Active Directory Security Assessment Guide
Active Directory Security Assessment Guide
A structured guide for reviewing an Active Directory environment, identifying common weaknesses, and prioritizing remediation work.
Active Directory security assessments should be practical, repeatable, and focused on risk. This guide provides a structured approach for reviewing identity hygiene, privileged access, authentication controls, delegation, certificate services, logging, and operational resilience.
Define Scope
Identify the domains, forests, trusts, systems, and identity components that should be included in the review.
Collect Evidence
Gather configuration data, security settings, account details, delegation settings, certificate data, and event sources.
Prioritize Risk
Focus on issues that create domain compromise paths, privileged access exposure, relay risk, or persistent access.
Plan Remediation
Turn findings into practical workstreams with ownership, priority, validation steps, and operational impact review.
Assessment Overview
An Active Directory security assessment is a structured review of identity-related risk. The goal is not only to find misconfigurations. The goal is to understand which issues could realistically lead to privilege escalation, lateral movement, persistence, or domain compromise.
- Review the environment from the perspective of identity control, not just configuration compliance.
- Prioritize findings that affect domain controllers, privileged accounts, AD CS, delegation, authentication, and Tier 0 systems.
- Separate high-impact risks from routine cleanup items.
- Document evidence clearly enough that administrators can validate each issue.
- Provide remediation guidance that accounts for operational risk and testing.
- Validate fixes after remediation rather than assuming changes were successful.
Scope Planning
Scope determines whether the assessment will provide an accurate view of risk. Active Directory environments often include multiple domains, forests, trusts, certificate authorities, hybrid identity components, and delegated administration models.
- Identify all domains and forests included in the assessment.
- Document domain controllers, sites, trusts, and domain functional levels.
- Identify certificate authorities and AD CS role services.
- Identify hybrid identity components such as Microsoft Entra Connect or cloud sync.
- Identify privileged access workstations, jump servers, management servers, and backup systems.
- Identify security tools, endpoint management platforms, and monitoring systems that depend on Active Directory.
- Confirm whether the assessment includes only configuration review or also event log and behavior review.
- Define whether the assessment is a point-in-time review or part of recurring posture management.
Data Collection
Data collection should be broad enough to identify meaningful risk, but controlled enough to avoid unnecessary disruption. In most environments, a read-only review can identify many important Active Directory weaknesses.
- Collect domain, forest, site, subnet, trust, and domain controller information.
- Collect privileged group membership and nested group relationships.
- Collect user, service account, computer account, and group configuration data.
- Collect Group Policy links, permissions, and high-impact settings.
- Collect Kerberos delegation settings, SPNs, and preauthentication configuration.
- Collect LDAP signing, LDAP channel binding, SMB signing, and NTLM-related settings.
- Collect AD CS certificate template, CA, and enrollment endpoint data.
- Collect relevant event logs where monitoring and detection review are in scope.
- Export findings and evidence in a format that can be reviewed and validated by the operations team.
Tier 0 Review
Tier 0 includes systems and identities that can control Active Directory or the identities that administer it. Weaknesses in Tier 0 usually deserve the highest priority.
- Identify domain controllers and systems that manage domain controllers.
- Identify certificate authorities and PKI systems trusted for authentication.
- Identify backup systems that can restore or control domain controllers.
- Identify privileged access workstations, jump servers, and management servers.
- Review who can administer Tier 0 systems.
- Review where Tier 0 accounts can log on.
- Review whether Tier 0 systems are protected from lower-tier administration.
- Review whether privileged accounts are protected from delegation.
- Review logging and monitoring coverage for Tier 0 systems.
Identity Hygiene
Identity hygiene issues may not always look critical by themselves, but they often create useful opportunities for attackers. Stale accounts, weak passwords, old service accounts, and unclear ownership make the environment harder to defend.
- Identify stale enabled user accounts.
- Identify stale enabled computer accounts.
- Identify disabled accounts that have not been reviewed or removed.
- Identify accounts with passwords that never expire.
- Identify accounts with old passwords, especially privileged and service accounts.
- Identify accounts configured with reversible encryption.
- Identify users with Kerberos preauthentication disabled.
- Identify unmanaged or ownerless service accounts.
- Review group membership for stale users, stale computers, and old service accounts.
Privileged Access Review
Privileged access is one of the most important assessment areas. The review should include direct group membership, nested membership, delegated permissions, local administrative access, and accounts with control over sensitive systems.
- Review Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Server Operators, and Backup Operators.
- Identify nested group paths into privileged groups.
- Review users and groups with delegated control over sensitive OUs.
- Review local administrator rights on servers and management systems.
- Identify service accounts with privileged group membership.
- Identify accounts with rights to modify Group Policy Objects.
- Identify accounts with rights to modify certificate templates or CA configuration.
- Identify accounts with write permissions over computer objects that could support delegation abuse.
- Document all accounts with practical Tier 0 control.
Authentication Controls
Authentication controls determine how credentials can be used, reused, relayed, or attacked. Review both policy settings and real-world dependencies.
- Review domain password policy and fine-grained password policies.
- Review account lockout policy and failed authentication behavior.
- Review NTLM usage before applying restrictions.
- Review systems and applications that still require NTLM.
- Review simple LDAP binds and whether they use LDAPS or StartTLS.
- Review legacy name resolution protocols such as LLMNR and NBT-NS.
- Review administrative logon patterns for privileged accounts.
- Review whether privileged accounts are marked as sensitive and not delegable.
