Active Directory penetration testing in Bangalore
Bengaluru companies often run Active Directory beside a cloud identity service, with new Windows Server 2025 domain controllers arriving. BERRY9 tests those directories remotely from Hyderabad, our only office, including the newest attack paths and the link between on-premises and cloud identity.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote from Hyderabad, on-site by arrangement
Last reviewed
01 / Local need
Why Bangalore companies test Active Directory
Fast growth and a cloud-first culture leave a hybrid identity estate.
A Bengaluru company that went from fifty to five hundred staff in three years has a directory shaped by hiring rushes: groups copied from other groups, administrators added to unblock a release, and a sync to a cloud tenant that nobody revisits. Captive centers and suppliers working for global customers are asked to show that their identity setup meets the customer's standard. Both are served by a test that starts as an ordinary employee and tries to reach the keys.
Because identity changes quickly in a fast-growing company, one test is only a snapshot. Many teams in the city repeat the Active Directory test after a hiring wave, a merger or a domain controller upgrade, and keep the first report as the baseline against which the next one is compared, so progress shows up as paths closed. The service is on the Active Directory penetration testing page, and the city view is on VAPT services in Bangalore.
02 / Scope
What a Bangalore directory test looks at first
A hybrid, quickly grown estate points to six starting places.
Groups and rights grown by copy
Groups copied to onboard someone quickly carry rights nobody chose. We map who can reach what and which nested memberships give hidden power.
Windows Server 2025 domain controllers
New features bring new permissions. We check who may create delegated managed service accounts and review the settings that the BadSuccessor research highlighted, after confirming the patch is installed.
Privileged accounts in daily use
Administrators who read email and browse the web on their own laptops are a common path. We check where privileged sessions happen.
Sync to a cloud tenant
The account that syncs the directory to the cloud holds great power. We test its protection and the paths from on-premises users to cloud administrator roles.
Service and automation accounts
Build and deployment systems log in with accounts that rarely rotate. We test their rights and whether their credentials can be recovered from a workstation.
Detection in the directory
We keep a log of our actions and ask which of them your directory auditing and alerts noticed.
03 / From our guide
From our guide: BadSuccessor and hybrid identity
Two themes drive most of the newer questions we get from Bengaluru teams: the Windows Server 2025 escalation path disclosed in 2025, and the link between on-premises and cloud identity. This is how our guide covers them.
BadSuccessor: a 2025 attack on a 2025 feature
In May 2025 researchers at Akamai described BadSuccessor, an escalation path in Windows Server 2025's delegated Managed Service Accounts (dMSA). The feature lets an administrator migrate a service account to a new type, and the attack abused how that migration is recorded so a user with the right to create a dMSA could inherit the rights of any account in the domain. Microsoft released a fix in August 2025, tracked as CVE-2025-53779, and Akamai's follow-up analysis describes the patch as moving validation into the Kerberos service.
The lesson is wider than one bug. A new Active Directory feature arrives with new permissions to audit, and the patch does not remove the need to know who can create objects in which organizational units. If you have Windows Server 2025 domain controllers, install the update and review who holds the right to create dMSAs.
Hybrid identity widens the target
Most organizations also sync Active Directory with a cloud identity service. The 2026 reports from CrowdStrike and Microsoft both describe attackers targeting these hybrid links: the sync account, federation settings, and tokens issued after a successful phish. An on-premises weakness can become a cloud tenant compromise, and the reverse is also true. A modern assessment looks at both sides of the connection.
Both are tested in every engagement where they apply, and the report states plainly where they do not. The remaining paths, from Kerberos tickets to certificate services, are in our full Active Directory guide.
04 / What we find
Weak points that recur in Bengaluru directories
Hiring rushes and quick fixes leave their mark on a directory.
Show details for Weak points that recur in Bengaluru directories
- Copied groups with hidden power. A group cloned from an engineer's to onboard a new joiner, and carrying rights over servers that the new joiner never needed.
- Service accounts with human-length passwords. Build and deployment accounts whose password hashes can be recovered and cracked offline.
- Administrators on the corporate laptop. Domain-level accounts used for daily email, so one phish reaches the whole directory.
