Active Directory penetration testing
We start with one ordinary domain account and look for the route to domain admin: Kerberoasting, delegation, ACL abuse, trusts and certificate services, with the fix for every step. Based in Hyderabad, testing Windows domains across India.
- Starting point
- A standard domain user
- Single domain
- 5 to 10 working days
- Starts from
- INR 27,000 + 18% GST
- You receive
- Attack-path graph, hygiene checklist
Last reviewed
Pathdomain user → F-01 → F-02 → domain admin
Also mappedF-03
- F-01Kerberoasting: a service account with a short password, set years ago and never rotatedMedium
- F-02A server trusted for unconstrained delegation that administrators sign in to every dayMedium
- F-03A certificate template that lets any domain user choose whose identity it carriesMedium
- ChainTaking over that one server yields credentials for each admin who connectsCritical
01 / Who needs it
Who needs Active Directory penetration testing
In most Windows estates, Active Directory decides who is allowed to do what. It holds the user accounts, the groups, the service accounts that applications run under, the policies pushed to every laptop and the keys to the domain controllers themselves. That makes it the place an intruder heads for once they are inside.
A phished employee, a stolen laptop or a malicious insider starts with one ordinary account; whether that account stays ordinary or turns into control of the whole domain depends on how the directory has been configured over the years. Active Directory penetration testing answers that question directly. We start where a real intruder would, with the access of a regular employee, and look for the shortest route from that account to domain admin.
The reasons organizations commission an Active Directory test tend to fall into a few groups:
The domain is old and nobody has looked at it as a whole
Domains that have grown for a decade or more collect service accounts with passwords set long ago, permissions granted for a project that ended, and settings switched off to make one old application work. Each made sense at the time. Together they can form a path an attacker can walk.
An external test came back clean
A tidy perimeter says little about what happens after a phishing email lands. Internal and external testing surface different problems, and the directory only shows up in the internal view.
Two networks are being joined
When a subsidiary, an acquired company or a partner is connected through a domain trust, one side's security can start to depend on the other's.
Someone has asked for evidence
An auditor, a board or an enterprise customer wants to know that internal access controls have been tested, not only described in a policy.
The security team wants a prioritized list
Directory hardening advice is long. A test shows which of those items an attacker could actually use against your domain, so the team can start there.
Any Windows domain, on-premises or hybrid
The service is for any organization that runs a Windows domain, whether it is entirely on-premises or a hybrid estate where on-premises systems are connected to cloud infrastructure.
02 / What we test
What we test in your domain
The test covers the directory and the systems that lean on it. The areas below come from the Active Directory phase of our internal network engagements, scoped here as a test in its own right.
Identity and privileged accounts
Who holds domain admin and the other tier-zero rights, how many accounts that is, and which accounts quietly hold more power than their name suggests.
Kerberos
Service accounts that can be Kerberoasted and accounts with Kerberos pre-authentication disabled, both of which turn a password problem into a path to privilege.
Delegation
Hosts and services allowed to act on behalf of users, starting with unconstrained delegation, which is the most dangerous setting of the group.
Access control lists and group policy
Permissions on users, groups and Group Policy Objects that let an ordinary account change something privileged, such as adding itself to an admin group or editing a policy that applies to domain controllers.
Trusts
Relationships between domains and forests, and whether a foothold in one gives a way into another.
Active Directory Certificate Services (ADCS)
Certificate templates and enrollment settings that can hand a user a certificate for a more privileged identity, a route to domain compromise that needs no password at all.
Credentials left in the open
File shares readable by every domain user that hold deployment scripts, configuration files, password databases or old Group Policy Preferences files with recoverable passwords.
Network-level credential capture
Legacy name-resolution protocols (LLMNR and NBT-NS), which can let an attacker on the same network segment collect other users' authentication, and NTLM relay, which can let an attacker anywhere on the internal network reuse it, including authentication they trick a server into sending.
Segmentation and admin access
Whether user networks can reach places they should not, and how privileged access workstations and jump hosts used by administrators are hardened.
The perimeter, cloud networks and wireless are covered by our network penetration testing service, and the two can be run together.
03 / Method
How an assumed-breach test runs
An Active Directory test is an assumed-breach engagement. Rather than spend days trying to get in, we take it as given that someone already has, and measure how far they can go. The work runs in five steps.
Show details for How an assumed-breach test runs
Step 1
Rules of engagement
Before anything runs, both sides sign off on the domains and hosts in scope, the time windows, how intense active testing may be and the stop conditions. Testing is designed to be safe for a domain your staff are working in that day: we work to avoid disrupting your production environment, and anything that counts as a hard stop is agreed in writing before testing begins.
OutputSigned rules of engagement
Step 2
The foothold
You give us access at the level of a standard domain user, the same as a new employee: a VPN credential, a jump host inside your network, or a laptop on-site. Nothing more privileged is needed, because the point of the test is to see what that account can reach.
OutputStandard domain user access
Step 3
Enumeration and path finding
From that foothold we map the directory: users, groups, computers, permissions, delegation settings, trusts and certificate templates. BloodHound enumeration is standard, and it shows the relationships between objects as a graph, which helps find the most efficient attack path, where one exists. Name-resolution poisoning and NTLM relay are tested on the network at this stage.
OutputThe directory mapped as a graph
Step 4
Privilege escalation toward domain compromise
We follow the most promising paths: ACL abuse, Kerberoasting, AS-REP roasting, certificate services misconfigurations and unconstrained delegation. Each step is proven before the next one is taken, so the report can show the full route from the first account to domain admin, or show where the route stopped.
OutputThe route to domain admin, or where it stopped
Step 5
Reporting
The path is drawn as a topology diagram, each host's findings are written up with the fix, the techniques are mapped to MITRE ATT&CK, and the directory gets a tier-zero hygiene checklist.
OutputTopology diagram, per-host findings, hygiene checklist
The VAPT methodology page describes our general approach to testing.
04 / Attack paths
Attack paths we examine
The six families of weakness below are well-documented routes from an ordinary account to domain admin. None of them needs an unpatched vulnerability: each is a configuration that Active Directory allows, and that a domain can carry for years without anyone noticing.
Show details for Attack paths we examine
Here is what each means for the business, and the class of fix that closes it. The report holds the technical detail for your administrators.
Kerberoasting
Any domain user can ask for a Kerberos service ticket for any account that has a Service Principal Name, which includes many service accounts. Part of that ticket is protected by the service account's password, so it can be taken away and attacked offline, at the attacker's own pace, without a single failed login on your side. A service account with a short password, set years ago and never rotated, falls quickly, and service accounts are often far more privileged than they need to be. The fix is 25-character random passwords on every account with a Service Principal Name or a move to Group Managed Service Accounts, retiring the older RC4 encryption where possible, and monitoring for unusual service-ticket requests.
AS-REP roasting
Kerberos normally makes a user prove who they are before the domain controller answers. When that pre-authentication is switched off for an account, anyone on the network can ask for a response tied to that account's password and try to crack it offline, without knowing anything about the account beyond its name. It can be a leftover from an old application that once needed it. The fix is simple: turn pre-authentication back on for every account; there is seldom a good reason to leave it off.
Unconstrained and constrained delegation
Delegation lets a server act on behalf of the users who connect to it. With unconstrained delegation, the server receives a reusable credential for every user who authenticates to it, so anyone who takes over that server can impersonate those users, domain admins included. Such a server is often less well protected than a domain controller, which is what makes it attractive. The fix is to remove unconstrained delegation from every system other than the domain controllers, which have it by design. Where a service genuinely needs to act for users, use constrained or resource-based constrained delegation instead, and mark domain admin accounts as sensitive so they cannot be delegated. We also check how constrained delegation is configured, because an account allowed to delegate to a sensitive service, such as one on a domain controller, can still lead to domain admin.
ACL abuse
Every object in the directory carries a list of who may change it. Over time, rights can be granted to a helpdesk group, a script account or a single user and never taken back. A regular user who can write to a privileged group, or who can edit a Group Policy Object that applies to the domain controllers, is a step away from domain admin, even though no one ever made them an administrator. These paths are hard to see by reading settings one at a time and clear once the relationships are graphed. The fix is to strip excess rights from privileged objects and keep tier-zero objects writable only by tier-zero accounts.
Trusts
A trust lets accounts in one domain or forest be recognized in another. That is useful when companies merge or subsidiaries share systems, and it also means the weakest domain in the arrangement can become the way into the strongest. Within one forest, an attacker who takes over any one domain can usually take over the whole forest, because the forest, not the domain, is the security boundary; between forests, protections such as SID filtering limit what crosses, and we check they are on. We look at which trusts exist, which direction they run and whether a foothold on one side gives any useful access on the other. The fix depends on the kind of trust. Inside a single forest, where the domains share one security boundary, every domain has to be protected to the standard of the most sensitive one. A trust to another forest that is no longer needed can be removed, and the ones that remain narrowed to what the business actually uses, with SID filtering left on.
Certificate services
Many domains run Active Directory Certificate Services to issue certificates for Wi-Fi, VPN or internal websites. A misconfigured certificate template or enrollment setting, the family of issues cataloged as ESC1, ESC2 and onward, can let an ordinary user obtain a certificate that identifies them as someone far more privileged. This route needs no password: the certificate itself is accepted as proof of identity, and it stays valid after a password reset, so teams that have hardened their service accounts can still be exposed here. The fix is to review every published template and the certificate authority's own settings, restrict who can enroll and what a requester is allowed to claim, and revoke any certificates already issued through a misconfigured template.
