Penetration testing article

What an Active Directory Penetration Test Includes

An Active Directory penetration test evaluates realistic identity and administrative attack paths from agreed starting privileges. It is designed to show how configuration and delegated access can combine into material risk.

Assessment overview

What the assessment includes

Domains, forests, trusts, agreed starting access, and prohibited systems

Directory discovery and review of users, groups, delegation, and policies

Controlled validation of credential, Kerberos, service account, and privilege paths

Assessment of administrative tiers, lateral movement, and defensive visibility

Evidence of identity attack paths, affected objects, hardening priorities, and verification

Test coverage

What is examined

Final coverage depends on the agreed systems, access, objectives, exclusions, and safety requirements.

Domain and forest trust relationships

Privileged groups and delegated rights

Credential and authentication exposure

Service accounts and Kerberos configuration

Administrative tiers and lateral movement

Policy, logging, and hardening controls

Industry references

How coverage is informed

Microsoft security guidance

Identity, privileged access and hardening recommendations for the relevant platform.

CIS Benchmarks

Configuration review context for Windows and systems connected to the directory.

MITRE ATT&CK

Classification of observed enterprise identity techniques; not a compliance framework.

NIST SP 800-115

Assessment planning, execution, and reporting.

These references inform the assessment. Testing does not itself provide certification or guarantee compliance.

Final report

What is included in the report

The report is designed for both decision makers and the teams responsible for remediation.

Analysis of identity attack paths

Validated privilege findings

Affected objects and evidence

Hardening priorities

Remediation verification

Discuss the required scope and report.

DIGITPOL HK will confirm the targets, constraints, evidence needs, and reporting requirements before testing.

Request an assessment