- Delegation left from a migration. Rights to create or change objects granted for a project and never withdrawn.
- A sync account that is too powerful. The cloud connector holding more rights than its job requires.
- Little or no alerting. Kerberos ticket requests for dozens of service accounts that nobody is alerted about.
The report orders the fixes by how many routes each one closes, because removing one over-broad permission often breaks several attack paths at once.
None of these needs an exotic technique. The common thread is that nobody owns the directory as a product, so changes accumulate without review. If that sounds familiar, the first useful step may not be the test itself but naming one person who approves changes to privileged groups, and the report gives that person a ranked list to work from.
05 / Rules and customers
What Bangalore reviewers ask about identity
Identity questions come from customers' security teams and from certification audits.
Show details for What Bangalore reviewers ask about identity
Customers ask how privileged access is controlled, whether multi-factor authentication covers administrators, and when the directory was last tested. Audits for SOC 2 and ISO 27001 expect proof of a routine and of findings that were closed. Our article on how often to test offers a schedule tied to major changes, such as a domain controller upgrade.
For the wider threat picture, CrowdStrike's 2026 report puts the average criminal break-out from a first foothold to a second system at 29 minutes; see our 2026 threats article for what that means for testing priorities.
06 / How it runs
How a directory test fits a Bangalore hybrid estate
We set up the starting position on one call, and no visit is needed after that.
Show details for How a directory test fits a Bangalore hybrid estate
Before day 1
Scope and starting position
We agree the domains, any cloud tenant link, the starting position and what stays off limits, and settle whether the way in is a VPN login or a device you connect.
Day 1
Account and access
You create a plain user account and allow our testing addresses. We settle what may be done if we reach administrator rights and how that is demonstrated without being misused.
Days 2 to 7
Mapping the paths
We map accounts, groups, trusts, certificate services, delegated accounts and the cloud link, and chain the weak points toward domain administrator, and we report serious exposure the moment it appears.
OutputStep-by-step attack paths with proof
07 / Questions to ask
Questions for a directory tester in a hybrid estate
These matter most when the estate is hybrid and growing.
Show details for Questions for a directory tester in a hybrid estate
- Will you test the link between our directory and the cloud tenant?
- How do you treat Windows Server 2025 domain controllers and delegated managed service accounts?
- What will you do with administrator access if you reach it, and what will you never do?
- Will you tell us which of your steps our directory auditing recorded?
- Can the report show the paths as chains, with the one fix that closes the most?
08 / Delivery
Delivery of directory tests for Bangalore companies
Where the work happens
Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.
What you receive
One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.
How to prepare
Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.
09 / Price
What directory testing costs in Bangalore
The price does not change with the city. Directory work belongs to the larger band and begins from INR 27,000 + 18% GST, set by the domains, sites and cloud links involved. The cost guide breaks the figure down.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you test for the BadSuccessor issue in Windows Server 2025?
Where Windows Server 2025 domain controllers are in use, we confirm the August 2025 fix is installed and review who may create delegated managed service accounts, because the underlying permissions matter even after the patch. See the section on From our guide: BadSuccessor and hybrid identity above.
Do you cover the link between Active Directory and the cloud?
Yes. We test the sync account and the paths from on-premises users into cloud roles. A fuller cloud review is a separate service, the cloud security assessment. See the section on What a Bangalore directory test looks at first above.
Does the directory test have to happen on site?
Yes. We start from a VPN login for a regular employee or from a device you connect that calls out to us. See the section on How a directory test fits a Bangalore hybrid estate above.
Will you change anything in our directory?
We avoid changes. Where proving a path requires one, we agree it beforehand, log it and reverse it, and production data is never altered. See the section on Questions for a directory tester in a hybrid estate above.
Will the test show what our monitoring missed?
Yes, if you want it. We log our actions and the report can list which your directory auditing and alerts noticed and which they did not. See the section on What a Bangalore directory test looks at first above.
How is directory testing priced?
It begins from INR 27,000 + 18% GST, according to domains, sites and cloud links. See the section on What directory testing costs in Bangalore above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana