What Are Active Directory Attacks? The Path from Standard User to Critical Privileges

An attacker gaining their first access to a corporate network is usually only the beginning of the operation.

That first access may have come through a low-privileged user account, a standard employee computer or a service with limited access.

From this point on, the attacker's fundamental question is:

“How can I turn this access into higher privileges?”

In Microsoft-based corporate environments the answer to that question is usually sought inside Active Directory (AD).

Active Directory is a critical identity infrastructure that centrally manages user accounts, computers, servers, groups, service accounts, security policies and access privileges.

While this central structure brings great convenience for businesses, it also makes an extremely valuable target for attackers.

Because a highly privileged access obtained in Active Directory can take the attacker from a single computer to a far wider corporate infrastructure.

For that reason Active Directory security, Active Directory penetration testing, AD pentest and Red Team operations are among the most critical topics in modern corporate cyber security.

But to understand Active Directory attacks you have to know one important truth:

The attacker does not always have to crack the Domain Admin password.

Most of the time the attack route runs through;

faulty permissions,

weak service account configurations,

credential exposure,

group memberships,

delegation relationships,

and the complex web of access links built up over the years.

Active Directory security is therefore not only about the security of individual users; the relationships between accounts and the attack paths matter just as much.

What Is Active Directory?

Microsoft Active Directory Domain Services is one of the core components of identity and access management in corporate Windows infrastructures.

Active Directory can centrally manage;

• user accounts,
• computer accounts,
• security groups,
• organizational unit structures,
• group policy objects,
• service accounts,
• domain controllers,
• access privileges,
• trust relationships.

All of it in one directory.

When an employee signs in to a work computer with their corporate username and password, for example, Active Directory is an important part of the authentication process.

The same user's Active Directory identity may also be used when accessing;

the file server,

the ERP system,

corporate applications,

shared directories.

The identity travels with them.

Active Directory is therefore not merely a user directory.

It can sit at the centre of the organisation's identity and access management structure.

Why Is Active Directory So Valuable to Attackers?

When an attacker first reaches a corporate network they usually do not hold administrative rights over critical systems.

They may have started with a standard user account.

But the Active Directory environment can help the attacker understand the trust relationships between users and systems.

The attacker may look for answers to questions such as:

Which domain am I in?

Which user accounts exist?

Which groups hold high privileges?

Which user is a local administrator on which computer?

Which service accounts are present?

Which servers are critical?

Which accounts can reach one another?

Is there an attack path that leads to Domain Admin?

The critical point here is this:

An Active Directory environment may contain thousands of users.

But the attacker does not need to compromise every account.

By following the right relationships they may be able to reach a highly privileged account in just a few steps.

What Is Domain Admin?

Domain Admins is one of the most privileged security groups in an Active Directory environment.

Users holding Domain Admin rights can have very broad administrative powers.

An attacker reaching Domain Admin level can therefore have serious consequences.

But in professional Active Directory security assessments it is wrong to focus on Domain Admin membership alone.

Because other permission relationships can grant the attacker similarly critical access.

For example;

the right to modify certain GPOs,

the right to manage critical users,

administrative access on a domain controller,

delegation rights,

the ability to change critical group memberships

can create high impact directly or indirectly.

In AD security the question “how many Domain Admins do we have?” is therefore not enough.

The real question is:

“From which users or systems do routes to critical privileges exist?”

What Is an Attack Path?

An attack path is the chain of relationships that can take an attacker from a low-privileged starting point to a more privileged account or a critical system.

In theory an attack route might look like this:

Standard User

↓

Local Administrator Rights

↓

Server Access

↓

Service Account

↓

Privileged Group

↓

Critical Administrative Rights

Each step in this chain may not look like a “critical vulnerability” on its own.

But assessed together, the links can form an extremely valuable route for an attacker.

And this is one of the most important problems in Active Directory security:

The risk may lie not in a single misconfiguration, but in misconfigurations being chained to one another.

What Is BloodHound and Why Is It Used?

One of the most frequently mentioned tools in Active Directory security assessments is BloodHound.

BloodHound is a tool that helps analyse users, groups, computers and permission relationships within Active Directory on a graph basis.

Its core purpose is to answer this question:

“Is there a privilege route from this user to a critical account?”

A user may have no direct Domain Admin rights, for instance.

But;

they may be a local admin on one computer,

another highly privileged user may have signed in on that computer,

and that account may hold higher privileges on another server.

This chain of relationships can be difficult to spot manually.

Analysis approaches like BloodHound make those links visible.

