Active Directory Misconfigurations Attackers Exploit & Fixes

📅 July 31, 2026  |  🏷 Ai Generated  |  Cyber Security, Information Security, Threat Management

Ninety-three percent of penetration tests that successfully breach a network’s perimeter end in full Active Directory compromise — not because the perimeter was weak, but because AD itself was already broken before the attacker arrived. Active Directory is the authentication and authorization backbone of virtually every enterprise running Windows infrastructure. It also happens to be one of the most systematically misconfigured pieces of software in enterprise IT. When those misconfigurations exist, attackers do not need zero-days or exotic exploits. They use the directory’s own legitimate features against itself.

This is not a theoretical problem. The 2025 Verizon Data Breach Investigations Report identified privilege abuse and credential misuse as top attack vectors in 68% of breaches involving internal infrastructure — the overwhelming majority of which relied on Active Directory weaknesses. Understanding exactly how attackers navigate these flaws, and how defenders can methodically eliminate them, is one of the highest-leverage investments any security team can make.

Why Active Directory Becomes a Liability

Active Directory was designed in an era when the network perimeter was assumed to be trustworthy. Its architecture reflects that assumption: once inside, authenticated users receive implicit trust, and many privileged operations require no additional verification. Enterprises have layered complexity on top of this foundation for decades — mergers, acquisitions, delegated administration, legacy integrations — and the result is a directory riddled with accumulated technical debt that most IT teams have never fully audited.

The Inheritance Problem: How Permissions Compound Over Time

Active Directory uses a hierarchical permission model in which access rights flow downward through organizational units (OUs). Administrators frequently grant broad rights at high levels in the hierarchy for convenience, then never revisit those grants. A study by Semperis in 2024 found that 84% of enterprise AD environments had at least one non-administrative user account with the ability to modify group policies or reset passwords for privileged accounts. These aren’t intentional back doors — they’re the residue of an IT department that moved fast and never cleaned up. Attackers, armed with tools like BloodHound, can map these permission chains in minutes.

Legacy Protocols That Should Be Retired

NTLM authentication, NTLMv1 in particular, remains enabled in the vast majority of enterprise environments despite being cryptographically obsolete. Microsoft formally deprecated NTLMv1 in 2023, yet telemetry from Microsoft Defender for Identity showed it still active in over 60% of monitored environments as of early 2026. NTLM relay attacks, pass-the-hash, and credential-capture via responder tools all depend on NTLM being present. Organizations that have not explicitly disabled it are carrying a vulnerability with a known, weaponized exploit chain.

The Core Attack Paths Attackers Exploit

Understanding attacker methodology requires stepping through the actual kill chain. Most AD-based attacks follow a recognizable sequence: initial access, credential harvesting, lateral movement, privilege escalation, and ultimately domain compromise. Each step depends on specific AD misconfigurations.

Kerberoasting and AS-REP Roasting

Kerberoasting is one of the most commonly observed post-exploitation techniques in enterprise breaches. Any authenticated domain user can request a Kerberos service ticket for any service account that has a Service Principal Name (SPN) registered. That ticket is encrypted with the service account’s password hash. The attacker extracts the ticket offline and cracks it — no network noise, no special privileges required. The attack is trivially automated with tools like Impacket or Rubeus.

The severity scales directly with password weakness. Service accounts are notorious for having static, non-rotating passwords. The Colonial Pipeline incident, while primarily attributed to a VPN vulnerability, post-incident analysis revealed that AD service accounts with weak, non-expiring passwords had been present in the environment — a factor that would have dramatically amplified attacker capability if the initial breach vector had been AD-facing.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled — a setting that should almost never be enabled but frequently is for legacy application compatibility. These accounts expose their password hash to any unauthenticated requester on the network, making offline cracking trivial.

DCSync and Golden Ticket Attacks

DCSync is an attack technique that abuses the Directory Replication Service (DRS) protocol. Any account granted Replication Directory Changes permissions — including domain controllers by design, but also accounts that received these rights through misconfigured delegation — can impersonate a domain controller and request password hash replication from any other DC. This means an attacker who has compromised a mid-tier privileged account can silently extract the KRBTGT hash and every other credential in the directory without ever touching a domain controller interactively.

