Penetration testing
Active Directory Attacks Explained for Beginners
Most companies run their Windows computers, users and permissions through Active Directory. That makes it the center of almost every internal penetration test: one weak account or one careless permission can lead, step by step, to control of the whole domain. This guide explains the common weaknesses in plain language, the way a tester thinks about them, and the fix an administrator should apply for each.
What Active Directory Is
Active Directory is Microsoft's directory service. A domain groups users, computers and groups under one set of rules. Domain controllers are the servers that hold the directory and check every login. Group Policy pushes settings to every machine, and permissions decide who can change which object. Logins use two protocols: Kerberos, which works with tickets, and the older NTLM, which many networks still allow.
Why Testers Focus on It
An attacker rarely needs a clever exploit inside a company network. They need one ordinary account, and then a chain of small weaknesses that each give a little more access. A tester's job is to find that chain before an attacker does, show it with evidence and explain how to break it.
1Enumeration, Reading the Map
By default, any domain user can read most of the directory: users, groups, computers, who is an administrator where, and which permissions exist. Testers collect this and load it into BloodHound, which draws the relationships as a graph and shows the shortest path from the account they hold to Domain Admins. Defenders can run the same tool to find and close those paths first.
2Weak Passwords and Password Spraying
Password spraying tries one common password against many accounts, slowly enough to avoid locking them out. It works because some users still pick passwords like a season and a year. In a real test this is done only with written permission and an agreed limit on attempts. Fix: long passphrases, a banned-password list, multi-factor authentication and alerts on many failed logins across accounts.
3Kerberoasting and AS-REP Roasting
Service accounts run applications such as databases. Any domain user can ask for a Kerberos ticket for these services, and part of that ticket is protected with the service account's password. If the password is weak, it can be cracked offline, without touching the network again. AS-REP roasting is a cousin: accounts that have Kerberos pre-authentication switched off give away crackable data without any login at all. Fix: long random passwords for service accounts, preferably group Managed Service Accounts that rotate them automatically, and pre-authentication left on. See how password cracking works.
4NTLM Relay
When a computer authenticates with NTLM, an attacker in the middle can sometimes pass that login on to another server and act as the victim there. It works when servers do not require signing. Fix: require SMB signing, enable LDAP signing and channel binding, and reduce NTLM use wherever Kerberos can replace it.
5ACL Abuse, Permissions Nobody Remembers
Every object in the directory has a permission list. Over the years, help-desk groups, old scripts and migrations leave behind rights such as "can reset this user's password" or "can add members to this group". Each looks harmless, but chained together they become a path to administrator. Testers use tools such as bloodyAD to prove a path exists in the lab. Fix: review delegated rights regularly, remove what is not needed and watch for changes to sensitive groups.
6Local Administrator Reuse
If every workstation shares the same local administrator password, compromising one machine opens all of them. Testers check for this with tools such as NetExec. Fix: Windows LAPS, which gives each machine its own random local administrator password, and no domain administrators logging in to ordinary workstations. Local escalation is covered in privilege escalation explained.
7DCSync, the End of the Chain
Domain controllers copy the directory between themselves. An account with replication rights can ask for that copy, including the password hashes of every user, without logging in to a domain controller. Tools in the Impacket toolkit can do this, which is why testers report any unexpected replication rights as critical. Fix: only domain controllers should hold these rights, and requests from anywhere else should raise an alert.
What a Good Report Says
A finding list on its own is not much use to an administrator. A good Active Directory report shows the attack path as a diagram, gives evidence for each step and orders the fixes so that one change breaks the most paths. Our sample penetration test report shows the format.
Practice Only in Your Own Lab
Everything above must be practiced only on a domain you built yourself, or on systems you have written permission to test. Testing a company network without authorization is a criminal offense in India, whatever your intention. Our network and Active Directory penetration testing course has you build that domain in VirtualBox and assess it with NetExec, BloodHound, bloodyAD and Impacket. For deeper Active Directory work afterward, CPENT AI is the next step.
Want to try an Active Directory lab before you join? Book free trial classes. Contact us or call +91 86868 92922.
Courses Mentioned in This Guide
More Guides
What Is VAPT? Vulnerability Assessment vs Penetration Testing
VAPT explained: how a vulnerability assessment differs from a penetration test, the types of VAPT, how an engagement runs and what the final report contains.
Read the guide →How to Build a Cyber Security Home Lab on Your Laptop
Build a free cybersecurity home lab: the laptop you need, VirtualBox, Kali Linux, vulnerable machines, a Windows domain and a SIEM, kept safely isolated.
Read the guide →Penetration Testing Phases Explained, Step by Step
The phases of a penetration test, from scoping and reconnaissance to exploitation, reporting and retesting, with what happens and what is produced in each.
Read the guide →Nmap for Beginners: Essential Scans Explained
Learn Nmap step by step: host discovery, port and version scans, default scripts, timing and saving output, with the commands explained and where to practice legally.
Read the guide →Start Your Cyber Security Career
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps