In most enterprise networks in Canada and the United States, Active Directory is the single system that decides everything else. It authenticates the users, authorizes access to the file servers and applications, and holds the privileged accounts that administer the environment. That makes it the destination every serious attacker is driving toward, because whoever controls the directory controls the organization. It is also the system defenders understand least well, because two decades of accumulated groups, trusts, delegations, and service accounts hide escalation paths that no one deliberately created and no scanner will surface.
This guide explains what a professional Active Directory penetration test covers, how attackers turn a standard user into a Domain Admin, what you receive, and how to prepare. It reflects what we find in real assessments across financial services, healthcare, and public-sector environments in Canada and the United States, not a generic checklist. If you want the working tool our consultants use to run these engagements, the free Active Directory Penetration Testing Playbook is available below.
What Active Directory Penetration Testing Is
Active Directory penetration testing is a structured, authorized attempt to compromise your Active Directory environment using the same techniques a real attacker would use, performed with written permission and defined rules of engagement. It usually starts from an assumed breach, a standard domain user or a single compromised workstation, and measures how far that position can be escalated. The goal is to prove the paths from low privilege to domain dominance, demonstrate what they expose, and hand back evidence-based, prioritized remediation.
It is not a vulnerability scan or a configuration review. A scanner lists missing patches, and an audit compares settings against a benchmark, but neither can resolve the relationships between users, groups, service accounts, and permissions that actually form an escalation path. That requires a tester who maps the environment as an attack graph and walks it. In our engagements, the finding that matters most is rarely a missing patch; it is a chain, a Kerberoastable service account, an abusable delegation, and a certificate template, that a scanner reported only as unrelated low-context issues.
Active Directory Penetration Testing vs Vulnerability Scanning and a Security Audit
Active Directory penetration testing proves exploitable escalation paths with evidence, while a vulnerability scan lists known weaknesses and an Active Directory security audit compares configuration against best practice. All three are useful, and the difference matters when you are scoping an engagement and defending the spend to a board or an auditor.
- Vulnerability scanning finds known CVEs and missing patches on domain-joined hosts. It is necessary and cheap, and it is the floor. It does not resolve permissions, delegation, or escalation paths.
- An Active Directory security audit reviews configuration and hygiene against a benchmark and produces a prioritized posture report. It is valuable for baselining, but it stops short of proving which weaknesses actually chain into domain compromise.
- Active Directory penetration testing takes those weaknesses and proves which ones combine into a real path from a standard user to Domain Admin, with reproducible evidence, on a defined scope. It answers the question a leader actually asks: if a laptop were phished tomorrow, how quickly would the attacker own the domain?
Most enterprises need scanning and hygiene review running continuously, and an Active Directory penetration test on a defined cadence to prove that the escalation paths have actually been closed. The techniques below are examined in depth in our Kerberoasting, NTLM relay, ADCS abuse, and DCSync analyses.
Free download: the Active Directory Penetration Testing Playbook
The article explains the method. The Playbook is the working toolkit our consultants run an engagement with: an assumed-breach methodology, an attack-path mapping guide, scoping and rules-of-engagement checklists, an evidence template, and a tiering and remediation matrix. Confirm your email and we send a secure download link.
Privacy notice: Double opt-in - we email a confirmation link and the playbook downloads only after you confirm. We use your name and email to deliver the playbook and, only if you opt in above, to send marketing communications you can unsubscribe from at any time. We never sell your information. To unsubscribe or request deletion, email info@cybersecpentesting.com. See our Privacy Policy.
Why Active Directory Is the Primary Target
Active Directory concentrates authority in one place, which is what makes it efficient to administer and devastating to lose. An attacker who reaches domain dominance does not need to exploit each system individually; they inherit the keys to all of them. The escalation paths that get them there fall into a handful of recurring categories.
