Active Directory and Domain Controller Audit

Flow chart of the Active Directory and Domain Controller Audit engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Baseline Selection. We agree the forests and domains in scope and select the CIS Microsoft Windows Server and Active Directory hardening baselines to measure against. Activities: Map the forest, domains and trusts in scope; Count domain controllers and their OS versions; Select the CIS Windows Server and AD hardening baselines; Provision a read-only domain account for collection. Hands over AD Scope and Baseline Agreement. Phase 2, Evidence and Config Collection. Using read-only domain access we collect AD objects, group policy, trust and delegation data with ADRecon and PingCastle exports. Activities: Run ADRecon to export users, groups, computers and OUs; Run PingCastle for a scored health and risk snapshot; Export every group policy object and its linked scope; Collect trust, delegation and password policy settings. Hands over Directory Evidence Export. Phase 3, Attack-Path Analysis. We map privilege escalation routes with BloodHound and PowerView, identifying the shortest paths from ordinary users to domain admin. Activities: Map privileged group membership with BloodHound; Trace shortest paths from standard users to domain admin; Query ACL abuse routes such as GenericAll and WriteDACL; Identify Kerberoastable and AS-REP roastable accounts; Check certificate services templates for escalation paths. Hands over Attack-Path Map to Domain Admin. Phase 4, Manual Review of Risky Settings. We review domain controller hardening, Kerberos delegation, privileged group sprawl, stale accounts and legacy protocols that automated scoring can understate. Activities: Review unconstrained and constrained delegation on accounts; Check SMB signing, LDAP signing and NTLM usage on controllers; List stale accounts, dormant admins and never-expiring passwords; Assess tiering, LAPS coverage and admin workstation practice. Hands over AD Hardening Scorecard. Phase 5, Prioritised Findings. Findings are ranked by how directly they lead to compromise, with the affected objects listed so remediation is targeted. Activities: Rank findings by how directly they reach domain admin; List the affected accounts, groups and objects per finding; Separate quick wins from structural tiering work; Brief the identity team on the top escalation paths. Hands over Active Directory Findings Report. Phase 6, Remediation and Re-Check. We provide a fix order that closes the highest-value paths first, then re-run PingCastle and BloodHound to confirm the paths are gone. Activities: Set a fix order that breaks the shortest paths first; Give step-by-step guidance for each delegation and ACL change; Advise on rollout risk for protocol hardening changes; Re-run PingCastle and BloodHound to confirm paths are closed. Hands over Prioritised Remediation Runbook and Re-Check Report. Each phase begins from the artefact the phase before it produced.