Active Directory Attack Paths: How Domains Fall

In most enterprise networks, the route from a single compromised workstation to full domain control runs through Active Directory. What makes these paths striking is that they seldom rely on a vulnerability in the conventional sense. They rely on configuration — permissions granted years ago, service accounts created for a project nobody remembers, and trust relationships that made sense at the time.

Why AD is such a productive target

Active Directory is designed for delegation and interoperability across large, messy organisations. That flexibility is genuinely necessary, and it is also what creates attack paths.

Environments accumulate history. Permissions are granted for a migration and never removed, service accounts are created with excessive rights because it was quicker, and nested group membership grows until nobody can say who is effectively an administrator. An attacker does not need to break anything — they need to find the path that already exists.

The recurring paths

• Credential harvesting from memory — obtaining credentials or hashes from a compromised host, then reusing them elsewhere. The reason local administrator rights on a workstation matter so much.
• Kerberoasting — requesting service tickets for accounts with service principal names and cracking them offline. Effective because service accounts frequently have weak, non-expiring passwords and excessive privilege.
• AS-REP roasting — targeting accounts configured without Kerberos pre-authentication, which allows offline cracking without any prior access.
• Shared local administrator passwords — one recovered local admin password that works across hundreds of machines turns a single compromise into estate-wide access.
• Delegation abuse — misconfigured Kerberos delegation permitting impersonation of other users, including privileged ones.
• ACL and permission abuse — an account able to reset another account's password, modify group membership, or write to an object it should not control.
• Certificate services misconfiguration — template and enrolment permissions that allow an attacker to obtain a certificate authenticating as a privileged user.
• Nested group sprawl — effective privilege that nobody intended and few can see without tooling.

The pattern underneath

Almost every path follows the same shape: obtain a foothold, harvest credentials, find an identity with slightly more privilege, repeat until reaching an account with domain-wide control.

Each individual step is small and often uses a legitimate feature exactly as designed. That is precisely why domain compromise is difficult to detect — much of the activity is indistinguishable from routine administration without careful context. Graph-based analysis tooling exists specifically because these relationships are effectively impossible to reason about manually at scale.

What actually breaks the chain

1. Eliminate shared local administrator passwords with a solution that randomises them per machine. This single change breaks one of the most reliable lateral movement routes.
2. Implement administrative tiering so that privileged accounts never authenticate to lower-trust systems. If a domain administrator never logs into a workstation, those credentials cannot be harvested from one.
3. Use dedicated privileged workstations for administrative work, separated from email and browsing.
4. Fix service accounts — use managed service accounts where possible, ensure long random passwords otherwise, and strip privileges that are not required.
5. Audit permissions and delegation with graph tooling, since these relationships are not visible in a directory browser.
6. Review certificate templates, which are a commonly overlooked escalation route.
7. Remove stale objects — dormant accounts and machines that have not authenticated in months.
8. Monitor the specific behaviours — anomalous service ticket requests, replication requests from unexpected hosts, and privileged group membership changes.

Testing it properly

An internal assessment focused on Active Directory usually returns more actionable findings per day than almost any other engagement type, because these paths accumulate silently and are rarely visible without deliberate analysis.

The most useful framing is assumed breach: rather than asking whether an attacker can get in, start from one compromised standard workstation account and establish how far that reaches. That reflects the realistic scenario, and it produces a remediation list ordered by how much each fix actually shortens the path to domain control.

Related from TechBiz Security

• Active Directory assessment
• Network security assessment
• Penetration Testing: The Complete Guide

Sources & further reading

• Microsoft — Securing privileged access
• MITRE ATT&CK — Credential Access
• CISA — Cybersecurity Advisories
• Microsoft — Active Directory security best practices

Frequently asked questions