Active Directory Security Audit: Finding and Fixing the Paths to Domain Admin

Active Directory: The Crown Jewel

Active Directory (AD) is the backbone of enterprise identity in most organizations. Compromising AD means controlling every user, computer, and service in the domain. AD security auditing identifies the attack paths adversaries use to reach Domain Admin.

Critical Attack Techniques

Kerberoasting

Request service tickets for accounts with SPNs, then crack offline:

# Request tickets
GetUserSPNs.py domain/user:password -request -dc-ip 10.0.0.1
# Crack with hashcat
hashcat -m 13100 tickets.txt wordlist.txt

Prevention: Use long, complex passwords for service accounts. Use Group Managed Service Accounts (gMSA).

AS-REP Roasting

Target accounts with Kerberos pre-authentication disabled:

GetNPUsers.py domain/ -usersfile users.txt -no-pass -dc-ip 10.0.0.1

Prevention: Enable pre-authentication for all accounts.

DCSync

Simulate domain controller replication to extract all password hashes:

secretsdump.py domain/admin:password@dc.domain.com

Prevention: Restrict replication permissions. Monitor for non-DC replication requests.

Delegation Attacks

Exploit unconstrained or constrained delegation:

• Unconstrained: Compromised server can impersonate any user to any service
• Constrained: Limited but still exploitable via protocol transition

Audit Checklist

• Identify accounts with SPNs and weak passwords
• Find accounts with pre-auth disabled
• Review delegation settings on all accounts
• Map paths to Domain Admin using BloodHound
• Check for stale accounts and groups
• Verify LAPS deployment for local admin passwords
• Audit Group Policy for security settings
• Review trust relationships with other domains

Where SuperClue Fits

SuperClue does not audit Active Directory. On Windows servers, its SOC agent reads security event logs, and 24 of its HIDS rules target Windows events, which helps you notice attacks such as unusual logons.