- Review compatibility before enforcing stronger authentication controls.
Kerberos and Delegation Review
Kerberos weaknesses can support offline password cracking, impersonation, and lateral movement. Delegation settings should be rare, documented, and limited to business requirements.
- Identify accounts with Kerberos preauthentication disabled.
- Identify user accounts with Service Principal Names.
- Review service accounts with old passwords and SPNs.
- Review accounts that support RC4 encryption.
- Identify non-domain-controller systems trusted for unconstrained delegation.
- Review constrained delegation and allowed SPN targets.
- Identify accounts configured with protocol transition.
- Identify resource-based constrained delegation configurations.
- Review computer object permissions that could allow RBCD abuse.
- Protect privileged accounts from delegation.
LDAP, NTLM, and SMB Review
LDAP, NTLM, and SMB settings are closely related to relay risk. These controls should be reviewed together instead of treated as isolated hardening items.
- Review LDAP signing requirements on domain controllers.
- Review LDAP channel binding requirements on domain controllers.
- Review clients that perform unsigned LDAP binds.
- Review applications that use simple LDAP binds.
- Review SMB signing requirements on domain controllers and sensitive servers.
- Review NTLM authentication patterns.
- Review AD CS web enrollment exposure to NTLM relay.
- Review MachineAccountQuota and computer account creation paths.
- Review whether Extended Protection for Authentication is needed on HTTP-based Windows authentication endpoints.
AD CS Review
Active Directory Certificate Services can create powerful privilege escalation paths. A security assessment should review certificate templates, CA configuration, enrollment permissions, and certificate-based authentication behavior.
- Inventory enterprise certificate authorities and published templates.
- Identify templates that allow client authentication, smart card logon, or Any Purpose usage.
- Identify templates where the requester can supply subject or SAN values.
- Review enrollment permissions on authentication-capable templates.
- Review certificate template ACLs for excessive write permissions.
- Review CA permissions and certificate manager permissions.
- Review web enrollment endpoints and NTLM relay protections.
- Review certificate mapping behavior and weak mappings.
- Monitor certificate template and CA configuration changes.
Logging and Monitoring Review
A security assessment should evaluate whether the organization can detect important Active Directory changes and suspicious authentication behavior.
- Review domain controller security log collection.
- Review monitoring for privileged group membership changes.
- Review monitoring for user, computer, and service account changes.
- Review monitoring for Kerberos service ticket activity.
- Review monitoring for NTLM authentication.
- Review monitoring for LDAP signing and channel binding events.
- Review monitoring for delegation-related attribute changes.
- Review monitoring for Group Policy changes.
- Review monitoring for certificate template and CA configuration changes.
- Review alert coverage for common Active Directory attack paths.
Prioritization Model
Not every finding deserves the same urgency. Prioritization should consider impact, exploitability, exposure, operational context, and whether the issue contributes to a realistic attack path.
| Priority | Typical Conditions | Examples |
|---|---|---|
| Critical | Could enable domain compromise, privileged impersonation, or control over Tier 0 systems. | Unconstrained delegation on servers, dangerous AD CS templates, weak CA permissions, privileged accounts exposed to delegation. |
| High | Creates meaningful escalation, lateral movement, relay, or credential attack risk. | Kerberoastable privileged service accounts, AS-REP roastable users, LDAP signing gaps, broad delegated permissions. |
| Medium | Increases attack surface or weakens security posture but may require additional conditions. | Stale computer accounts, old service account passwords, weak logging coverage, excessive non-Tier 0 access. |
| Low | Represents cleanup, hygiene, or documentation improvements with limited direct attack impact. | Unused groups, minor inventory gaps, non-sensitive disabled accounts pending removal. |
- Prioritize issues that affect domain controllers, CAs, privileged accounts, and Tier 0 systems.
- Prioritize misconfigurations that enable impersonation, relay, credential theft, or offline cracking.
- Prioritize findings that are externally reachable, broadly exposed, or easy to abuse.
- Lower priority for issues that are isolated, already compensated for, or require unlikely conditions.
- Document assumptions, compensating controls, and business context for each priority decision.
Remediation Roadmap
A useful assessment should not stop at findings. It should help the organization decide what to fix first, what to test, and what can be handled as part of longer-term security hygiene.
- Create a short-term remediation plan for critical and high-risk issues.
- Identify changes that require testing because they may affect applications or legacy systems.
- Assign owners for each remediation workstream.
- Define validation steps for each finding.
- Group related findings into workstreams, such as AD CS hardening, delegation cleanup, service account hygiene, and LDAP hardening.
- Identify quick wins that reduce risk without major operational impact.
- Track exceptions with owners, justification, and review dates.
- Schedule a follow-up review after remediation.
Reporting
The final assessment output should be useful to both technical teams and leadership. It should explain risk clearly, provide evidence, and give practical next steps.
- Include an executive summary with the highest-risk themes.
- Summarize the most important attack paths and exposure points.
- Include finding descriptions that explain why each issue matters.
- Include evidence that allows administrators to validate the issue.
- Include remediation guidance and validation steps.
- Separate urgent remediation from longer-term hygiene work.
- Include a prioritized roadmap with recommended ownership and sequencing.
- Track exceptions and risks that the organization chooses to accept temporarily.
Use Carefully
Validate findings before making production changes.
This guide is intended as educational guidance. Active Directory environments vary widely, and security changes may affect authentication, applications, operations, and legacy systems. Review evidence, test changes safely, document exceptions, and validate remediation before applying changes broadly in production.