Active Directory and Domain Controller Audit

We examine the routes that lead from an ordinary domain account to domain admin, and we rank them by how short and how reliable they are. In practice that means four recurring families. Privileged group sprawl, where membership of built-in administrative groups has grown through years of exceptions and was never trimmed back. Delegation, both unconstrained and constrained, left configured on accounts and computers that no longer need it. Kerberos weaknesses, including service accounts whose tickets can be requested and cracked offline, and accounts that do not require pre-authentication. Stale objects: dormant admins, never-expiring passwords and computer accounts for machines that were decommissioned. We also review certificate template permissions, because those can turn a standard user into a domain administrator in a single step. Findings are then ranked by how directly they reach domain admin, with the affected accounts, groups and objects listed, so your remediation is targeted rather than general.

Yes. We read directory objects, group policy, trust and delegation data, and we write nothing back; nothing in this audit changes your directory. The account you provision for us needs no administrative rights, only the ability to read the objects we enumerate, and we ask you to create it for the engagement so you can disable it the day we finish. The honest risk is load, not change. Enumerating a large forest generates a lot of queries against domain controllers, and session-collection passes touch many machines in a short window, so we agree the timing of the heavier queries with you and run them when your operations team says it suits. If your monitoring alerts on directory enumeration, tell us during scoping. A defensive team noticing our collection and escalating it is a good outcome, and it is better discovered deliberately than during a real intrusion.

Findings split into two piles, and only one of them is quick. The quick pile is object-level: removing accounts from privileged groups, clearing delegation flags nobody needs any more, retiring dormant admin accounts, tightening a certificate template, correcting password policy settings. Your identity team can work through that from the remediation runbook, which gives step-by-step guidance for each delegation and ACL change and an order that breaks the shortest paths first. The slow pile is structural. Administrative tiering separates the accounts that administer domain controllers from those that administer servers and workstations, so it changes how your administrators log in every day and reaches into joiner-mover-leaver process, privileged access workstations and local administrator password management. That is a project, not a change ticket. We separate the two piles explicitly, so you can close the shortest paths in weeks while planning the tiering work properly, then we re-check once your fixes land.

This audit is scoped to on-premises Active Directory and the domain controllers behind it. Entra ID and hybrid identity can be added, but as a separate scope agreed during scoping, not as an assumed extra. We say so plainly because the two estates fail differently. On premises, the question is who can reach domain admin through group membership, delegation and access control lists. In Entra ID it is directory role assignment, application consent, service principal credentials and conditional access gaps, and none of those appear in an on-premises collection. The bridge between them is the synchronisation infrastructure, which is where a hybrid estate gets interesting, because the synchronisation service account holds standing privilege on both sides. So raise hybrid identity on the scoping call. We will tell you whether the on-premises audit alone answers the question you are asking, or whether the cloud side belongs in the same engagement.

This audit reads your directory configuration exhaustively; an internal network penetration test attacks it selectively. The difference is coverage against proof. Here we enumerate privileged groups, delegation settings, trusts and stale objects across the forests in scope, measure domain controller hardening against the published Windows Server and Active Directory baselines named on this page, and hand you the map of escalation routes, including ones no attacker would bother with because a shorter path exists. Our Network Infrastructure penetration test does the opposite: it starts from a foothold and demonstrates the path an attacker takes, with proof of concept for every finding, which is more persuasive and less complete as an inventory. If your goal is to fix Active Directory, start with this audit, because it tells you what to change. If your goal is to prove the risk to people who have not funded the fix, the penetration test makes that case.