05 / Typical findings
What a typical Active Directory finding looks like
The examples below are generic. They are not taken from any client's network; they describe the kind of finding an Active Directory report tends to contain, so you know what to expect.
Show details for What a typical Active Directory finding looks like
| Finding | Detail | Fix |
|---|---|---|
| A service account with a weak password that is also a domain admin | It was added to the admin group once to fix a permissions error and never removed. Because it has a Service Principal Name, any domain user can request a ticket for it and work on the password offline. | The Kerberoasting fix: a 25-character random password or a move to a Group Managed Service Account, and the account taken out of the admin group. |
| A file share every employee can read, holding a deployment script with a privileged password in plain text | No exploit is involved: the attacker only has to look. | Reproduction and remediation in the per-host findings. |
| An old Group Policy Preferences file that still sets a local administrator password | The password in these files can be recovered by anyone who can read the file, and if the same local administrator password is set on many machines, one recovered password opens them all. | Reproduction and remediation in the per-host findings. |
| A support group with rights to reset passwords on accounts that turn out to be administrators | The right was meant for staff accounts; nobody noticed it also covered privileged ones. | The ACL abuse fix: strip excess rights from privileged objects and keep tier-zero objects writable only by tier-zero accounts. |
| A server trusted for unconstrained delegation that administrators sign in to every day | Taking over that one server yields credentials for each admin who connects. | The delegation fix: unconstrained delegation removed from this server, and constrained or resource-based constrained delegation where a service genuinely needs to act for users. |
| A certificate template any domain user can enroll in | A template that lets the requester choose whose identity the certificate carries, and whose certificates can be used to sign in. | The certificate services fix: restrict who can enroll and what a requester is allowed to claim, and revoke the certificates already issued through the template. |
| LLMNR and NBT-NS still enabled across the user network | When a machine mistypes a share name, an attacker on the same network segment can answer it and receive its authentication attempt. | Reproduction and remediation in the per-host findings. |
| A user network that can reach the management interfaces of domain controllers or production servers | Often found as a side effect of the lateral movement work. | Reproduction and remediation in the per-host findings. |
Rated one at a time, several of these look moderate. What matters is how they connect: a password found on a share leads to a server, the server holds an administrator's credential, and that credential opens the domain. The report shows those links as one path, so it is clear which single fix breaks the chain earliest.
06 / What you get
What you get
Every Active Directory report is written for two readers: the administrators who will make the changes, and the managers who need to know how exposed the domain was and what it will take to close the gaps.
Show details for What you get
- An attack-path graph that maps each step from the first account to the end of the path, with the weakness used at every step.
- A topology diagram of the route we took through your network, so the path is clear to someone who was not involved in the test.
- Per-host findings with reproduction and remediation, so an administrator can confirm each issue and fix it from the write-up.
- MITRE ATT&CK technique coverage, showing which attacker techniques were used, useful to a detection or SOC team checking what their monitoring would have caught.
- An Active Directory hygiene checklist for tier zero: the accounts, groups and settings that control the domain, and the state each should be in.
- A remediation roadmap that maps to the controls your audit framework cares about, so fixes can be scheduled and tracked.
The sample VAPT report shows how a BERRY9 report is laid out.
07 / Price
Price
An Active Directory test starts from INR 27,000 + 18% GST. Larger scopes cost more.
Active Directory test
Starts fromINR 27,000 + 18% GST
It is a starting price: the figure for your environment is set once we know what is in scope, and three things drive it:
- Domains. A single domain is one directory to map. Several domains, or several forests joined by trusts, multiply the permissions, policies and trust paths to review.
- Servers. Domain controllers, certificate authorities, file servers and the member servers that administrators sign in to all add hosts to examine and write up.
- Users. More user and service accounts, and more groups linking them, mean a larger graph of relationships to work through.
Starter scope
Starts fromINR 9,000 + 18% GST
The smallest engagement we offer, the starter scope, is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
An Active Directory test is a larger piece of work than that, which is why it starts from INR 27,000 + 18% GST instead.
Read the VAPT cost guideThe VAPT cost guide for India walks through how scope turns into a price across all types of test.
08 / Turnaround and retest
Turnaround and retest
An Active Directory test follows the steps in the method above, and the time depends mainly on the number of domains, servers and users in scope.
Show details for Turnaround and retest
- Working days for a single-domain test
- 5 to 10
- From the rules of engagement to the report
- 5 steps
A single-domain test typically takes 5 to 10 working days; several domains or forests take longer, and the proposal states the schedule.