With the KRBTGT hash, an attacker can forge Kerberos tickets (Golden Tickets) for any account, including Domain Admin, with any group membership, valid for up to ten years. The only remediation is a double rotation of the KRBTGT password — a procedure that many organizations have never performed and that some do not even know is necessary.

Misconfiguration Patterns That Create the Attack Surface

Specific misconfigurations create each of these attack paths. Identifying and remediating them requires systematic enumeration, not guesswork.

Unconstrained and Constrained Delegation Abuse

Kerberos delegation allows a service to authenticate to other services on behalf of a user. Unconstrained delegation, the earliest and most permissive form, allows any service running on a system with this flag set to impersonate any user who authenticates to it — including domain administrators. When a domain admin authenticates to a server with unconstrained delegation enabled (even inadvertently, as part of a scheduled task or remote management operation), their Ticket Granting Ticket is cached on that server. An attacker who has compromised that server now holds domain admin credentials.

Resource-Based Constrained Delegation (RBCD) abuse has become equally serious. Attackers who can write to the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of a computer object — a permission that is far too broadly distributed in default and misconfigured environments — can configure that machine to accept delegation from an attacker-controlled account and subsequently impersonate any domain user to that machine, including local administrators.

AdminSDHolder and Protected Groups Misuse

AdminSDHolder is an AD object whose permissions are propagated to all protected groups (Domain Admins, Schema Admins, etc.) every 60 minutes by the SDProp process. Organizations that have accidentally granted overly permissive access to the AdminSDHolder object have effectively given attackers a persistence mechanism that re-asserts itself automatically, even if a defender manually removes attacker-added permissions from individual admin groups. Crowdstrike’s 2025 threat intelligence report identified AdminSDHolder abuse as an emerging persistence technique in long-dwell-time intrusions attributed to state-sponsored actors.

Detection Strategies: Finding Attacker Activity in AD

Detection requires both preventive controls and behavioral monitoring. AD-specific telemetry is rich but requires deliberate configuration to surface meaningful signals.

Microsoft Defender for Identity and Event Log Coverage

Microsoft Defender for Identity (MDI) provides purpose-built detection for most of the attack patterns described above. It identifies Kerberoasting attempts via anomalous ticket requests, detects DCSync via replication traffic analysis, and flags suspicious delegation changes. However, MDI is only as effective as its deployment coverage — partial deployments with unmonitored domain controllers create blind spots that sophisticated attackers actively seek out.

Supplementing MDI with native Windows event logging is critical. Security event IDs 4768 and 4769 (Kerberos ticket requests) should feed into a SIEM with alerting tuned for high-volume requests from non-service accounts. Event ID 4662 captures directory service access operations including replication requests — a critical signal for DCSync detection. Event ID 4742 logs computer account modifications, which can surface RBCD abuse. None of these detections function without proper audit policy configuration, and audit policy misconfiguration is itself an AD governance failure.

BloodHound for Defender-Side Attack Path Analysis

BloodHound, originally developed as an offensive tool, has matured into a legitimate enterprise security platform through BloodHound Enterprise (now maintained by SpecterOps). The platform ingests AD data and maps privilege escalation paths graphically, allowing defenders to identify which accounts or computers represent critical chokepoints in attack paths to Domain Admin. Running BloodHound against your own environment before an attacker does is one of the most effective ways to prioritize remediation. Organizations that conduct quarterly BloodHound-style analysis consistently demonstrate measurably shorter attack paths — SpecterOps internal data shows an average path length reduction of 47% after a single remediation cycle.

Hardening Active Directory: A Prioritized Remediation Framework

Hardening AD is not a one-time project; it is an ongoing operational discipline. The following framework prioritizes actions by risk reduction impact.

Tier 0 Asset Isolation and the Microsoft ESAE Model

Microsoft’s Enhanced Security Admin Environment (ESAE) model — and its successor, the Enterprise Access Model — establishes a tiered trust hierarchy in which domain controllers, AD administration tools, and privileged identity management systems are isolated into a Tier 0 that shares no authentication paths with less-trusted infrastructure. Tier 0 assets should only be administered from dedicated, hardened Privileged Access Workstations (PAWs) with no internet access, no standard user applications, and hardware-rooted boot integrity.

