Active Directory Security Assessment

An Active Directory audit is a comprehensive configuration review: we analyse every object, ACL, GPO, and account against security best practices and compliance frameworks. A penetration test is goal-oriented: it finds one viable path to Domain Admin and stops. Our AD Security Assessment combines both: systematic audit coverage across the full environment, with attack simulation to validate exploitability. You receive a complete picture, not just the path we happened to find first.

EDR tools monitor for malicious execution but cannot fix architectural flaws. If a user has GenericWrite permissions over a Domain Admin account due to a bad ACL, an attacker can take over the domain using built-in Windows tools without triggering any EDR alert. These are logic and configuration flaws that exist in the directory structure itself. EDR detects execution. Active Directory penetration testing and audit detects the misconfigured relationships that make execution unnecessary.

AD security assessments are scoped based on the number of domain objects (users, computers, groups), forest complexity, and whether Entra ID is included. Single domain environments up to 2,000 users typically cost from £3,750. Larger single domains (2,000 to 5,000 users) typically cost from £5,500. Multi-domain environments with forest trusts or hybrid Entra ID scope typically cost from £7,500. All engagements are fixed-price with no hidden day-rate additions. We provide a formal quote after a 30-minute scoping call, typically within one working day.

Yes. Our assessment is strictly read-only. We query AD objects, ACLs, and GPOs using SharpHound for data collection. No objects are modified, no passwords are reset, and no accounts are created during the engagement. Analysis is performed in our lab environment, not on your network. Zero production disruption.

No. Any authenticated domain user can read most directory information. We only need a standard user account to perform the assessment. This reflects real-world attacker capability: an attacker with a phished helpdesk account can enumerate the same data we collect. That is exactly why this assessment matters.

We cover hybrid environments. Our Entra ID scope includes: Azure AD Connect sync configuration, Conditional Access policy gaps, over-privileged App Registrations and Service Principals, PIM configuration review, guest access policies, and Primary Refresh Token attack surface. We ensure a compromise on-premises cannot pivot to the cloud, and vice versa. Entra ID scope is available as an extension to any on-premises AD assessment.

Kerberoasting is a post-exploitation technique where any authenticated domain user requests Kerberos TGS tickets for service accounts with SPNs set. These tickets are encrypted with the service account's password hash and can be cracked offline. Our assessment identifies every account vulnerable to Kerberoasting, enumerates their privilege level, and provides prioritised remediation including password rotation schedules and gMSA migration where applicable. In our experience, 3 in 5 AD environments contain at least one Kerberoastable Tier 0 account.

Cyber insurance underwriters increasingly require evidence of independent Active Directory security testing. A CREST-certified assessment report from an accredited firm, with a formal findings document mapping to recognised frameworks (ISO 27001, NIST CSF), is the format underwriters recognise and accept. The assessment cost typically represents less than the premium reduction it justifies. We can scope and deliver an assessment within 3 to 5 working days to meet your renewal deadline.

Purple Knight and PingCastle are automated AD security scanning tools that check for known misconfiguration patterns. They are useful as a baseline but cannot validate the attack path from a real user to Domain Admin through chained ACL relationships. That requires graph-based analysis and manual verification by an experienced analyst. A professional AD security assessment also produces a report with legal weight for compliance purposes, includes ESC1-ESC8 AD CS testing, and provides a technical debrief. Automated tools identify individual misconfigurations. We identify the attack chains that connect them.

Microsoft security baselines, LAPS, and tiered administration are essential Active Directory hardening measures and a strong starting point. However, configuration hardening and offensive attack path analysis are complementary. LAPS secures local admin credentials but does not address ACL-based privilege escalation, Kerberoastable SPNs, or trust relationship abuse. Most AD hardening projects fail at the ACL layer: the tiered model looks correct in Active Directory Users and Computers, but BloodHound shows legacy group memberships and forgotten ACL entries that bypass every tier boundary. Independent third-party assessment is also a requirement of ISO 27001 Annex A.8.2 and SOC 2 CC6.

Yes. DCSync is a technique where an attacker with Replicating Directory Changes permissions can request password hash replication from a domain controller, effectively extracting every credential in the domain. Our assessment identifies all accounts and objects with DCSync-capable permissions, determines whether those permissions are legitimate or misconfigured, and provides remediation guidance. Testing is conducted safely: we enumerate the permissions without executing replication.

Most AD assessments complete in 3 to 5 working days, including scoping, data collection, analysis, report writing, and debrief. Larger or more complex environments with multiple forests, external trusts, or Entra ID scope may extend to 7 to 10 days. We provide a fixed timeline during scoping.