Active Directory Attack Paths: What We Find in Almost Every Internal Pentest

Almost every internal network penetration test that reaches an Active Directory environment ends the same way, not through a novel exploit, but through a chain of ordinary AD misconfigurations that, individually, look minor. A 2024 joint advisory from CISA, the NSA, and international partners catalogued 17 of the most common techniques used against Active Directory specifically because they recur across real environments so consistently. These are the ones we see most often.

Kerberoasting and AS-REP roasting

Kerberoasting requests a service ticket for any account with a Service Principal Name and cracks its encrypted portion offline, which means a service account with a weak or old password is crackable regardless of any account lockout policy, since the attack never touches the domain controller's authentication logic directly. AS-REP roasting targets a smaller but still common misconfiguration: accounts with Kerberos pre-authentication disabled, which lets an attacker request and crack their hash without ever needing valid credentials in the first place. Both are detectable directly from Active Directory's own data with zero exploitation required, the accounts vulnerable to either technique are enumerable in advance.

Unconstrained and abusable delegation

Delegation lets a service impersonate a user to access other resources on their behalf, necessary for some real application architectures, but unconstrained delegation configured on a compromised machine hands over the Ticket-Granting Ticket of anyone who authenticates to it, including a domain administrator who logs in for routine maintenance. Constrained and resource-based constrained delegation are safer by design, but misconfigured or overly broad delegation rights on either still create a real escalation path, this is one of the more consequential single settings in an AD environment, and one of the least frequently audited.

Weak GPO and ACL permissions

Group Policy Objects apply broadly and run with high privilege by design, which makes a GPO with edit rights granted to a low-privileged group a direct path to domain-wide code execution, modify the GPO, and it runs as SYSTEM on every machine it applies to. The same pattern shows up in raw Active Directory ACLs: a GenericAll or WriteDACL permission left on an object by a departed admin or a legacy delegation setup is often forgotten entirely, and it's exactly the kind of finding that only shows up when someone actually maps the permission graph rather than reading a policy document.

LLMNR/NBT-NS poisoning and credential relay

Windows' legacy name-resolution fallback protocols, LLMNR and NBT-NS, will happily respond to a broadcast query for a hostname that doesn't exist, and an attacker on the same network segment can answer first, harvesting NTLM hashes or relaying the authentication attempt directly to another host. This one requires no prior foothold beyond network access, which is exactly why it's one of the first techniques tested in almost any internal engagement.

Why attack paths, not isolated findings, is the right frame

None of these four techniques alone is usually catastrophic. What makes Active Directory compromise so consistent in real engagements is that they chain, LLMNR poisoning yields a foothold, Kerberoasting yields a service account, that account has GPO edit rights somewhere, and the GPO reaches a domain controller. Reporting each of these as an isolated, individually-scored finding misses the actual risk; the risk is the path between them. This is exactly what our Penetration Testing engagements are built to surface, and it's the same reasoning behind mapping findings to OWASP and MITRE ATT&CK rather than reporting a flat list. For the broader defense-in-depth thinking this fits into, see our piece on zero trust architecture. Kerberoasting and AS-REP roasting are only half the identity-attack picture, see our piece on password spraying for the other common way in.