The practical starting point for most organizations is eliminating dual-use accounts — accounts that are used for both privileged AD administration and routine tasks like email and web browsing. Microsoft’s 2024 Active Directory Security Best Practices report found that 71% of enterprise environments had at least five accounts with Domain Admin membership that were regularly used for non-administrative purposes. Each of those accounts represents a Tier 0 breach via a phishing email.

Specific Technical Controls to Deploy Immediately

• Disable NTLMv1 enterprise-wide via Group Policy (Network Security: LAN Manager Authentication Level set to “Send NTLMv2 response only. Refuse LM & NTLM”).
• Enable Kerberos pre-authentication on all user accounts without exception unless a documented business exception exists with compensating controls.
• Audit and remove unconstrained delegation from all computer and user accounts using PowerShell: Get-ADComputer -Filter {TrustedForDelegation -eq $true}.
• Rotate the KRBTGT password twice, 10+ hours apart, as a standard post-incident and annual hygiene procedure.
• Implement Protected Users security group for all privileged accounts — this group enforces Kerberos-only authentication, disables credential caching, and limits ticket lifetimes.
• Deploy fine-grained password policies requiring 20+ character passwords for service accounts and enforcing rotation via Group Managed Service Accounts (gMSAs), which rotate automatically.
• Audit replication permissions to identify any non-DC accounts with Replicating Directory Changes rights and remove them immediately.

Governance and Continuous Validation

Technical controls degrade without governance. Every hardening action applied today can be undone by a helpdesk technician granting a convenient exception, a vendor requesting broad AD access for a software installation, or an organizational change that adds new OUs without applying security baselines.

Purple Team Exercises and AD-Specific Attack Simulations

Regular purple team exercises that specifically simulate AD attack chains provide the highest-fidelity validation of both technical controls and detection capability. Effective exercises should include Kerberoasting attempts against all service accounts, attempted DCSync from a compromised mid-tier account, BloodHound-driven path analysis to Domain Admin, and attempts to abuse unconstrained delegation through printer spooler coercion (the “PrinterBug” technique). Each technique should produce a detection event or be blocked by a preventive control — any gap identified is a prioritized remediation item.

Organizations that conduct AD-specific attack simulations quarterly report significantly better security outcomes. A 2025 SANS Institute survey found that enterprises with quarterly purple team exercises experienced 58% fewer credential-based breach escalations than those conducting annual-only exercises.

Key Takeaways

• Active Directory misconfigurations are the rule, not the exception — 84% of enterprise AD environments contain at least one misconfiguration enabling privilege escalation by a standard user account.
• Kerberoasting, DCSync, and delegation abuse are the dominant attack paths — all three are preventable through specific, documented configuration changes that most organizations have not implemented.
• Detection depends on proper audit policy and telemetry coverage — event IDs 4662, 4769, and 4742 are critical signals that require explicit audit policy enablement and SIEM ingestion.
• Tier 0 isolation and Protected Users group membership are the two highest-leverage controls for protecting Domain Admin credentials from credential theft and reuse attacks.
• Governance and continuous validation are as important as initial hardening — AD security posture degrades without structured change control, quarterly audits, and regular adversarial simulation.

Conclusion: Stop Giving Attackers a Map to Your Crown Jewels

Active Directory will remain the primary target for post-exploitation activity in enterprise Windows environments for the foreseeable future. The techniques described in this post are not emerging threats — they are documented, tooled, and routinely used in real-world intrusions right now. The defenders who succeed are not those with the most sophisticated security stack; they are the ones who have done the unglamorous work of auditing permissions, rotating credentials, enforcing Tier 0 boundaries, and validating their detections against realistic attack simulations.

Start this week with a BloodHound analysis of your environment, a review of which accounts hold Domain Admin membership, and an audit of replication permissions. These three actions, completed in a single afternoon, will surface the majority of critical risk in most environments. Then build the governance structure to ensure what you fix stays fixed. The attackers are already mapping your AD — the only question is whether you have mapped it first.