with Entra ID. Every one of those changes left something behind: a service account nobody owns, a delegation setting nobody remembers enabling, a certificate template copied from a blog post in 2016.
None of that shows up on a vulnerability scan, because none of it is a missing patch. It's configuration. An attacker with one ordinary user account can read most of it, chain it together, and walk to Domain Admin without exploiting a single CVE.
An Active Directory security assessment is how you find those chains before someone else does. This post explains what an identity-focused assessment actually checks, how it differs from an audit or a pen test, and what you should have in hand when it's done.
What is an Active Directory security assessment?
An Active Directory security assessment is a structured review of how your directory can be abused — not just whether it's configured to a checklist. It asks one question: starting from an ordinary account, how far can someone get, and by which route?
That's what separates Active Directory security from Active Directory administration. Administration keeps users logging in. Security is about who can become whom, and how quickly.
The term gets used loosely, so it helps to separate it from the reviews it's often confused with:
| Review | What it answers | Typical output |
|---|---|---|
| AD health check | Is the directory working? Replication, DNS, FSMO roles, stale DCs | Operational fixes |
| AD security audit | Does it meet a policy or control framework? | Pass/fail against controls, evidence for auditors |
| AD security assessment | How could it be abused, and what matters most to fix? | Attack paths, prioritised findings, a fix plan |
| AD penetration testing | Can a tester actually reach Domain Admin? | Proof of compromise for the paths tested |
A good identity-focused assessment sits between the last two. It maps every path the way an assessment does, then proves the ones that matter the way a pen test does — with the active steps agreed with you in advance.
What an identity-focused assessment actually checks
The checks below are where privilege actually escalates in AD. Each one is something a single low-privileged account can usually discover on its own.
1. Who really holds Tier 0
Domain Admins is the obvious list. The real list is longer: Enterprise Admins, Schema Admins, Account Operators, Backup Operators, the accounts protected by AdminSDHolder, and anyone with rights over a domain controller or a Group Policy linked to one. Nested groups hide most of it — a helpdesk group inside a group inside Server Operators is still Tier 0. We also check whether those accounts sit in the Protected Users group and log on only to hardened admin workstations.
2. Kerberos weaknesses
Any account with a service principal name can be Kerberoasted: an attacker requests a ticket and cracks the password offline, with no failed logins to alert on. Accounts set to skip Kerberos pre-authentication can be AS-REP roasted the same way. We list every exposed account, how old its password is, and whether it could move to a group managed service account (gMSA).
We also check the krbtgt account. If its password hasn't been reset in years, any golden ticket forged with an old hash may still work. A safe krbtgt password reset is done twice, with a full replication cycle in between.
3. Delegation
Unconstrained delegation lets a server impersonate anyone who connects to it — including a domain controller, if an attacker can make it authenticate. Constrained and resource-based delegation are safer but often misconfigured. We map every delegation setting and who can change it.
4. Active Directory Certificate Services (ADCS)
ADCS is the most under-checked part of most estates. One loose certificate template — for example, one that lets the requester name any user and is open to Domain Users — is a direct route to Domain Admin. We review templates, enrolment rights, CA permissions and web enrolment against the known abuse patterns (ESC1 onwards).
5. ACLs and attack paths
The most dangerous findings are usually permissions, not settings: GenericAll on a group, WriteDACL on an OU, DCSync rights granted for an old migration. Individually they look harmless. Chained, they form an attack path. This is where BloodHound for Active Directory earns its place — it turns thousands of permissions into a graph showing the shortest routes to Tier 0.
6. Service accounts and other non-human identities
Service accounts are often over-privileged, never rotate, and have no named owner. We flag the ones with interactive logon rights, passwords that never expire, or membership in admin groups. More on why these matter in our guide to non-human identity management.
7. Legacy protocols and stored secrets
NTLMv1, unsigned LDAP and SMB, and the print spooler on domain controllers all make relay attacks easier. We also search SYSVOL for old Group Policy Preferences passwords, check whether local admin passwords are unique (LAPS), and look at MachineAccountQuota — by default, any user can join ten computers to the domain.
