Domain administrator compromise is rarely the result of a single exploit. In the assessments we run, it is almost always a chain: four or five ordinary misconfigurations, each individually defensible, that combine into a path from an ordinary user account to complete control of the environment.
This guide covers the links that appear most often in those chains, why each exists, and what breaks it.
Why Directories Accumulate Attack Paths
Active Directory is frequently fifteen or twenty years old in the environments where it matters most. It has survived reorganizations, acquisitions, application migrations and staff turnover, and each of those events left permissions behind.
The structural problem is that directories are graphs. A permission grant is a local decision with global consequences, and the person granting it can see the grant but not the graph. Someone gives a help desk group the ability to reset passwords for a department, which is correct. Someone else places a service account in that department, which is also correct. The combination creates a path nobody chose.
This is why attack paths are found by mapping rather than by inspection, and why environments that have never been mapped almost always contain several.
Kerberoasting
Any authenticated user can request a service ticket for any account that has a service principal name. Part of that ticket is encrypted with the service account's password hash, so the requester can take it away and crack it offline at leisure.
This is not a vulnerability. It is how Kerberos works. It becomes an attack when service accounts have weak passwords, which they frequently do, because their passwords were set once by whoever installed the application and never changed.
Break it: move to Group Managed Service Accounts, which use long random passwords rotated automatically. Where an application cannot support them, enforce a password of at least twenty-five random characters and remove privilege the application does not actually need. A service account with a weak password and no privilege is a minor issue; the same account with local administrator rights on two hundred servers is a domain compromise waiting to be assembled.
Credentials in Reachable Places
Deployment scripts, runbooks, share folders, code repositories and SharePoint sites accumulate passwords. Somebody needed an installation to work, wrote the credential down, and moved on.
This is the least sophisticated link in most chains and one of the most productive. Enumeration from a standard user account routinely finds shares readable by all authenticated users containing exactly this material.
Break it: audit shares for broad readability, then search them for credential patterns. Move secrets into a managed store. Scan code repositories, including their history, because a credential removed in a later commit is still in the history.
Delegation
Delegation lets a service act on behalf of a user, which some applications legitimately need. Unconstrained delegation is the dangerous variant: a server configured this way caches the credentials of every user who authenticates to it, which means compromising that server yields every identity that has touched it, including administrators.
It exists in most long-established environments for reasons that expired years ago.
Break it: inventory unconstrained delegation and eliminate it, replacing it with constrained or resource-based constrained delegation. Mark privileged accounts as sensitive and not delegatable so their credentials cannot be delegated regardless of server configuration.
ACL and Permission Abuse
Access control entries on directory objects are where the most interesting paths live, because they are invisible in the group membership view most administrators look at.
Rights such as GenericAll, WriteDacl, WriteOwner and the ability to reset a password on a privileged account each provide a route to control that account. These are granted during ordinary work, frequently to service accounts by installers, and are almost never reviewed afterward.
Break it: map them. This is where a directory mapping tool earns its cost, because these relationships are effectively impossible to audit manually. Treat any path from a non-privileged principal to a privileged group as a finding.
Cached Credentials and Lateral Movement
Once an attacker holds administrative rights on a system, they can harvest credentials cached in memory from anyone who has logged into it. This is how privilege travels: an administrator troubleshoots a problem on a compromised server, and their credential is now available to whoever controls it.
Break it: tiered administration. Domain administrator credentials should be used only on domain controllers and privileged access workstations, never on ordinary servers or user endpoints. This is the single highest-value control in this list and the hardest to sustain, because it constrains how administrators work. It is also what most reliably breaks the chains described above, since nearly all of them depend on catching a privileged credential somewhere it should not have been.
Enable Credential Guard, restrict local administrator rights, and use the Protected Users group for privileged accounts.
Finding Your Own Paths
The paths in your environment exist whether or not anyone has looked at them, and they are discoverable by anyone with a domain account.
Run a directory mapping tool against your own environment and look at the resulting graph. Most teams doing this for the first time find several paths from ordinary users to domain administrator and are surprised by how short they are. That surprise is the useful part: it establishes that the problem is structural rather than a matter of individual mistakes.
Then make it recurring. Paths reappear as permissions are granted during normal operations, so a one-time cleanup decays. Monthly mapping with any new path treated as an issue keeps it from rebuilding.
For a worked example of these links combining, see domain admin in a day. To have your directory mapped and tested, get in touch.
Frequently asked questions
Why is Active Directory such a common target?
Because it is the authority for authentication and authorization across most enterprise environments. Compromising the directory means compromising everything that trusts it, which is typically every server, workstation, file share and application in the organization. It is also old, complex and accumulates configuration, which gives attackers a large surface of misconfiguration to work with.
What is an Active Directory attack path?
A sequence of permissions, group memberships and trust relationships that lets an attacker move from a low-privileged position to a highly privileged one. Each individual step is usually a legitimate configuration. The path is the combination, and because directories are graphs rather than lists, these paths are difficult to see by inspection and straightforward to find with a mapping tool.
What is the single highest-value fix?
Tiered administration: preventing privileged credentials from being used on ordinary workstations and servers. Most attack paths depend on harvesting a cached administrative credential from a system the attacker already controls. Removing that opportunity breaks a large proportion of paths at once, though it requires real operational discipline to maintain.
How often should we review Active Directory security?
Continuously for attack paths, because they reappear as permissions are granted during ordinary work, and comprehensively at least annually. Many organizations run a directory mapping tool monthly and treat any new path to a privileged group as an issue to resolve, which keeps the problem from rebuilding between assessments.
Does moving to cloud identity remove this problem?
It changes it rather than removing it. Most organizations run hybrid identity for years, and the synchronization between on-premises Active Directory and cloud identity creates its own attack paths in both directions. A compromise of on-premises directory frequently yields cloud access, and the account performing synchronization is itself a high-value target.