Active Directory has been the backbone of enterprise identity management for over two decades. It’s also accumulated two decades’ worth of misconfigurations, legacy settings, and trust relationships that create escalation paths attackers exploit with alarming consistency.
The uncomfortable truth is that most Active Directory environments contain at least one path from a standard user account to domain admin. Often there are several. Finding and eliminating those paths before an attacker does is one of the most impactful security improvements any organisation can make.
Kerberoasting and AS-REP Roasting
These attacks exploit how Active Directory handles Kerberos authentication. Kerberoasting targets service accounts with service principal names registered. Any authenticated user can request a Kerberos service ticket for these accounts, and that ticket is encrypted with the service account’s password hash. Crack the hash offline, and you have the service account’s password.
AS-REP roasting targets accounts that don’t require pre-authentication. It’s less common but equally devastating when found, because it doesn’t even require authenticated access to execute.
William Fieldhouse, Director of Aardwolf Security Ltd, comments: “Active Directory privilege escalation is something we demonstrate in virtually every internal assessment. Kerberoasting, AS-REP roasting, unconstrained delegation, and misconfigured group policy objects all provide pathways from a standard user account to domain admin. Most organisations have no idea these paths exist until we show them.”
Group Policy and Delegation Weaknesses
Group Policy Objects can push scripts, software, and configuration changes to every machine in a domain. If an attacker can modify a GPO linked to a high-value organisational unit, they can execute arbitrary code on every system within it.
Unconstrained delegation is another classic misconfiguration. Servers configured with unconstrained delegation store the Kerberos tickets of every user who authenticates to them. Compromise that server, and you can impersonate any user who’s connected to it, including domain administrators.
Finding the Paths Before Attackers Do
Tools like BloodHound map the relationships and permissions in Active Directory to identify attack paths visually. Running BloodHound against your own environment reveals paths you didn’t know existed.
Regular internal network penetration testing should include Active Directory attack path analysis as a core component. Testers will attempt Kerberoasting, test for delegation issues, and map out the escalation paths that a real attacker would follow.
Remediating the Risk
Use managed service accounts or group managed service accounts instead of standard accounts for services. Set long, complex passwords on any service accounts that must retain SPNs. Remove unconstrained delegation from every server that doesn’t absolutely require it. Review GPO permissions and restrict who can modify them.
If you haven’t assessed your Active Directory security recently, getting a penetration test quote for a focused internal assessment will show you exactly what paths exist and how to close them. Active Directory security isn’t glamorous, but getting it right prevents some of the most common and most damaging attack scenarios in enterprise environments.
