Network Security Assessment
Internal and external network testing to expose exploitable exposure.
Learn More
Offensive Security
Active Directory Security Assessment in Pakistan
AD attack-path mapping, Kerberos abuse, and privilege-escalation review.
What it is
Active Directory is where most intrusions turn into disasters. We look for the paths from an ordinary user account to Domain Admin — Kerberos delegation, ACL misconfiguration, credential material left on disk, and the service accounts that quietly hold more privilege than anyone remembers granting.
Types of Active Directory Assessment we deliver
Attack path mapping
The chains that actually lead to Domain Admin, traced from an ordinary user account rather than listed as abstract hardening advice.
Privileged access review
Who is in Domain Admins, Enterprise Admins and the other privileged groups, how they got there, and who is still there years after changing jobs.
Kerberos weaknesses
Kerberoasting, AS-REP roasting, unconstrained and constrained delegation, and the service accounts with passwords set before the current IT team arrived.
Group Policy and ACL review
Permissions on objects and policies that let a low-privilege account write where it should not.
Stale and orphaned accounts
Disabled-but-not-removed users, machines that have not logged on in years, and accounts with passwords that never expire.
Hybrid and Entra ID review
The sync between on-premise AD and Entra ID, where a cloud compromise and an on-premise one become the same incident.
How we do it
-
1
Domain enumeration
Users, groups, computers, trusts, GPOs and privileged group membership mapped from a standard user context.
-
2
Attack path analysis
BloodHound-style graphing to find the shortest route from any owned account to domain dominance.
-
3
Kerberos attacks
Kerberoasting and AS-REP roasting against service accounts, plus unconstrained and constrained delegation abuse.
-
4
ACL and object permissions
Dangerous rights — GenericAll, WriteDACL, WriteOwner — on users, groups and OUs that grant silent escalation.
-
5
Credential exposure
Passwords in GPOs, scripts and shares; cached credentials and LAPS coverage gaps.
-
6
Tiering and hygiene review
Whether administrative tiering exists in practice, and where privileged accounts log in that they should not.
What's included
- Attack path graphs from ordinary user to Domain Admin
- Kerberos delegation and roasting analysis
- Dangerous ACL discovery across the directory
- Service account privilege audit
- Password policy and LAPS coverage review
- Fix list ordered by which paths it closes
Who needs it
- Organisations running Windows domains of any real age
- Teams recovering from or preparing against ransomware
- Businesses with Active Directory inherited through acquisitions
Deliverables
- Attack path graphs with the chokepoints marked
- Privileged account and service account inventory
- Dangerous permission report by object
- Remediation sequence — which single change closes the most paths
What Active Directory Assessment costs
Priced on domain and forest size, and on how many starting positions you want tested.
The figure depends on scope, so we quote one fixed price in writing before any work begins. These are the things that move it:
- Users, groups and computer objects — Attack-path analysis grows with the object graph. A 200-user domain and a 6,000-user domain are not the same amount of path to walk.
- How many domains or forests — Trust relationships are where the interesting escalations live, and each trust is additional work rather than more of the same.
- The starting position you want proven — From an unauthenticated foothold, from a standard domain user, or from a compromised helpdesk account — each is a separate question and each is worth asking.
- Whether tiering already exists — An environment with an administrative tier model takes longer to assess properly, because the question moves from "is there a path" to "does the model actually hold".
- Whether findings need to be re-walked after remediation — AD remediation changes the graph. Re-running the analysis after your changes is a second engagement, usually a short one.
A read-only domain account on day one removes the whole discovery phase and is the cheapest thing you can give us.
Where we deliver Active Directory Assessment
Active Directory assessment runs remotely through a domain-joined machine or a jump host, so we work with organisations anywhere in Pakistan. On-site is available from Multan where your policy will not allow external access into the domain, which is common in banking and government.
Compliance relevance
Frequently asked questions
One ordinary domain user account with no special privileges. That is the point — we are modelling what an attacker gets from a single phished employee.
Enumeration and graphing are read-only. Anything that writes to the directory or requests tickets at volume is agreed in advance and run in a window you choose.
Yes, and hybrid is often the weakest moment. Connect servers, synchronisation accounts and the trust between on-premise and cloud are exactly where hybrid environments get compromised.
Because in a Windows environment it is where the engagement is usually decided. AD holds the authentication for everything else, so a path to Domain Admin is a path to every system at once. A general network test may never reach it; an assessment built for it starts there.
One ordinary domain user account and a machine on the network, which is deliberately the position a phished employee would be in. We do not start with administrative access, because starting there would answer a question nobody is asking.
The assessment is read-heavy and non-destructive by default. Anything that changes state, such as demonstrating a privilege escalation end to end, is agreed with you first and performed in a window you choose.
Three to seven working days for most environments. Domains with many trusts, a long history of mergers, or a large number of service accounts take longer, because the complexity is exactly what creates the attack paths.
They answer different questions. Defender for Identity tells you about suspicious activity happening now. An assessment tells you which paths exist to be abused in the first place, including the ones that look like normal administration and therefore never alert.
The specific attack chains we walked, with each step and the object that permitted it, ranked by how little privilege the attacker needs to start. Then the fixes, separated into what can be changed this week and what needs a project.
Yes, and the sync between them is where we pay most attention. Hybrid identity is where an on-premise compromise becomes a cloud compromise and the other way round, usually through a sync account with more privilege than anyone intended.
Priced on domain and forest size, and on how many starting positions you want tested. Beyond that the figure depends on scope — mainly users, groups and computer objects, how many domains or forests and the starting position you want proven. We quote one fixed price in writing before any work begins, so the number does not move once the engagement starts. A read-only domain account on day one removes the whole discovery phase and is the cheapest thing you can give us.
New to penetration testing?
Read the guide
Our complete guide covers methodology, standards, what a good report contains, and how often to test.
Related services
Penetration Testing
Manual, OSCP-grade testing that emulates real attackers against your assets.
Learn MoreRed Team Operations
Goal-based adversary emulation testing people, process, and technology.
Learn More