>_ learning path
Active Directory Security: Attack Paths, Hardening, and Defense
Active Directory (AD) is the identity backbone of most enterprise networks — and precisely because it controls authentication, authorisation, and trust, it is one of the most valuable targets in any environment. This hub brings together our in-depth guides on how Active Directory works, how attackers abuse it, and how defenders can harden it. Whether you are studying for a pentest role, running a red team engagement, or securing a domain you own, use it as a structured map through the topic.
[ START HERE ]
Where to start
If you are new to AD security, work top-to-bottom: understand how the environment is enumerated, then how the core authentication protocols are abused, then how small misconfigurations turn into full domain compromise, and finally the infrastructure-level risks. Each linked guide is self-contained and ends with detection and hardening steps, so you can also jump straight to the area you need.
[ 01 ]
Enumeration and reconnaissance
Almost every attack path begins with mapping the domain — users, groups, sessions, and the relationships between them. Learning to see the environment the way an attacker does is the fastest way to understand where your real risk lives.
- Active Directory Enumeration with BloodHound: A Beginner’s Guide — collect and visualise attack paths, and read graphs the way both attackers and defenders do.
[ 02 ]
Authentication protocols and how they are abused
Kerberos, NTLM, LDAP, and SMB are the protocols that make a domain work. Each has well-known weaknesses — ticket abuse, relaying, and missing signing — that remain some of the most reliable routes to lateral movement and privilege escalation.
- Kerberos in Active Directory — TGT/TGS, SPNs, Kerberoasting and AS-REP roasting, plus detection and hardening.
- NTLM Authentication: Pass-the-Hash and Relay — why NTLM is being retired and what to do about it today.
- LDAP and LDAP Signing — channel binding, relay risks, and hardening.
- SMB Signing and NTLM Relay — closing the quiet path to lateral movement.
[ 03 ]
Privilege escalation and attack paths
Domain compromise rarely comes from a single exploit. It comes from chains: an over-permissioned ACL, an abusable delegation setting, or a certificate template that anyone can enrol in. These guides show how small permissions become Domain Admin.
- Active Directory ACLs and Attack Paths — how small permissions become Domain Admin.
- Active Directory Delegation — unconstrained, constrained, and resource-based constrained delegation (RBCD) risks.
- Active Directory Certificate Services (AD CS) — audit templates before they become a path to Domain Admin.
[ 04 ]
Configuration and infrastructure risks
Beyond individual protocols, the way a domain is configured — Group Policy, DNS, and trusts between domains — defines its blast radius. Misconfigurations here often go unnoticed for years.
- Group Policy Security — SYSVOL, GPO permissions, and the cpassword legacy.
- DNS and Active Directory — SRV records, dynamic updates, and spoofing risks.
- Active Directory Domain Trusts — direction, transitivity, SID filtering, and blast radius.
[ DEFENSE ]
A practical hardening mindset
Across all of these topics, the same defensive themes recur: enforce signing (LDAP and SMB), reduce and monitor privileged group membership, tier your administration, remove or constrain risky delegation, audit certificate templates, and watch the specific event IDs each guide calls out. Attackers look for the one forgotten setting; defenders win by closing categories of risk rather than chasing single findings.
>_ keep learning
Keep learning
New Active Directory guides are added regularly. Bookmark this page as your starting point, and pair it with hands-on practice on platforms like Hack The Box and TryHackMe to turn theory into repeatable skill.