Active Directory Security Checklist

Secure a testing position within the domain network with standard user credentials.

Document all AD domains, forests, and trust configurations included in the assessment.

Clarify whether achieving Domain Admin and demonstrating impact is in scope.

Optionally coordinate with the SOC to evaluate detection of AD attack techniques.

Prepare the AD attack toolkit and verify operational security for testing.

Run SharpHound collectors to map users, groups, computers, ACLs, and sessions.

Identify all members of high-privilege groups and nested group memberships.

Enumerate accounts with ServicePrincipalNames set for Kerberoasting targets.

Review GPOs for password policies, user rights assignments, and script deployments.

Check which accounts can read Local Administrator passwords managed by LAPS.

Find systems with unconstrained or constrained delegation that could be abused for escalation.

Request TGS tickets for SPNs and crack them offline to recover service account passwords.

Identify and exploit accounts with DONT_REQUIRE_PREAUTH flag set.

Use harvested NTLM hashes and Kerberos tickets to authenticate to other systems.

Test common passwords against all domain accounts while respecting lockout policies.

Coerce authentication from domain controllers and relay to AD CS or LDAP services.

Determine if credentials can be dumped from memory using Mimikatz or similar tools.

Abuse GenericAll, WriteDacl, WriteOwner, and other dangerous ACEs identified by BloodHound.

Check for vulnerable certificate templates (ESC1-ESC8) using Certify or Certipy.

Use DCSync, Volume Shadow Copy, or ntdsutil to extract the AD database.

Exploit trust relationships using SID history injection or foreign group memberships.

Assess whether KRBTGT hash extraction would allow forged Kerberos ticket creation.

Check for GPO creation rights or modification permissions that could push malicious policies.

Generate clear attack path graphs showing the chain from initial user to Domain Admin.

Report on cracked passwords, password reuse, and policy compliance statistics.

Recommend tiered administration, credential protection, and ACL remediation steps.

Reference specific ATT&CK technique IDs for each attack used during the assessment.

Ensure all forged tickets, implants, and test accounts are removed and passwords are reset.