{"id":46225,"date":"2026-07-06T17:24:29","date_gmt":"2026-07-06T15:24:29","guid":{"rendered":"https:\/\/www.pentestfactory.de\/securing-active-directory-attack-vectors-hardening-penetration-testing-2026\/"},"modified":"2026-07-08T16:35:13","modified_gmt":"2026-07-08T14:35:13","slug":"securing-active-directory-attack-vectors-hardening-penetration-testing-2026","status":"publish","type":"post","link":"https:\/\/www.pentestfactory.de\/en\/securing-active-directory-attack-vectors-hardening-penetration-testing-2026\/","title":{"rendered":"Securing Active Directory: Attack Vectors, Hardening & Penetration Testing 2026"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A single user account. No admin privileges, no special rights\u2014obtained through a phishing email sent to the accounting department. In many of our internal penetration tests, this is the starting point\u2014and in an alarmingly high percentage of environments, it\u2019s enough to become a domain administrator within a few hours. Not through a spectacular zero-day vulnerability, but through configurations that have remained unchanged in the directory for years. <\/p>

Active Directory (AD) is the world’s leading directory service for managing Windows networks. Adoption figures vary depending on the source: Frost & Sullivan<\/em> estimates that approximately 90 percent of Global Fortune 1000 companies use AD as their primary means of authentication and authorization; older figures from Microsoft put the number even higher, at 93 to 95 percent. The exact current number of installations is difficult to determine\u2014however, industry observers assume that the percentage has not decreased significantly since then. AD is also the de facto standard in the DACH region: Some industry sources estimate that around 80 percent of German companies with more than 50 employees rely on Windows Server systems, and that a large proportion of SMEs use AD or its cloud counterpart, Microsoft Entra ID\u2014however, no reliable primary statistics specifically for Germany are available on this topic. <\/p>

In practice, this widespread use means that AD manages identities, authenticates users and services, and determines who is allowed to access which resources. It is precisely this central role that makes it the most valuable target. Whoever controls the domain controls practically everything. <\/p>

This article shows, from an attacker\u2019s perspective, what a typical path from a standard user to a domain admin<\/em> looks like, which techniques will actually work in 2025 and 2026\u2014including the very latest ones like BadSuccessor<\/strong> \u2014and what hardening measures you can use to close these paths. Finally, we\u2019ll assess what a professional Active Directory penetration test<\/strong> can achieve and where its limitations lie. <\/p>

Why Active Directory Is the Main Target<\/h2>

In September 2024, the Five Eyes<\/em> agencies\u2014including the U.S. CISA, the NSA, and the U.K.\u2019s NCSC\u2014published a joint guideline titled \u201cDetecting and Mitigating Active Directory Compromises,\u201d<\/a> which describes 17 of the most commonly observed attack techniques targeting AD. Their key message: Active Directory is the most widely used authentication solution in corporate networks worldwide\u2014and is routinely targeted by attackers to escalate privileges and take over the most valuable accounts. <\/p>

The Sophos Active Adversary Report 2026<\/a>, which analyzes 661 incident response and MDR cases from 70 countries, highlights just how central Active Directory is to real-world attacks. In about two-thirds of the incidents examined (67 percent), the cause was related to identity\u2014compromised credentials, brute-force attacks, and phishing. And attackers are moving faster: The median time from initial access to reaching Active Directory was most recently just 3.4 hours<\/strong> \u2014about 70 percent shorter than a year earlier. The trend is clear: Attackers who want to move laterally and ultimately encrypt data almost always use Active Directory as their pathway. <\/p>

There are two fundamentally different reasons for this. The first is historical baggage: AD has grown over two decades in many organizations and carries a corresponding amount of baggage\u2014generous default settings, legacy protocols that are still supported for compatibility reasons, and permission chains that have developed over the years that no one can fully understand anymore. These weaknesses are the result of configuration and historical circumstances and can, in principle, be resolved. <\/p>

The second reason is inherent in the design, which is precisely why it is so sensitive: AD concentrates the most valuable secrets in one place. Through multimaster replication, every writable domain controller maintains a complete replica of the central database ntds.dit<\/code> \u2014including the password hashes for all accounts. Anyone who compromises a single one of these domain controllers potentially gains access to the login credentials for the entire domain. The BSI addresses this specific security requirement in its IT-Grundschutz module APP.2.2 Active Directory Domain Services<\/a>, which consistently classifies domain controllers and the AD infrastructure as requiring a high level of protection. <\/p>

An Overview of the Typical Attack Path<\/h2>

An internal attack on AD almost always follows the same pattern. The individual stages are interlinked, and at several points, a single misconfiguration is enough to bypass a stage: <\/p>

  1. Reconnaissance<\/strong> \u2013 The directory is scanned: users, groups, service accounts, permissions, and trusts.<\/li>
  2. Credential Access<\/strong> \u2013 Initial credentials or password hashes are compromised, for example, through kerberoasting or password spraying.<\/li>
  3. Privilege Escalation<\/strong> \u2013 An unprivileged account is elevated to a privileged one, often due to misconfigurations in certificate services or permissions.<\/li>
  4. Lateral Movement<\/strong> \u2013 The attacker moves sideways across the net, from one side to the other.<\/li>
  5. Domain Dominance<\/strong> \u2013 Complete control over the domain, usually achieved by extracting all password hashes.<\/li>
  6. Persistence<\/strong> \u2013 Long-term, stealthy access that is not eliminated even by a password change.<\/li><\/ol>

