Active Directory Pentesting Checklist

Map the domain, forest, trusts, and principals before touching anything noisy. Enumeration drives every downstream attack path: who can do what, where the high-value targets live, and which misconfigurations are reachable from a low-privileged foothold.

Attack the Kerberos and NTLM authentication primitives directly: roast service and preauth-disabled accounts for offline cracking, spray weak passwords against the directory, and poison name-resolution to capture and relay credentials.

Extract credential material from memory, disk, and the directory itself: LSASS secrets, DCSync replication, the NTDS.dit database, and access tokens. This phase converts a foothold into broad credential ownership.

Move between hosts using recovered credentials, hashes, and tickets. Pass-the-Hash, Pass-the-Ticket, remote execution protocols, and NTLM relay turn a single compromised credential into broad network access.

Escalate from limited rights to domain dominance by abusing object ACLs, Kerberos delegation, Active Directory Certificate Services, and Group Policy. These are the highest-impact escalation primitives in modern AD.

Establish durable, hard-to-evict footholds after achieving high privilege: forge Kerberos tickets, manipulate replication, and plant directory-level backdoors that survive password resets and remediation.

Cross security boundaries by abusing domain and forest trusts. Enumerate trust relationships, abuse SID history and inter-realm tickets within a forest, and exploit cross-forest attack paths where trust configuration permits.