8. Stale and orphaned access
Enabled accounts for people who left, computers that haven't logged in for a year, admin rights nobody reviews. This overlaps with your user access reviews — the assessment gives those reviews a cleaner starting point.
9. The hybrid link to Entra ID
If you sync to Entra ID, the sync server and its service account are effectively Tier 0 in both directories. We check where it runs, who can log on to it, and which permissions the sync account holds on-prem.
Active Directory assessment tools — and where they stop
The free tools are good, and you should run them. Three cover most of the ground:
- PingCastle (now part of Netwrix) scores the domain against a rule set and produces a readable risk report.
- Purple Knight (from Semperis) runs a similar set of indicators and adds some Entra ID checks.
- BloodHound (from SpecterOps) graphs permissions and group memberships to show attack paths.
What these Active Directory security tools give you is a list. What they can't tell you is which three findings matter in your environment, which "critical" item is a false alarm because of a control they can't see, or how to fix a delegation setting without breaking the application that depends on it.
That's the gap an engineer-led assessment fills: the tools find, the engineer confirms, ranks and plans the fix. If you've already run PingCastle and have a report full of red, that's a fine place to start the conversation.
What you should have when it's done
An assessment is only as useful as what you can act on afterwards. At the end you should hold:
- An attack-path map — the routes from an ordinary account to Tier 0, shortest first.
- Prioritised findings — ranked by how much they shorten those routes, not by a tool's default severity.
- A fix plan — who changes what, in what order, and what might break, so the work can actually be scheduled.
- Evidence your auditors can use — useful if SOX, PCI DSS or a cyber-insurance questionnaire is asking about privileged access.
How to secure Active Directory: hardening quick wins
Some Active Directory security best practices pay off before any assessment starts. If you do nothing else this quarter:
- Move service accounts with SPNs to gMSAs, or give them 25+ character passwords.
- Reset the krbtgt password (twice, with replication in between) if it hasn't been done in the last year.
- Turn off the print spooler on domain controllers.
- Set MachineAccountQuota to 0.
- Deploy Windows LAPS so every local admin password is unique.
- Put Tier 0 admins in Protected Users and give them separate admin accounts.
- Remove standing admin rights where you can — see our guide to just-in-time access and zero standing privileges.
Active Directory hardening like this closes the easy routes. The assessment finds the ones specific to your estate — and that's where a PAM platform like CyberArk (now Idira) takes over, vaulting and rotating the credentials that remain.
Frequently asked questions
What is Active Directory in cyber security?
Active Directory is the system that decides who can log on to what across a Windows network. In security terms, it's the map an attacker uses to find privileged accounts — and the keys to most of the estate once they control it.
Will an assessment disrupt production?
It shouldn't. Most of the work is read-only enumeration that any domain user can already perform. Any active step — such as cracking a roasted ticket or testing a certificate template — is agreed with you before it runs.
How is this different from a regular network pen test?
A network pen test looks for exploitable hosts and services. Active Directory penetration testing, done as part of an identity-focused assessment, looks at the trust and permissions between accounts. Most of the routes it finds involve no vulnerability at all.
How often should we assess Active Directory?
Once a year at minimum, and after any big change: a merger, a new Entra ID sync, a domain migration, or a new certificate authority. Attack paths come back as admins make everyday changes.
How often should the krbtgt password be reset?
Periodically as routine hygiene, and immediately (twice) after any suspected domain compromise. Wait for full replication between the two resets so existing tickets aren't cut off unexpectedly.
Do we need this if we already have a PAM tool?
Yes. PAM protects the accounts you've onboarded. An assessment finds the privileged access you didn't know existed — which is usually what needs onboarding next.
Start with the paths that matter
Applied IAM's identity-focused Active Directory security assessment is run by engineers who deploy and operate privileged access for a living — certified in CyberArk (CDE-PAM, Guardian, Defender), SailPoint IdentityIQ, CISSP and Security+. We don't hand over a scanner report. We hand over the routes, the order to close them, and the help to do it.
If you're evaluating an AD security assessment, or already have a PingCastle report you're not sure how to prioritise, book 30 minutes with one of our engineers. We'll walk through your setup and tell you where we'd look first. If you're earlier than that, Identity Security Posture Management is the wider view of the same problem.
