Active Directory Attack Paths and Their Fixes

Any domain user can request a service ticket for any account that has a Service Principal Name. The ticket is encrypted with the service account's password hash, which means it can be cracked offline at attacker speed. Service accounts created with weak passwords twenty years ago are still around and still vulnerable.

Fix: 25-character random passwords on every SPN-bearing account, or migrate to Group Managed Service Accounts. Monitor for unusual ticket-granting-service requests.

Accounts with Kerberos pre-authentication disabled emit a TGT encrypted with the user's password hash without any authentication required. Anyone on the network can request one and crack offline.

Fix: Enable pre-authentication on every account. There is no legitimate reason to have it disabled in 2026.

A host configured for unconstrained delegation receives the TGT of every user who authenticates to it. Compromise the host (often easier than compromising a DC) and you collect TGTs that let you impersonate every user who logs in — including domain admins.

Fix: Remove unconstrained delegation everywhere. Use constrained or resource-based constrained delegation. Mark domain admin accounts as sensitive and cannot be delegated.

BloodHound finds these for you. A regular user with GenericWrite on a privileged group, or with the right to write to a GPO that applies to domain controllers, is one step from domain admin. ADCS misconfigurations (ESC1 to ESC8) provide a parallel path: a certificate obtained through a weak template can be used to authenticate as another user, including a domain admin.

See network penetration testing; the Active Directory test goes deeper into this one.