Active Directory compromise

Active Directory is usually the authentication and authorisation plane for the estate. Own it and you own mail, files, and most apps that trust the domain. Own it and you often own the cloud path through Entra ID as well. The agencies' joint paper lists seventeen common techniques. This page is the digest: why AD falls, what to harden first, and which ticket and certificate paths to kill.

First principles

Every authenticated user can usually enumerate the directory. That makes the attack surface large by design. Hidden relationships between users, groups, and computers are what get exploited — often after the attacker understands your domain better than you do. BloodHound, PingCastle, and Purple Knight exist so you can see those paths before they do.

Privileged access is the immediate prize. Domain Admins, Enterprise Admins, KRBTGT, AD FS, AD CS, backup admins, and Entra Connect accounts are Tier 0. Tier 0 credentials never land on lower-tier systems. Tier 0 computers are only managed by Tier 0 users. Microsoft's Enterprise Access Model (hybrid, with Entra Connect) is the current shape of that rule. Implement it and many of the seventeen techniques become hard or impossible.

Ticket abuse that every domain can run

Kerberoasting: any user can request a TGS for an account with an SPN. The ticket is encrypted with that account's password hash. Crack it and you are that account. Prefer group Managed Service Accounts. Else set long unique passwords, strip Domain Admins membership from SPN accounts, enforce AES, and watch 4769 storms (RC4 0x17, Ticket Options 0x40800000 / 0x40810000).

AS-REP roasting: users with Kerberos pre-authentication disabled hand out crackable AS-REP tickets to anyone who asks. Require pre-auth on every account. Legacy exceptions get minimum privilege and a long password. Watch 4768 bursts and 4625 when the spray is unauthenticated.

Password spraying: one or a few passwords across many accounts, under the lockout threshold. NTLM to a DC bypasses MFA. Prefer long unique passwords, lockout after five fails (except break-glass), disable NTLM where you can, and never leave cleartext secrets on shares. The built-in Administrator account does not honour lockout — treat it as break-glass only and watch it.

Delegation, GPP, and certificates

Unconstrained delegation parks TGTs in LSASS on the delegated host. Prefer resource-based constrained delegation. Mark privileged accounts sensitive / Protected Users. Disable Print Spooler on DCs so they cannot be coerced into authenticating to a delegated host.

GPP cpasswords in SYSVOL are still found years after MS14-025. The AES key is public. Delete every cpassword. Use LAPS for local admin passwords. A canary GPP password on a never-login account is a tripwire.

AD CS ESC1 and friends: enrolment + client-auth EKU + enrollee-supplied SAN + no manager approval lets any user mint a cert as any other user. Remove enrollee-supplied SAN on client-auth templates, lock write on templates, drop EDITF_ATTRIBUTESUBJECTALTNAME2, require manager approval where SAN is needed, and treat CAs as Tier 0. A stolen CA private key is a Golden Certificate — HSM the CA key, MFA the admins, application-control the CA hosts.

Domain-wide theft

DCSync needs directory replication rights. Minimise who has Replicating Directory Changes / All / Filtered Set. Prefer RPC Event 5712 detection on Server 2019+ with the Oct 2025 cumulative (DRS GUID, OpNum 3) over noisy 4662. A successful DCSync or ntds.dit dump is a full-domain event: reset passwords, reset KRBTGT twice, and plan for rebuild if DPAPI backup keys left.

Golden Ticket forges TGTs with the KRBTGT hash. Silver Ticket forges service tickets with a computer or service hash and never talks to a DC. Mitigate by stopping the dump paths, rotating KRBTGT on a schedule and after suspected compromise (twice, with replication between), and watching 4769 without a matching 4768.

What an admin actually does

• Map Tier 0. Shrink Domain Admins. Privileged Access Workstations. Phishing-resistant MFA on Tier 0.
• Inventory SPNs and pre-auth-disabled accounts. Convert to gMSA where you can. Kill unconstrained delegation.
• Scrub SYSVOL for cpasswords. Harden AD CS templates. Put CAs and DCs behind jump hosts only.
• Centralise 4768 / 4769 / 4625 / 4741 / CA and DC sync events. Baseline who may replicate. Add canaries for Kerberoast / AS-REP / GPP / DCSync.
• Read the full agency paper for the seventeen techniques, event tables, and canary recipes. This page is the spine, not the reprint.