Overview
Most UK organisations run Microsoft identity, often with on-premises Active Directory synchronised to Entra ID. That makes the directory the shortest path from one compromised user to everything. We trace those privilege paths, check the sync and trust links between on-premises and cloud, and rank the fixes so your infrastructure team can close the widest routes first.
Active Directory grows by accumulation. Years of groups, delegations, service accounts and permissions build up until an ordinary user, through no single dramatic flaw, has a path to Domain Admin that no one intended or can see. An AD assessment exists to find those paths, because controlling the directory means controlling nearly every system and account that trusts it.
We focus on the abuses that define real intrusions rather than generic misconfiguration. Kerberos weaknesses such as roastable service accounts and unconstrained or resource-based delegation, dangerous access-control entries that let one principal reset another's password or take ownership, over-privileged service accounts, and risky domain and forest trusts are all examined. We model how these combine, because the danger is rarely one setting but a chain of small permissions that together hand over the directory.
Our reporting turns that complexity into action. Alongside scored findings we provide attack-path diagrams that show how initial access becomes domain dominance, mapped to MITRE ATT&CK so your defenders can align detection. Recommendations are prioritised and practical: tiered administration, cleaning up delegation and ACLs, protecting privileged accounts, and the specific changes that collapse the most paths for the least disruption.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Access & enumerationFrom a standard account we collect the directory's objects and relationships.
- Path analysisWe model permissions and trusts to reveal routes toward privileged access.
- Technique testingKerberos, ACL, delegation and credential techniques are tested along those routes.
- Dominance demonstrationWe safely demonstrate the shortest realistic path to domain control.
- Report & debriefAttack-path diagrams, ATT&CK mapping and a prioritised hardening plan are delivered.
What you receive
- Attack-path diagrams from standard account to Domain Admin
- Findings mapped to MITRE ATT&CK with CVSS v4.0 scores
- Review of Kerberos, delegation, ACL and trust risks
- Prioritised tiering and hardening roadmap
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CIS Benchmarks
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- Cyber Essentials controls
Frequently asked questions
What access do you need for an AD assessment?
A single standard domain user account and network reachability to the domain controllers is enough to begin. Most of the value comes from showing how ordinary access escalates, which is exactly what a low-privileged starting point lets us demonstrate.
Is enumeration safe to run in production?
Yes. The collection techniques we use read the directory in the way ordinary domain-joined systems do and do not change objects. Any technique that could affect accounts or tickets is discussed with you first and run carefully, avoiding disruption.
How is this different from an internal network test?
An internal test covers the whole network and all its services; an AD assessment drills specifically into the identity layer, the permissions, Kerberos, delegation and trusts that turn a foothold into domain control. They complement each other and are often run together.
What permission do you need before testing our network?
Signed written authorisation from someone entitled to give it, which keeps the work on the right side of the Computer Misuse Act 1990. If a hosting company, landlord or managed IT provider runs part of the estate, we ask you to confirm their permission too.
Is this the same as a Cyber Essentials Plus audit?
No. Cyber Essentials Plus has a Certification Body check, hands-on, that the scheme's five controls are in place. An infrastructure pentest goes further, chaining weaknesses to show real attack paths. Many teams use our findings to tidy up before their Certification Body visits.