BloodHound should therefore not be thought of only as an attacker's tool.

Blue Teams and Active Directory security teams can also use this kind of analysis for attack path management.

Why Does Kerberos Matter in Active Directory Security?

One of the authentication protocols widely used in Active Directory environments is Kerberos.

Kerberos was designed to provide secure, centralised authentication.

But misconfigured accounts or weak password policies can give rise to certain Kerberos-based attack scenarios.

The Kerberos setup is therefore an important area of assessment in Red Team and AD pentest work.

Some of the best-known concepts are techniques such as;

Kerberoasting

AS-REP Roasting

Golden Ticket

Silver Ticket

Each of these rests on different conditions and security risks.

But from the defensive perspective the core message is the same:

Active Directory security is not just about user passwords.

How authentication protocols are configured is an important part of security too.

What Is Kerberoasting?

Kerberoasting is one of the common attack techniques targeting the security of service accounts in Active Directory environments.

In corporate systems some services may run under particular user accounts.

Those accounts can be used as service accounts.

The risk increases if those accounts;

use weak passwords,

have not had their passwords changed for a long time,

hold more privileges than they need.

Each of these makes the account more attractive.

In Kerberoasting attacks the attacker's aim is to obtain Kerberos data relating to service accounts and try to take advantage of weak password use.

It is therefore important for organisations to use security controls such as;

strong service account passwords,

managed service accounts,

group managed service accounts (gMSA),

the principle of least privilege.

Together these close the most common gap.

What Is AS-REP Roasting?

AS-REP roasting is one of the attack scenarios that can arise when certain user accounts are misconfigured within Kerberos authentication processes.

Accounts with the Kerberos pre-authentication mechanism disabled can pose a particular risk.

Configurations of this kind usually emerge over the years for compatibility or legacy application reasons.

But an exception configuration that is no longer in use, left sitting in the system, can create an opportunity for an attacker.

This reveals an important principle in Active Directory security:

Exceptions that were necessary in the past must be reviewed regularly.

Why Are Service Accounts Risky?

Service accounts are among the most critical identities in many Active Directory environments.

Because service accounts usually;

stay active for a long time,

rarely have their passwords changed,

are used across multiple systems,

may hold high access privileges.

Every one of those traits helps an attacker.

This makes them an important target.

A standard user account may have limited access, for instance.

But if a misconfigured, highly privileged service account exists in the same environment, the attacker can factor that account into the attack path.

Important parts of Active Directory hardening therefore include;

producing an inventory of service accounts,

limiting their privileges,

managing their passwords securely,

migrating them to managed accounts such as gMSA where possible.

Each step shrinks the exposure.

Why Do Local Administrator Rights Matter?

A user being a local administrator on a single computer may not look critical at domain level at first glance.

But that access can be important from the attacker's perspective.

Because a system on which local administrator rights are held may contain valuable information such as;

credentials,

session information,

service configurations,

other user activity.

All of it accessible to whoever holds admin rights.

The risk increases further if highly privileged users sign in to the same system.

It is therefore important for organisations to reduce widespread local administrator rights.

Least privilege is one of the core principles of Active Directory security.

A user should hold only the privileges their job requires.

What Is Credential Access?

Credential access is the MITRE ATT&CK tactic in which the attacker tries to obtain usernames, passwords, tokens or other authentication material.

Credential access is one of the critical stages in Active Directory attacks.

Because every new credential obtained can widen the attacker's reach.

The attacker's fundamental goal is usually not to obtain a single password.

The goal is to be able to reach a different system with a new identity.

This process can turn the attack chain into:

First User

↓

New Credential

↓

New System

↓

More Privileged Credential

↓

Critical System

Credential security therefore sits at the centre of modern Red Team and Active Directory security work.

What Is Pass-the-Hash?

One of the known attack techniques in Windows environments is the pass-the-hash method.

In this approach the aim is not always to learn the user's plaintext password.

Under certain conditions the password hash used in authentication may be abused instead.

From the defensive side this risk makes security controls such as;

where highly privileged accounts sign in,

how local administrator accounts are managed,

credential isolation,

Microsoft Defender Credential Guard,

privileged access workstations

especially important.

The core principle here is this:

A highly privileged account should be used on as few systems as possible.

What Is Pass-the-Ticket?

Another attack approach seen in Kerberos-based environments is known as pass-the-ticket.

In this method Kerberos tickets may be used in an unauthorised way.

Active Directory security therefore does not consist of password protection alone.

The security of authentication sessions and the ticket lifecycle matters too.

