What is Active Directory security testing?
Active Directory security testing is a focused assessment of the identity layer your network actually runs on: domain controllers, user and service accounts, groups, organisational units, trust relationships, and the password policy that governs all of them. It looks for the conditions that let an ordinary account become a privileged one, then safely proves which of those paths work.
It is not a generic vulnerability scan pointed at a domain controller. The issues that decide a domain compromise are usually misconfigurations, excess privilege and weak or reused credentials rather than missing patches, so testing centres on enumeration, password-policy auditing and validated privilege paths, all under per-tenant Rules of Engagement.
Modern identity also rarely stops at the domain. Most organisations run hybrid identity: on-premises Active Directory synchronised to Microsoft Entra ID, formerly Azure AD, with Microsoft 365 on the same accounts. Testing one side and not the other leaves the pivot between them open, so PentestOps covers both.
| Question | Short answer |
|---|---|
| What it tests | Domain controllers, accounts, groups, trusts and the password policy. |
| Attacker position | A standard domain user, or one compromised workstation. |
| How PentestOps runs it | Through the on-prem agent, natively inside the domain, with 0 inbound firewall rules. |
| Cloud identity | Microsoft Entra ID and Microsoft 365 posture, reviewed agentlessly by the cloud audit. |
| What you get | Validated privilege paths with evidence, not a list of directory settings. |
Why Active Directory is still the target
Almost every enterprise network still runs on Active Directory for identity, and attackers know it. A phished credential, a misconfigured group membership or a legacy protocol left enabled for one old application is often all it takes to move from a single workstation to full domain control. Firewalls and endpoint tools rarely stop that path, because it does not look like an exploit, it looks like a normal login.
PentestOps treats identity as first-class coverage alongside external, internal, web, API and cloud testing, not a bolt-on. Active Directory security testing enumerates the domain, audits the password policy that actually governs it, tests credentials, and safely validates how far a compromised account could really go.
The on-premise agent
Active Directory testing runs through the same lightweight on-prem agent used for internal network penetration testing. A single container connects outbound-only over a reverse tunnel, so there are no inbound firewall rules to open, no VPN and no jump host. The platform never initiates a connection into your network; the agent always reaches out.
It survives restrictive corporate proxies, auto-reconnects if the link drops, and has zero state to back up. A per-tenant API key is issued at install, and updates roll out through an operator-controlled change window you can pause indefinitely.
| Property | What it means |
|---|---|
| Time to deploy | About 5 minutes from one install command. |
| Inbound firewall rules | Zero. The agent connects outbound-only over TLS 443. |
| Internal scan speed | Runs natively on the LAN instead of tunnelling every packet out. |
| Packaging | Ships as a Docker container, RPM or DEB package. |
| Domain reach | One host can enumerate the domain across subnets. |
| Monitoring | 24/7 asset drift detection and change alerts. |
What an Active Directory assessment covers
The agent draws on the same 18+ internal modules used for internal network testing, with a specific focus on identity:
- Domain enumeration, mapping domain controllers, users, groups, organisational units and trust relationships.
- Password-policy auditing via SAM and NTDS hash analysis, identifying weak, default and reused credentials at scale.
- Credential testing against discovered accounts and services, the same technique most real attackers start with.
- Over-privileged group and permission review, surfacing accounts that hold more access than their role requires.
- Legacy protocol and configuration exposure, the kind of settings that quietly widen an attacker's options.
- Exploit-chain intelligence that links individual findings into the routes an attacker would realistically take.
- Privilege-escalation and lateral-movement validation, safely proving how far one foothold could actually reach.
The issues that keep recurring, mapped to MITRE ATT&CK
Attackers reuse a small set of techniques against Active Directory because they keep working. Naming them with their MITRE ATT&CK technique IDs makes a report easier to line up against your own detection coverage and easier to hand to a defensive team without translation.
| Issue | ATT&CK ID | Why it matters |
|---|---|---|
| Kerberoasting | T1558.003 | Any domain user can request service tickets for accounts that have a service principal name and crack them offline, so one weak service-account password becomes privileged access. |
| AS-REP roasting | T1558.004 | Accounts with Kerberos pre-authentication disabled hand out crackable material to anyone who asks, without the attacker needing a valid credential first. |
| DCSync | T1003.006 | An account holding directory replication rights can ask a domain controller for password hashes, including those of the most privileged accounts in the domain. |
| LSASS credential dumping | T1003.001 | Credentials cached in memory on a compromised host supply the next account to move with, which is how a single workstation turns into a chain. |
| Pass the hash after password reuse | T1550.002 | One local administrator password shared across the estate lets a captured hash unlock every machine that shares it, no cracking required. |
| LLMNR and NBT-NS poisoning with SMB relay | T1557.001 | Broadcast name-resolution fallback lets an attacker on the LAN capture authentication attempts and relay them at hosts that do not enforce signing. |
What the platform does about them
Testing looks for the conditions that make each technique possible: service accounts with weak or reused passwords, accounts with pre-authentication disabled, replication rights held by accounts that have no business holding them, credentials left reachable on ordinary workstations, and legacy name-resolution protocols still enabled. Password-policy auditing via SAM and NTDS hash analysis surfaces the credential side; safe, RoE-gated exploit chains prove which paths actually lead somewhere.