| Weakness class | What it looks like | Why a scanner misses it |
|---|---|---|
| Kerberos service accounts | Kerberoastable accounts with weak passwords and high privilege | Requires requesting and cracking tickets, then using the result |
| Credential exposure and reuse | Shared local admin passwords, cached credentials, secrets in scripts | The credential is valid; only its reuse across systems is the flaw |
| Delegation and ACLs | Unconstrained, constrained, and resource-based delegation; dangerous object permissions | Requires resolving the permission graph, not reading one object |
| Certificate services (ADCS) | Misconfigured templates that issue privileged certificates | A supported feature used as intended by the wrong requester |
| Hybrid identity | Sync accounts and trust between on-premises AD and Entra ID | Impact crosses the boundary between two identity systems |
Kerberos and NTLM Authentication
The protocols that make Active Directory convenient also create its most reliable attack paths. Kerberoasting (MITRE ATT&CK T1558.003) requests service tickets for accounts running under a user identity and cracks them offline, turning a weak service-account password into privileged access, and AS-REP roasting (T1558.004) does the same against accounts with Kerberos pre-authentication disabled. NTLM, still widely enabled, allows relaying coerced authentication to systems that trust it, including LDAP and Active Directory Certificate Services. Neither needs an exploit; both abuse authentication working as designed, which is exactly why scanners do not flag them. See our Kerberoasting and NTLM relay deep-dives.
Credential Exposure and Reuse
The most common escalation we see is not clever, it is credential reuse. A shared local administrator password across workstations, cached domain credentials on a compromised host, or a service account password left in a script lets an attacker move from the first machine to many, and eventually to one that a privileged user has touched. Unique, rotated local administrator passwords (Microsoft LAPS) and a tiered administration model break these paths by denying the reuse they depend on. Once privileged credentials are captured, DCSync (T1003.006) replicates directory data to pull every password hash in the domain.
Delegation and Trust
Delegation lets a service act on behalf of a user, and misconfigured delegation lets an attacker impersonate anyone, including a Domain Admin. Unconstrained, constrained, and resource-based (RBCD) delegation each create an impersonation path when they are configured too broadly. Dangerous permissions on objects, accumulated over years of administration, create the same effect quietly: a user who can reset another account's password or edit a group is one step from privilege they were never meant to have. These paths are invisible until the permission graph is resolved, which is why mapping is central to the engagement.
Certificate Services and ADCS
Active Directory Certificate Services is now one of the most productive escalation routes in a modern domain. A misconfigured certificate template can let a low-privileged user request a certificate that authenticates as a privileged account, converting an ordinary user into a Domain Admin through a supported feature. The ESC1 through ESC8 techniques (MITRE ATT&CK T1649) are covered in our ADCS abuse paths analysis.
Hybrid Identity and Entra ID
Most organizations now run hybrid identity, synchronizing on-premises Active Directory with Entra ID (formerly Azure AD). That connection is an escalation path in both directions: on-premises compromise can reach cloud identities, and cloud misconfigurations can reach the on-premises domain. A complete assessment tests the trust between the two, examined in our Azure and Entra ID attacks guide and alongside modern identity risks in identity-based attacks and MFA bypass.
What a Professional Active Directory Penetration Test Covers
A credible engagement is a structured attempt to escalate from a realistic starting position to domain dominance, not a configuration report. It runs as a repeatable sequence, and each phase feeds the next.
Scope and Rules of Engagement
The domains and forests in scope, the starting position (assumed-breach user, workstation, or unauthenticated), and any restrictions are named explicitly, along with the rules of engagement. Assumed breach is the realistic default, because a real attacker rarely starts from nothing. Good scoping is the first control an assessment provides, not a formality, and it aligns the engagement to your obligations, whether that is SOC 2, PCI DSS, HIPAA, or PIPEDA.
Methodology and Attack-Path Mapping
A professional test follows a published methodology aligned to MITRE ATT&CK rather than a tester's memory, and it treats the domain as an attack graph. Tools such as BloodHound resolve the relationships between users, groups, sessions, and permissions so that escalation paths become visible, and the tester then walks the shortest real path to domain dominance and every meaningful alternative. Mapping is what turns a list of settings into a proof of impact.
