How AD trusts define security boundaries: parent/child, forest and external trusts, direction, transitivity, SID filtering and selective authentication, plus commands to enumerate, audit and monitor trusts.
How AD-integrated DNS, SRV records and dynamic updates underpin authentication, why insecure updates and record takeover matter, and how to audit AD DNS with nslookup, Resolve-DnsName, dcdiag and repadmin.
SIDs, DACLs, ACEs and the dangerous rights (GenericAll, WriteDACL, WriteOwner, AddMember, ForceChangePassword) that form BloodHound-style attack paths, plus how to audit and cut them.
How Group Policy and SYSVOL work, why GPO edit permissions are a domain-wide code-execution risk, the GPP cpassword exposure, and how to audit, detect and harden Group Policy.
Kerberos delegation explained: unconstrained vs constrained vs resource-based delegation, TrustedForDelegation, how each is abused, and PowerShell commands to audit and harden delegation.
Why AD CS is a major attack surface: enterprise CAs, certificate templates, enrollment permissions and ESC-style misconfigurations, plus how to inventory, audit, harden and monitor your PKI.
How SMB authentication works, why SMB signing stops NTLM relay, and how to audit signing requirements across the fleet with PowerShell, then detect and harden.
How Active Directory uses LDAP and LDAPS, why unsigned binds and missing channel binding enable relay attacks, and how to audit domain controllers and enforce LDAP signing.
Understand the NTLM challenge-response protocol, NTLMv1 vs NTLMv2, Pass-the-Hash and NTLM relay, where NTLM still lives in the enterprise, and how to audit, detect and migrate away from it.
A deep dive into Kerberos authentication in Active Directory: AS-REQ/AS-REP, TGT/TGS, SPNs, delegation, Kerberoasting and AS-REP roasting, plus detection, auditing and hardening.