On the mitigation side, LAPS, now shipped as Windows LAPS, is the standard answer to local administrator password reuse. It randomises the local administrator password on every machine and rotates it automatically, so a hash captured on one host stops at that host instead of unlocking the estate. Reporting pairs each finding with per-finding remediation guidance, and re-testing confirms the change actually closed the path.
How it works
Active Directory testing follows the same repeatable, seven-phase testing methodology as every PentestOps engagement, aligned to PTES, NIST SP 800-115 and CREST guidance.
After the agent is online, reconnaissance and enumeration build a live map of the domain: controllers, accounts, groups and trusts. Vulnerability analysis then correlates findings against the CVE catalogue and ranks what remains by CVSS v3.1, exploit availability and business impact.
Exploitation and validation safely confirms the highest-value paths and captures evidence at each step, before reporting and remediation delivers an executive summary, technical detail and prioritised fixes. On Enterprise, one-click remediation playbooks can be deployed through the agent over SSH, with rollback on validation failure.
From one weak credential to domain compromise
A vulnerability scan tells you an account has a weak password. It cannot tell you whether that password leads anywhere. Active Directory testing closes that gap: a strategy engine auto-picks the best technique per finding, and phased exploit chains turn a single weak credential into a demonstrated route toward broader domain access.
Every step runs under per-tenant Rules of Engagement with scope enforcement that automatically stops activity outside authorised assets, and every action leaves a full evidence trail. For a deeper look at how findings become proof, see attack path validation, and for the weaknesses that recur most often, see our guide to common Active Directory security issues.
Active Directory alongside the rest of your identity
Most organisations do not run Active Directory in isolation. Hybrid identity, Microsoft 365 and Azure AD extend the same directory into the cloud, and an attacker will happily pivot between the two if a fix on one side misses the other.
| Identity surface | How PentestOps tests it |
|---|---|
| On-premises Active Directory | Agent-driven enumeration, password-policy auditing and credential testing. |
| Domain accounts and groups | Over-privileged group review and exploit-chain intelligence linking findings together. |
| Microsoft Entra ID and conditional access | Agentless posture review, see Azure penetration testing. |
| Microsoft 365 | Covered by the cloud posture audit, with dedicated audits on Enterprise plans. |
| Lateral movement across the LAN | Validated alongside internal network testing. |
Microsoft Entra ID and hybrid identity
Microsoft Entra ID, formerly Azure AD, is where the on-premises directory usually ends up: accounts synchronised into the cloud, Microsoft 365 running on the same identities, and conditional access deciding who gets in from where. That is hybrid identity, and it means an attacker does not have to pick a side. A credential harvested on the LAN often works against the cloud tenant, and a privileged cloud role can reach back toward resources on-premises.
PentestOps tests both halves rather than treating the cloud as someone else's problem. The on-prem agent covers the domain itself, while cloud identity posture is reviewed agentlessly as part of the cloud configuration audit across AWS, Azure, GCP and Microsoft 365, with dedicated Microsoft 365 audits on Enterprise plans. See Azure penetration testing and cloud penetration testing for the cloud side.
The hybrid gaps worth checking are consistent across environments: privileged accounts that exist in both directories with the same password, directory synchronisation accounts holding more rights than they need, conditional access policies carrying exclusions that were only ever meant to be temporary, legacy authentication left enabled for one application nobody owns any more, and administrative roles assigned permanently where they could be granted only when required.
Why PentestOps for Active Directory testing
PentestOps is an Australian-built platform from Extranet Systems Pty Ltd, an ISO/IEC 27001:2022 certified company. The platform is hosted in Australia and customer data is stored in Australia. Discovered credentials are redacted before findings leave the agent, and remediation keys never leave your own hosts.
Active Directory testing is one lane of a single platform that also covers external, web, API, cloud and continuous monitoring, so identity risk is never assessed in isolation. Findings map to 8 compliance reporting frameworks plus CIS Benchmarks, exportable as PDF, CSV or JSON/API. Pricing is asset-wise, with scans unlimited within fair use. See pricing to get started.