Manual Testing vs Automated Scanning
Tools accelerate a skilled tester and are indispensable for enumeration and mapping. But the outcome that matters, a proven path from standard user to Domain Admin, is built by a human who chains a Kerberoast, a delegation abuse, and a certificate template into a single result, because no scanner constructs that chain. An engagement that is only a tuned scanner is a scan with a higher invoice, and reviewers can tell the difference.
| Automated scanner | Manual penetration test |
|---|---|
| Lists missing patches and known CVEs | Proves standard-user-to-Domain-Admin paths |
| No notion of permissions or delegation | Resolves and abuses the permission graph |
| No attack chaining | Chains Kerberos, delegation, and ADCS to impact |
| Flags features as intended behaviour | Proves the feature abused by the wrong principal |
| Severity by generic label | Severity by the escalation it enables |
Evidence and Finding Development
Every proven path is documented with reproducible evidence, tied to the accounts and systems it reached, and translated into business risk. Findings are prioritized by the escalation they enable and by which single change breaks the path, so remediation is efficient. The engagement also records what could not be confirmed, so a limitation reduces confidence in coverage rather than being mistaken for an absence of risk.
Common Active Directory Attack Paths We Prove
Across Canadian and U.S. engagements, a handful of paths recur, and naming them helps security teams recognize their own exposure. These are the chains we most frequently develop from a standard user to domain dominance:
- Kerberoast to privileged account: a weak service-account password is cracked from a requested ticket, yielding an account with far more privilege than it needed.
- NTLM relay to ADCS to Domain Admin: coerced authentication is relayed to a certificate service that issues a privileged certificate, escalating straight to domain control.
- Delegation or ACL abuse: an over-broad permission or an unconstrained delegation lets a low-privileged user impersonate or reset a privileged one.
- Credential reuse to DCSync: a shared or cached credential reaches a privileged account, and DCSync then extracts every hash in the domain.
What We Actually Test in Active Directory
Scope is agreed per engagement, but a full Active Directory penetration test typically covers the areas below, with depth prioritized by where your domain actually carries risk.
How Findings Become Business Risk
A finding is only useful when it is expressed as risk a leader can act on. The severity of an Active Directory issue is decided by the escalation it enables, not by the sophistication of the technique. The same weak service-account password is minor in isolation and critical when it sits on the path to Domain Admin, and a good report makes that distinction explicit by describing the path and the single change that breaks it.
A professional report separates technical impact from business translation and maps findings to the frameworks your organization answers to. Domain compromise is, in practice, the mechanism behind most ransomware incidents, which is why it draws board and regulator attention. NIST CSF 2.0 and CIS Controls v8 provide the control language; SOC 2, PCI DSS, and HIPAA drive audit expectations in the US; and PIPEDA, under the Office of the Privacy Commissioner, sets the reasonable-safeguard expectation in Canada, addressed in our PIPEDA penetration testing guide.
What to Expect From an Active Directory Penetration Testing Engagement
Buyers ask the same practical questions before commissioning a test. Here is what a CSPI Active Directory engagement involves, so there are no surprises when you scope one.
| Who performs the testing | A named principal consultant (CREST CRPT, OSCP, OSEP), not an outsourced or rotating team. The person who tests writes the report. |
| Access required | For the standard assumed-breach scenario, a low-privileged domain user account and a domain-joined endpoint or network access. Unauthenticated and insider-privilege variants can be added. |
| Production impact | Testing is deliberately non-destructive. Disruptive actions are excluded, credential and escalation checks are validated carefully, and any intrusive step is agreed in advance and scheduled around change windows. |
| Timeline | A focused single-domain engagement typically takes one to two weeks of testing plus reporting; multiple forests or a large hybrid estate extend it. The scoping call sets the schedule. |
| How findings are validated | Every path is manually proven and captured with reproducible evidence, including the specific change that breaks it. There are no unverified false positives in the report. |
| What you receive | A technical report with reproducible attack paths, an executive summary, business-risk translation, prioritized remediation with a tiering model, framework mapping, and a retest of fixed findings. |
| Included vs excluded | Scope is fixed in writing: named domains, forests, and starting position in scope; denial-of-service, physical intrusion, and third-party-hosted systems out of scope unless explicitly agreed. |
How to Prepare for an Active Directory Penetration Test
A few steps make the engagement faster and more valuable. Provision the assumed-breach user account and the network access or endpoint the test needs before the start date, and confirm in writing how any sensitive data will be handled. Share the domain and forest structure and any known areas of concern, so the tester spends time on depth rather than rediscovery. Make sure logging and monitoring are in a state you are willing to have tested, because part of the value is learning whether your defenders would detect the escalation, which a red team adversary simulation stresses at broader scope. Confirm authorization and rules of engagement, and agree in advance how findings will be prioritized and retested. For where an Active Directory test fits alongside network testing, see network penetration testing and what penetration testing is.