    The following sections walk through the most important techniques along this path\u2014each with an explanation of how it works<\/em>, its prerequisites<\/em>, its effects<\/em>, and countermeasures<\/em>.<\/p>

    \"\"<\/p>

    Reconnaissance: Reading the Directory Like an Attacker<\/h2>

    Before an attacker takes action, they assess the situation. Tools like BloodHound<\/strong>, using the SharpHound<\/em> collector, query LDAP information and represent Active Directory as a graph: users, groups, computers, and permissions become nodes, and the relationships between them become edges. From this graph, privilege escalation appears to be a simple pathfinding problem\u2014the shortest path from a compromised account to the Domain Admins<\/em> becomes visible, even if it involves over a dozen intermediate steps and nested group memberships. <\/p>

    Prerequisite:<\/em> In the default configuration, any valid domain account is sufficient to read large portions of the directory. Impact:<\/em> The attacker often knows the attack surface better than the internal IT team. Countermeasure:<\/em> Restrict anonymous and unnecessary read access, regularly audit permissions\u2014and use the same tools defensively. BloodHound, PingCastle<\/strong>, and Purple Knight<\/strong> are excellent tools for identifying risky paths before an attacker does. <\/p>

    However, it\u2019s nearly impossible to prevent simple read access\u2014every authenticated account is allowed to read large portions of the directory. The focus therefore shifts to detection<\/em>, and this is precisely where XDR (Extended Detection and Response) solutions come in. They correlate telemetry from endpoints, identities, and the network, and detect enumeration based on behavior rather than individual signatures. Tools like SharpHound leave a characteristic footprint: high-volume, widely distributed LDAP queries, massive SAMR enumeration, and unusual access patterns to the domain controllers. An identity-focused XDR component\u2014such as Microsoft Defender for Identity<\/em> as part of Defender XDR\u2014reports such activities via detections like Security Principal Reconnaissance (LDAP)<\/em> or User and Group Membership Reconnaissance (SAMR)<\/em>. <\/p>

    This can be effectively supplemented by deception: deliberately placed decoy or honeypot accounts\u2014such as dummy accounts with \u201cAdmin\u201d in their names\u2014trigger an alert as soon as they are queried, because regular operations never access them. However, detection is not a panacea. Attackers find ways around it, for example by shifting data collection from LDAP to Active Directory Web Services (ADWS) to blend in with normal web traffic. Therefore, only a combination of restricted read access, behavior-based monitoring, and deception can provide robust protection. <\/p>

    Credential Access: Kerberoasting and AS-REP Roasting<\/h2>

    Kerberoasting<\/strong> is one of the most reliable techniques out there because it exploits a legitimate Kerberos mechanism. Any account with a Service Principal Name<\/em> (SPN)\u2014typically service accounts for databases, web servers, or applications\u2014can be requested by any authenticated user. The domain controller issues a service ticket encrypted with the service account\u2019s password hash. The attacker takes this ticket and cracks it offline<\/em>, leaving no further traces on the network. If the service account has a weak password\u2014and this is usually the case with service accounts that have been in use for years\u2014it can be compromised in minutes. <\/p>

    AS-REP Roasting<\/strong> works in a similar way, but targets accounts where Kerberos pre-authentication<\/em> is disabled. For such accounts, an encrypted server response can be requested and also cracked offline\u2014in this case, not even a password is required. <\/p>

    Password Spraying: One Password, Many Accounts<\/h2>

    Instead of attacking an account with many passwords and triggering account locks, password spraying<\/strong> tries a few likely passwords against many accounts\u2014such as the current quarter plus the year. The Five Eyes guidelines<\/em> recommend, among other things, locking an account after a maximum of five failed login attempts, as well as actively scanning the web at least once a month for login credentials stored in plain text. Effective protection also includes multi-factor authentication and the use of blacklists for obviously weak passwords. <\/p>

    Privilege Escalation via Certificate Services (ADCS \/ ESC)<\/h2>

    Active Directory Certificate Services<\/em> (ADCS) are used in many companies\u2014and are often misconfigured. In 2021, SpecterOps described the first eight escalation classes (ESC1 through ESC8) in its research paper \u201cCertified Pre-Owned\u201d<\/a>; the Certipy<\/em> tool automates their detection and exploitation and now covers the entire known range from ESC1 to ESC17. The classes beyond ESC8 were identified by other researchers and were added by 2025. <\/p>

    Two classic examples illustrate the problem:<\/p>

    Impact:<\/em> At first, both techniques only yield a crackable hash, not a complete password. Only successful offline cracking can turn it into a plaintext password, and that works only with weak passwords. If a service account cracked in this way is also part of a privileged group, the attacker can gain direct access to the target. A sufficiently long, random password, on the other hand, renders the attack ineffective. Countermeasure:<\/em> The most effective defense is strong, random passwords\u2014ideally (group\/delegated) Managed Service Accounts<\/em> with automatic key management. This includes avoiding privileged service accounts and maintaining good SPN hygiene, i.e., removing unnecessary SPNs. Enforcing AES instead of RC4 significantly reduces the likelihood of a successful attack but does not eliminate Kerberoasting: The service ticket remains protected by the account\u2019s long-term key and can still be attacked offline. Enabling pre-authentication also helps protect against AS-REP Roasting. When it comes to monitoring, Event 4769 is not a reliable alarm indicator, as service ticket requests are part of normal operation and RC4 is not inherently malicious in legacy environments. The signal only becomes meaningful in context\u2014for example, when a single account requests tickets for many different SPNs within a short period of time. A targeted password audit<\/a> reveals precisely those weak service accounts that make Kerberoasting worthwhile. <\/p>