Active Directory Security: Common Attacks and How to Harden AD

Active Directory (AD) controls identities, access and policy for most Windows networks. That makes it the attacker's favourite target: whoever controls AD controls the organisation. In internal penetration tests, going from a single low-privilege account to domain administrator is often possible in hours, not because AD is broken, but because it is configured the way it was twenty years ago.

The most common AD attacks

• Password spraying: trying a few common passwords against every account, avoiding lockouts.
• Kerberoasting: any domain user can request service tickets for accounts with a service principal name (SPN). Tickets for service accounts with weak passwords can be cracked offline.
• AS-REP roasting: accounts with Kerberos pre-authentication disabled leak crackable material without any credentials.
• Pass-the-hash and pass-the-ticket: reusing stolen NTLM hashes or Kerberos tickets to authenticate without knowing the password.
• Credential dumping: extracting credentials from memory on machines where administrators have logged in.
• DCSync: abusing replication permissions to pull password hashes for any account, including krbtgt, directly from a domain controller.
• Golden and silver tickets: forging Kerberos tickets once the relevant account hashes are stolen, giving long-lived, hard-to-detect access.
• Misconfigured permissions and certificate services: excessive ACLs and vulnerable certificate templates that create hidden paths to domain admin.

Attackers map these paths with tools like BloodHound, which graphs relationships between users, groups, computers and permissions. Defenders should run the same analysis first.

How to harden Active Directory

1. Adopt a tiered administration model. Separate accounts for domain administration (Tier 0), servers (Tier 1) and workstations (Tier 2). Domain admins never log in to ordinary workstations.
2. Shrink privileged groups. Audit Domain Admins, Enterprise Admins and other privileged groups; most organisations have far too many members.
3. Deploy Windows LAPS so every machine has a unique, rotated local administrator password, killing lateral movement with a shared local admin password.
4. Protect service accounts. Use group managed service accounts (gMSA) or long random passwords, and remove unnecessary SPNs.
5. Enforce strong passwords and MFA for remote and privileged access, and ban known-breached passwords.
6. Use the Protected Users group for privileged accounts and restrict NTLM where possible.
7. Review replication rights so only domain controllers can perform DCSync.
8. Harden Active Directory Certificate Services and audit certificate templates.
9. Reset the krbtgt password periodically (twice, with replication time between resets) and after any suspected compromise.
10. Use privileged access workstations for Tier 0 administration.

What to monitor

Send domain controller security logs to your SIEM and alert on:

• Changes to privileged group membership.
• Unusual volumes of Kerberos service ticket requests, especially with weak encryption types (possible Kerberoasting).
• Replication requests from machines that are not domain controllers (possible DCSync).
• Logons by privileged accounts on workstations.
• New or modified Group Policy Objects.

Map each detection to MITRE ATT&CK techniques so you can see your coverage.

Do not forget hybrid identity

Most organisations now synchronise AD with a cloud identity provider such as Microsoft Entra ID. The synchronisation server is effectively Tier 0: compromise it and you may compromise both on-premises and cloud identities. Protect it like a domain controller.

Want to know how far an attacker could get in your domain? Book an Active Directory security assessment.

References and further reading

1. Microsoft: Windows LAPS overview
2. Microsoft: Enterprise access model (privileged access)
3. MITRE ATT&CK T1558.003: Kerberoasting
4. MITRE ATT&CK T1003.006: DCSync
5. SpecterOps BloodHound