The primary vector: Active Directory in corporate cyberattacks
Active Directory (AD) manages the identities, permissions, and computers in 90% of global enterprise environments. Because of its scale and complexity, AD configurations naturally drift over time. This configuration drift creates hidden relationships, over-privileged Service Principal Names (SPNs), and weak access control list (ACL) delegations. During a breach, lateral movement often leverages these AD flaws to pivot from a low-privilege employee workstation to a Domain Controller (DC) in hours.
Key AD vulnerabilities targeted by lateral attacks
- Kerberoasting: Legitimate domain users request Kerberos ticket-granting service (TGS) tickets for any service account with an SPN. Attackers extract these tickets from memory and crack the service account passwords offline.
- AS-REP Roasting: Identifies accounts that do not require Kerberos pre-authentication, enabling attackers to grab the AS-REP response package and brute-force the account password offline.
- ACL & Delegation Gaps: Over-permissive ACL settings (e.g., GenericWrite, WriteDacl, or WriteOwner) on high-value group or user objects allow attackers to take control of domains without raising alarms.
- Group Policy Object (GPO) Misconfigurations: Weak GPO permissions allow adversaries to modify policies, resulting in code execution or authorization changes across hundreds of client devices.
A modern alternative: Automated, non-destructive AD auditing
Historically, AD assessments required installing local agent binaries or executing invasive, resource-heavy scanning tools. Active exploitation tools like Mimikatz or BloodHound, while effective, can trigger operational risks or operational outages if configured aggressively in production domains.
AssurePort AD Security Assessment approaches auditing differently. It operates strictly as a **read-only, non-destructive agent**. By querying the domain catalog passively via LDAP and reading Group Policies without writing or injecting memory payloads, AssurePort builds a complete attack-path graph. It maps every security relationship, Kerberoasting exposure, and delegation pathway safely in under 20 minutes.
Remediation priority: Identifying AD vulnerabilities is only half the battle. AssurePort triages finding severity based on CVSS scoring and provides remediation steps, such as setting up Group Managed Service Accounts (gMSA), enabling AES encryption, and hardening Delegation parameters.
Why Active Directory is attackers' favourite target
Active Directory is not attacked because it is weak. It is attacked because it is everywhere. It underpins identity for the overwhelming majority of enterprises, which makes a single domain compromise a master key to the entire network.
The economics favour the attacker. The 2025 Verizon Data Breach Investigations Report found that the majority of breaches now involve compromised credentials rather than malware. Once an adversary holds one valid credential, Active Directory becomes the map that shows them where to go next. Security researchers at Dark Reading note that 25 years after its release, AD remains one of the most reliably exploited targets in enterprise security, precisely because configuration drift accumulates faster than most teams can audit it.
Microsoft's 2025 guidance on mitigating critical threats to Active Directory Domain Services stresses the same point. The risk is rarely a single missing patch. It is the slow build-up of excess privilege, stale service accounts, and forgotten delegations that no annual review ever catches.
How a single credential becomes domain takeover
Lateral movement through Active Directory follows a predictable chain. Understanding it explains why passive auditing matters.
- Initial access. A phished credential or an exposed service grants a foothold on one low-privilege workstation.
- Reconnaissance. The attacker queries the domain, running the same LDAP lookups any authenticated user can run, to map accounts, groups, and trust relationships.
- Credential harvesting. Kerberoasting and AS-REP Roasting extract crackable tickets for service accounts without touching a domain controller aggressively.
- Privilege escalation. Over-permissive ACLs (GenericWrite, WriteDacl, WriteOwner) let the attacker rewrite permissions on high-value objects.
- Domain takeover. With control of a privileged group or the DC itself, the adversary owns every identity in the forest.
Every step in that chain leaves a structural fingerprint in the directory before the attack happens. The over-privileged SPN, the account without pre-authentication, the dangerous ACL all exist as readable configuration. A read-only audit surfaces them in advance, which is the entire point of attack-path analysis.
What automated read-only AD auditing checks
AssurePort's Active Directory assessment queries the directory the way a defender should, passively and without writing, injecting, or dumping memory. In a single run it evaluates several classes of exposure.
- Kerberoast exposure: every service account with an SPN and a weak or non-expiring password.
- AS-REP roastable accounts: identities configured without Kerberos pre-authentication.
- Dangerous ACLs and delegations: GenericWrite, WriteDacl, WriteOwner, and unconstrained delegation paths that lead to privileged objects.
- Group Policy weaknesses: GPO permissions that would allow policy tampering across many endpoints.
- Domain controller posture: stale accounts, privileged group sprawl, and trust misconfigurations.
The output is an attack-path graph, not a flat vulnerability list. It shows how a low-privilege account could reach Domain Admin, ranked by exploitability, so remediation starts with the shortest path an attacker would actually take. Fixing that one path often collapses dozens of downstream risks at once.
Because directories drift continuously, a single assessment is a snapshot, not a guarantee. New service accounts appear, delegations get added during migrations, and group memberships expand as teams grow. Re-running the read-only audit after every major identity change keeps the attack-path graph current, so a freshly introduced Kerberoast target or dangerous ACL surfaces within days rather than at the next annual review.
Frequently Asked Questions
What is Kerberoasting?
Kerberoasting is an attack where any authenticated domain user requests Kerberos service tickets for accounts with a Service Principal Name, then cracks the ticket offline to recover the service account password. It needs no special privilege, which is why over-permissioned service accounts are so dangerous.
Is automated Active Directory auditing safe to run in production?
Yes, when it is read-only. AssurePort queries the domain passively over LDAP and reads Group Policy without writing changes, injecting code, or dumping memory. Unlike aggressive tooling, a non-destructive audit carries no risk of outage or account lockout.
Why is Active Directory such a common attack target?
Active Directory controls identity for the vast majority of enterprises, so one domain compromise unlocks the whole network. The 2025 Verizon DBIR found most breaches involve compromised credentials, and AD is the system those credentials unlock.
What is an attack-path graph?
An attack-path graph maps how a low-privilege account could reach Domain Admin by chaining misconfigurations: a roastable service account, a dangerous ACL, a weak delegation. It ranks findings by exploitability so teams fix the shortest path to compromise first.
How much does an AssurePort AD assessment cost?
The Active Directory Security Assessment runs from $299 per scan. It surfaces Kerberoasting exposure, ACL and delegation gaps, and domain controller posture issues, then provides prioritised remediation steps such as gMSA adoption and AES encryption.