What You'll Receive in the Active Directory Penetration Testing Playbook
The article explains the method. The Playbook is the actionable toolkit that lets you run or govern an engagement, and it complements the guide rather than repeating it. It is a working document, not a marketing brochure, and it includes:
- A scoping worksheet to define domains, forests, starting position, and success criteria before testing begins.
- A rules-of-engagement checklist covering authorization, exclusions, data handling, testing windows, and communication.
- An assumed-breach methodology sheet aligned to MITRE ATT&CK, covering enumeration, mapping, credential access, and escalation.
- An attack-path mapping guide for turning the permission and trust graph into proven routes to domain dominance.
- An evidence collection template so each path is captured reproducibly, and a findings register that scores severity by the escalation it enables.
- A tiering and remediation matrix and an executive reporting checklist so fixes are sequenced by the paths they break, plus a fully sanitized worked example (standard user to Domain Admin).
Frequently Asked Questions
What is Active Directory penetration testing?
Active Directory penetration testing is an authorized, human-led assessment that emulates a real attacker inside your domain, usually from an assumed breach. Rather than listing missing patches, a tester maps the permission and trust graph, chains weaknesses such as Kerberoasting, delegation abuse, and certificate misconfigurations into a validated path to domain dominance, and documents evidence and prioritized remediation.
How do attackers escalate from a standard user to Domain Admin?
They chain ordinary misconfigurations. A weak service-account password is cracked through Kerberoasting, coerced authentication is relayed to a certificate service, or an over-broad permission is abused, and reused or cached credentials reach a privileged account. In most first-time assessments such a path exists, which is why proving and closing it is the point of the test.
What are the stages of an Active Directory penetration test?
A professional test runs as a repeatable sequence: scoping and rules of engagement, enumeration, attack-path mapping, credential access, privilege escalation to domain compromise, and reporting with evidence, business-risk translation, and retest. It usually starts from an assumed breach and follows a methodology aligned to MITRE ATT&CK.
Which tools are used for Active Directory penetration testing?
Attack-path mapping tools such as BloodHound resolve the relationships that form escalation paths, supported by tooling for credential access and Kerberos, NTLM, and certificate techniques. Tools accelerate a skilled tester, but the proven path from a standard user to Domain Admin is built by a human chaining several weaknesses, not by a scanner.
Does the test cover hybrid Active Directory and Entra ID?
Yes. Most organizations run hybrid identity, and the connection between on-premises Active Directory and Entra ID is an escalation path in both directions. A complete assessment tests the sync accounts and trust between the two, so on-premises and cloud identity are assessed as one system rather than in isolation.
How much does Active Directory penetration testing cost?
Cost depends on scope: the number of domains and forests, whether hybrid identity is included, the size of the environment, and the starting position tested. Most enterprise Active Directory penetration tests in Canada and the US are scoped as a fixed-price engagement after a short scoping call, with pricing set before work begins.
Will the test affect our production domain?
Testing is deliberately non-destructive. Disruptive actions are excluded, credential and escalation checks are validated carefully rather than run at scale, and any intrusive step against production is agreed in advance and scheduled around change windows so availability is protected while the test still reflects real risk.
Does Active Directory penetration testing support SOC 2, PCI DSS, HIPAA, or PIPEDA compliance?
Yes. Human-led Active Directory penetration testing produces the exploitation evidence that SOC 2, PCI DSS, HIPAA, and PIPEDA reviewers expect, and maps to NIST CSF 2.0 and CIS Controls v8. Because domain compromise underpins most serious breaches, proving those paths are closed is exactly the assurance these frameworks look for. A vulnerability scan report alone does not satisfy them.
Active Directory is where an enterprise breach is usually won or lost. As an Active Directory penetration testing company serving enterprises in Canada and the United States, we prove, with evidence, whether an ordinary user can become a Domain Admin, and exactly which change stops it. Start with the playbook above, then talk to us about a scoped Active Directory penetration testing engagement.