Active Directory has been the backbone of enterprise identity for 25 years. It's also been the attack path of choice for ransomware operators, nation-state actors, and pen testers for roughly the same period.
AD was designed for manageability and trust. Modern attackers exploit exactly that — the implicit trust, the broad delegation, the legacy protocols that nobody turned off, and the default configurations that were never reviewed.
The good news: most Active Directory attacks don't require zero-days. They exploit misconfigurations. Fix the misconfigurations, and you eliminate the majority of the risk.
How Attackers Move Through Active Directory
Kerberoasting. Any domain account can request a Kerberos service ticket for any SPN. If the associated service account has a weak password, that ticket can be cracked offline — no interaction with the account holder required.
Pass-the-Hash / Pass-the-Ticket. Once on a workstation, attackers extract NTLM hashes or Kerberos tickets from memory using tools like Mimikatz. These credentials authenticate as that user elsewhere in the domain — no password required.
DCSync. An attacker with replication rights can simulate a domain controller and request password hashes for any user — including domain administrators. Quiet, devastating.
BloodHound. Open-source tools map AD permissions to find the shortest path from a low-privilege account to domain admin. Attackers run this. Most security teams don't.
Most Common Misconfigurations
Excessive privileged group membership — Domain Admins contains accounts with no business being there
Service accounts with weak passwords and excessive rights — domain admin permissions from 2019 that nobody reviewed
NTLM still enabled broadly — vulnerable to pass-the-hash; legacy compatibility that no longer applies
SMB signing not enforced — enables relay attacks; a one-line GPO change most environments haven't made
Print Spooler running on domain controllers — exploited by PrintNightmare; should not be running
Unconstrained delegation — allows impersonation of any user who authenticates to affected computers
Hardening Priorities
Tier 1 — This week: Audit Domain Admins and remove any account that doesn't need to be there. Identify service accounts with domain admin rights and scope them down. Disable Print Spooler on domain controllers. Enable SMB signing via Group Policy.
Tier 2 — This month: Run BloodHound to map your actual attack paths. Identify all Kerberoastable accounts and force complex passwords or move to Managed Service Accounts. Implement a tiered administration model.
Tier 3 — Ongoing: Implement Entra Password Protection. Enable audit logging for privileged group changes and DCSync attempts. Feed AD events to SIEM with detection rules.
The Tiered Administration Model
The most impactful structural change: separate credentials for Tier 0 (domain controllers), Tier 1 (servers), and Tier 2 (workstations). Credentials from a lower tier can never be used in a higher tier. A compromised helpdesk account cannot reach a domain controller. This single decision eliminates the majority of lateral movement paths.