What we need from you
- IP ranges.
- A network diagram.
- Signed rules of engagement.
- A standard domain user account, the foothold itself.
- A way onto the network, such as a VPN credential or a jump host.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
09 / Location and industries
Where we test from, and industries
Our network work, where Active Directory testing has been a dedicated phase, serves enterprise IT, pharma, manufacturing, healthcare, media and VFX, and education organizations.
Show details for Where we test from, and industries
Where we test from
BERRY9 has one office, in Hyderabad. Active Directory tests are usually run from our Hyderabad office, over a VPN connection or through a jump host you provide inside your network, so a domain gets the same test whether its servers sit in Hyderabad, Bangalore, Chennai or elsewhere in South India. Where remote access is not an option, a laptop can be placed on your network on-site by arrangement.
Industries
In each of them the directory is what ties users to systems; what changes is which systems the attacker would want to reach once they hold it.
City pages
10 / Compliance
Audits and compliance
Frameworks seldom name Active Directory, but their access-control and vulnerability-management expectations land on it, because it is where access is granted.
Show details for Audits and compliance
Work toward SOC 2, ISO 27001, PCI DSS or the DPDP Act will often raise the question of whether internal access has actually been tested, and an Active Directory report is one way to answer it.
SOC 2
The report shows how logical access was tested in practice, including how privileged accounts are controlled.
ISO 27001
The findings and the remediation roadmap can feed the vulnerability-management and access-control records your ISMS keeps. BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27.
PCI DSS
Where the domain touches the cardholder data environment, the test can be scoped alongside segmentation testing, which PCI DSS 4.x makes explicit.
DPDP Act
If directory accounts open the systems that hold personal data, showing who can reach those systems is part of demonstrating that the data is protected.
BERRY9 tests; it does not certify or audit your organization, and the audit outcome is your auditor's decision.
11 / Inquiry
Send us your scope and timeline
Tell us how many domains you run, roughly how many servers and users sit in them, whether there are trusts or a certificate authority, and when the work needs to be done. We will come back with a scope and timeline.
To discuss it first, call +91 86868 92922 or write to contact@berry9.com.
12 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Is Active Directory testing part of an internal penetration test?
It can be either. Active Directory attack paths, including Kerberoasting, AS-REP roasting, ACL abuse, certificate services and delegation, are a dedicated phase of our internal network tests, and they can also be scoped as an Active Directory test on its own. Either way, the report includes an Active Directory hygiene checklist.
Do you need access to our network to test Active Directory?
Yes. The test assumes an attacker already has a foothold, so you provide access at the level of a regular employee: a VPN credential, a jump host inside the network, or a laptop on-site. We then test what an attacker could do from that starting point.
Could the test disrupt our domain controllers or users?
The engagement is planned to be safe for a working domain. We work to avoid disrupting your production environment, and the stop conditions, the time windows and anything treated as off limits are signed off by both sides before the first test runs.
How do you find attack paths in a large directory?
BloodHound enumeration is standard on every Active Directory test. It maps users, groups, computers and the permissions between them as a graph, which helps find the most efficient route from an ordinary account to domain admin, where one exists, including paths that are hard to spot by reading settings one at a time.
How long does an Active Directory penetration test take?
A single-domain Active Directory test typically takes 5 to 10 working days. Several domains or forests take longer, and the proposal states the schedule. See the section on Turnaround and retest above.
How much does an Active Directory penetration test cost?
An Active Directory test starts from INR 27,000 + 18% GST. The final price depends on the number of domains, servers and users in scope. See the section on Price above.
Do you test hybrid environments connected to the cloud?
Yes. Hybrid networks, where on-premises systems connect to cloud infrastructure, are in scope, and our cloud network testing covers AWS, GCP and Azure. Tell us what is connected to the domain when the test is scoped.
Can you test whether user networks can reach the admin interfaces of our domain controllers?
Yes. Segmentation testing is available on its own or as part of a broader internal test. The deliverable is a per-boundary report showing what is reachable from where, with a topology diagram.
Will an Active Directory test make us compliant with SOC 2 or ISO 27001?
Not by itself. An Active Directory report is evidence that internal access controls were tested, which can support SOC 2, ISO 27001, PCI DSS or DPDP Act work. BERRY9 tests and does not certify or audit your organization; the audit result is for your auditor to decide.
Do you test domains outside Hyderabad?
Yes. BERRY9 has one office, in Hyderabad, and Active Directory tests are usually run from our Hyderabad office over a VPN or through a jump host, so organizations in Bangalore, Chennai and the rest of South India get the same test. A laptop can also be placed on your network on-site by arrangement.