Assessing attack behaviour of this kind in Red Team work can be valuable for measuring the organisation's endpoint and identity detection capability.

What Is Privilege Escalation?

Privilege escalation is the attacker's attempt to reach a higher privilege level than their current access provides.

In an Active Directory environment the attacker may have started with a standard user account.

But the objective may be to reach stronger access levels such as;

local administrator,

server administrator,

privileged service account,

Domain Admin.

Each step upward widens the impact.

Privilege escalation does not always happen through a software vulnerability.

Misconfigured access rights can produce the same outcome.

For example;

excessive group membership,

an incorrect ACL configuration,

faulty delegation,

a highly privileged service account,

a weak password policy

can each be part of an attack route.

What Is an Active Directory ACL?

Active Directory objects can carry various access control list (ACL) permissions.

These permissions determine which operations users or groups can perform on particular Active Directory objects.

Misconfigured ACLs can be extremely valuable to an attacker.

A low-privileged user may, without anyone realising, hold excessive control over a critical user account or group.

Situations like this can arise over the years through;

temporary project permissions,

personnel changes,

legacy applications,

faulty delegations.

Nobody intended the result.

In Active Directory security assessments, therefore, not only group memberships but also ACL relationships must be analysed.

Active Directory Delegation Risks

Active Directory and Kerberos environments can contain various delegation mechanisms.

Delegation is an important feature allowing applications or services to perform certain operations on behalf of a user.

But misconfigured, it can create attack routes.

In Red Team and AD pentest work, therefore;

legacy delegation structures,

service accounts,

permission relationships

must be assessed carefully.

Old delegation configurations belonging to services unused for years are especially easy to overlook from a security perspective.

Why Are Group Policy Objects Critical?

A group policy object (GPO) is a powerful mechanism for centrally configuring users and computers in Active Directory environments.

Through GPOs;

security policies,

Windows settings,

scripts,

application configurations

can be applied to a large number of systems.

Being able to make unauthorised changes to a critical GPO can therefore constitute a significant security risk.

A user not being a Domain Admin does not mean they are unimportant.

If that same user holds the right to modify a critical GPO, their impact can be very high.

This example shows why looking at group names alone is not enough in Active Directory security.

Why Must Domain Controllers Be Protected?

A domain controller (DC) is one of the most critical systems in Active Directory infrastructure.

It plays a central role in authentication and directory services.

Domain controller security therefore carries special importance.

Domain controllers should be separated as far as possible from;

general user activity,

unnecessary applications,

internet access,

routine administrative operations.

The fewer functions they carry, the smaller the exposure.

How highly privileged accounts are used must also be tightly controlled.

The compromise of a domain controller can have very serious consequences for an organisation's Active Directory security.

The Tiering Model and Privileged Access

One of the important approaches used in Active Directory security is administrative tiering, or modern privileged access models.

The core idea is this:

The most critical administrative accounts should not be used on everyday user computers.

A Domain Admin account should not be used for;

reading email,

browsing the internet,

managing ordinary workstations.

Those are jobs for a normal account.

The wider the usage area of highly privileged accounts, the larger the attack surface through which an attacker can reach them.

Organisations may therefore consider approaches such as;

separate admin accounts,

privileged access workstations (PAW),

PAM,

just-in-time access,

just enough administration.

Each reduces standing privilege.

Active Directory and Lateral Movement

One of the critical effects of Active Directory attacks is the capability for lateral movement.

After reaching one computer the attacker may try to progress to other systems on the same network.

Routes may be explored, for example;

from workstation to server,

from one server to another,

from a user account to a service account.

Each hop extends the reach.

The identity and access relationships within Active Directory can make this movement easier or harder.

Network segmentation and identity segmentation must therefore be considered together.

Firewall segmentation alone may not be enough.

Access relationships between identities must be limited too.

What Is an Active Directory Pentest?

An Active Directory pentest is a penetration testing engagement that assesses the vulnerabilities, misconfigurations and attack paths in a corporate AD environment.

Such an engagement may analyse;

user and group privileges,

service accounts,

Kerberos configurations,

NTLM usage,

ACL relationships,

delegation configurations,

GPO security,

local administrator relationships,

password policy,

privileged accounts,

attack paths.

All of it as one connected picture.

But a professional AD pentest should not consist merely of automated tool output.

The real value lies in analysing whether the relationships found can be turned into genuine attack impact.

The Difference Between an Active Directory Pentest and a Red Team

AD pentesting and Red Teaming are related but not the same exercise.

The main goal of an Active Directory pentest is to identify the security risks in the AD environment systematically.

A Red Team may use Active Directory as part of a broader attack scenario.

The Red Team objective might be, for example;

“Reach the critical system starting from the internet.”

That is the mission.

In that case the attack chain may progress like this:

Initial Access

↓

Standard User

↓

Active Directory Discovery

↓

Credential Access

↓

Privilege Escalation

↓

Lateral Movement

↓

Critical Asset

Here Active Directory is not the target, but one of the main routes that carries the attacker to the target.

How Can a SOC Detect Active Directory Attacks?

Detecting Active Directory attacks does not consist merely of monitoring domain controller logs.

Different telemetry sources must be assessed together.

For example;

Windows event logs,

domain controller security logs,

EDR/XDR data,

identity provider logs,

PAM records,

network telemetry,

SIEM correlations

can be analysed side by side.

What matters for the SOC is not seeing a single event, but being able to understand the relationship between events.

For example;

unusual behaviour on a standard user account,

followed by authentication to different systems,

then attempted access to highly privileged resources

becomes far more meaningful when assessed together.

This approach has also made the concept of identity threat detection and response (ITDR) important.

What Is ITDR?

Identity threat detection and response (ITDR) is a security approach aimed at detecting and responding to attacks against identity systems.

In modern attacks, attackers do not progress only through endpoints or the network.

They abuse identities.

Areas such as;

Active Directory,

Microsoft Entra ID,

privileged accounts,

service accounts,

authentication behaviour

must therefore be monitored continuously.

ITDR helps close the gap between classic endpoint security and identity security.

How Should Active Directory Hardening Be Done?

Active Directory security is not a one-off project.

It is a security process that must be improved continuously.

It is particularly important for organisations to;

reduce unnecessary Domain Admin accounts,

separate highly privileged users,

manage service accounts securely,

evaluate the use of gMSA,

reduce legacy protocols,

control NTLM usage,

use LAPS,

review ACL and delegation relationships,

audit GPO permissions,

limit local administrator access,

improve MFA and PAM integrations,

monitor AD logs centrally.

All of these belong in the programme.

But one of the most critical steps is carrying out regular attack path analysis.

Because the environment changes over time.

New users are added.

New servers are created.

Projects begin.

Privileges are granted.

Service accounts are opened.

Temporary access is forgotten.

These changes can create new attack routes.

Why Must Active Directory Security Be Tested Continuously?

An Active Directory environment may be secure today.

But within a few months the security posture can change because of;

new applications,

new users,

organisational changes,

new service accounts,

new permissions.

None of it individually alarming.

An assessment carried out only once a year may therefore not always be enough.

Organisations can combine different methods such as;

Active Directory pentesting,

attack path management,

identity security assessment,

purple team exercises,

ITDR monitoring.

Used together they cover far more ground.

The aim is not merely to find vulnerabilities, but to detect the formation of new attack routes at an early stage.

What Should an Active Directory Report Contain?

A professional Active Directory security assessment should not end with a list of technical vulnerabilities alone.

The report may contain sections such as;

Executive Risk Summary

A management-level summary of critical AD risks.

Attack Path Analysis

The routes from low-privileged users to critical privileges.

Privileged Account Analysis

The state of highly privileged accounts.

Service Account Risks

Security problems in service accounts.

Kerberos Security

Kerberos-based risks and misconfigurations.

ACL & Delegation Review

Permission and delegation problems.

Detection Coverage

Whether the SOC and EDR systems could see the attacks.

Remediation Roadmap

A prioritised improvement plan.

Together they make up a complete picture.

This structure helps turn Active Directory risks from technical findings into business risks.

Conclusion: The Most Dangerous Thing in Active Directory Is Not a Single Vulnerability, but the Route Between Them

An Active Directory environment can contain thousands of users, computers and permission relationships.

Most of them may not look critical in isolation.

But the attacker does not look at individual systems; they look at relationships.

One user may be an admin on another computer.

A highly privileged user may sign in on that computer.

A service account may have a weak password.

That account may be able to reach a critical group.

An ACL may be misconfigured.

And a handful of small mistakes can combine into a critical attack route.

The most important question in Active Directory security is therefore not:

“Are our Domain Admin accounts secure?”

The better question is:

“Is there any attack path that could take a standard user to critical privileges?”

Red Teaming and Active Directory pentesting exist precisely to uncover those routes before the attacker does.

But reaching high privileges is not the end of the attack.

For a threat actor to reach a critical target they usually have to move between different systems inside the corporate network.

That stage is one of the most critical parts of the cyber attack chain:

Lateral movement.