Active Directory is the backbone of most corporate networks. An attacker who gains control of the domain essentially gains control of the entire company. Active Directory is no longer limited to internal IT networks – it increasingly extends to OT environments and is often closely linked to Azure and Entra ID. Because Active Directory controls authentication and access across your entire organization, it remains a central and critical target for attackers.
Active Directory Penetration Testing
Whether you are a SME or a global corporation - our Active Directory penetration tests provide you with exactly the insights you need to protect your core infrastructure
Why you should put your Active Directory to the test
As environments evolve – with legacy systems, hybrid configurations and cloud extensions – so do the attack surfaces. Thanks to our many years of experience in the areas of Active Directory and OT, we are able to precisely identify potential attack paths and assess their impact in the real world – whether in IT or OT. In particular, the detection of attack paths that spill over from IT into OT is a central focus of our Active Directory assessments.
Common vulnerabilities in Active Directories
Active Directory often has security-relevant vulnerabilities, as many environments have grown historically and have never been systematically hardened. This makes them an attractive target for attackers.
- Weak passwords for service accounts
- Unintended assignment of rights via inherited group memberships
- Misconfigured authorizations
- Critical misconfiguration when using AD CS (PKI)
- Too far-reaching authorizations on network shares with confidential information
- Missing or insufficiently implemented access model
How we support you
Our Active Directory Penetration Test is designed to identify the real risks within your identity infrastructure – from privilege escalation paths and misconfigurations to inadequately protected, sensitive information (e.g. plain text passwords) or insecure delegation models. Whether on-premises, hybrid with Entra ID or extended to OT environments, we assess your AD ecosystem for vulnerabilities that attackers can exploit to spread across your domain and gain access to sensitive information.
Targeted attack simulations
We simulate the behavior of attackers to uncover vulnerabilities that could put your most important infrastructure at risk – using manual methods and specialized tools that go far beyond automated scans.
Active Directory know-how
With many years of experience in both Active Directory and OT, we can accurately evaluate potential attack vectors and assess their true impact across all your Active Directory environments – whether IT or OT.
Security check of your AD ecosystem
Using an assumed-breach approach, we find out how far attackers can penetrate your Active Directory, regardless of the security of individual clients, e.g. on the basis of an opened phishing email that compromises the client.
Making Active Directory secure –
with the right test package
Our test packages help you to systematically identify and eliminate vulnerabilities in your Active Directory environment. Whether you have a small network or a complex infrastructure – choose the right package for you.
For small to medium-sized AD environments
First security assessment of your Active Directory environment – fast, structured and practical.
Scope of services:
-
Automated hardening test
-
Vulnerability scan of critical servers (incl. DCs)
-
Analysis of user, group and password configurations
-
Check for admin abuse (e.g. missing tiering, password reuse)
-
Manual attack path modeling (basic)
-
AD-CS check (if available)
-
Report with results and measures
Ideal as a starting point for improving your AD security
For medium to large environments
Advanced analysis with a focus on more complex attack vectors and additional components.
Scope of services:
-
All contents of the Essential Test
-
Advanced attack path modeling (manual)
-
Basic check of shared network content
-
Initial assessment of MS SQL, ConfigMgr and Entra Connect (if available)
-
Detailed report with prioritization
Optional add-ons:
-
Password analysis
-
Trust analysis for multiple domains
Ideal for validating measures or gaining a deeper understanding of risk
For complex AD environments with multiple domains or forests
In-depth security assessment – comprehensive, manual and customized.
Scope of services:
-
all content from Essential & Advanced
-
Comprehensive attack path modeling
-
Extended tests of supporting systems (e.g. MS SQL, ConfigMgr)
-
Detailed analysis of intra-/inter-forest trusts
-
Complete report with concrete recommendations for action
Optional add-ons:
-
Password analysis
-
Azure AD / Hybrid Identity Assessment
Ideal for companies with high security requirements or compliance targets
How to protect your Active Directory in OT environments
In our webinar, our experts from Limes Security will show you what you should pay attention to when introducing and securing an Active Directory in OT environments. Find out which risks are particularly critical, how proven IT security mechanisms can be sensibly transferred to OT and which measures are crucial for a secure, practical implementation.
Results of our AD penetration tests
Frequently asked questions
How does a penetration test of my Active Directory work?
Basically, a test of your Active Directory (AD) starts like any other pentest at Limes Security. Together with you, the (usually two) testers discuss the objectives and the exact mode of cooperation in a kick-off meeting. All your open questions will be answered and the previously agreed scope and the systems to be tested will be reconfirmed. Any worst-case scenarios that may be of particular interest to you are also discussed. The penetration test itself then takes place, during which it is particularly important for us to remain in close contact with you at all times – for example via a dedicated chat channel. Any questions that arise on both sides can therefore be clarified as quickly as possible, and we will also inform you immediately of any particularly critical vulnerabilities that cannot wait until the official report has been completed. You will receive this report no later than 2 weeks after the end of the penetration test. If desired, a joint final meeting, in which all test results are discussed again, concludes the project.
Can the AD penetration test also be carried out remotely?
In recent years, we have had very good experience with remote penetration tests in the area of Active Directory. Such an approach has the decisive advantage for you of eliminating any travel costs and time. All you need to do is host virtual machines (VM) – whose images we can provide you with – for our testers to carry out the penetration test. Remote access to these is also required (e.g. VPN). Experience shows that this additional effort is minimal, as both requirements are part of everyday administration in most companies. However, if you would like an on-site test, our testers will of course be happy to come to the test location of your choice.
What preparations are necessary for the penetration test?
Our testers must be able to access all systems to be tested from their test VMs (whether Limes VMs or those provided by you), unless otherwise agreed in advance. This may require additional firewall activations. In addition, at least two standard users are required in the domain who have the same rights as an average user in your company. If you are testing from VMs provided by you, we also ask that the test users on these are local administrators.
What should be the focus of the test?
This question can hardly be answered in general terms. Usually, a very individual test focus can be derived from the combination of existing systems/technologies in your Active Directory, their criticality, your threat profile and the available time budget. We will be happy to assist you with this in advance in a separate scoping meeting. In general, however, we place a special focus on the rights assigned to users and groups, important hardening settings in AD and critical technologies such as AD CS, the AD-integrated PKI solution.
I have several domains in use. Can/should they all be tested at the same time?
A basic distinction must be made between domains and forests. Starting from a domain that has been taken over, all other domains in the same forest can usually be taken over without much effort. There are also numerous misconfigurations across forest boundaries that enable compromise. A check of all domains/forests is therefore definitely recommended from a security perspective. However, as the number of domains/forests increases, the time budget required also increases, which is why it may be more suitable for you to divide the penetration test into several sub-areas. We will be happy to help you find the package that best suits your individual needs.
Will the AD penetration test affect my day-to-day operations?
Our testers proceed as carefully as possible to avoid any disruption to day-to-day operations as far as possible. Nevertheless, brief availability problems can occur in rare cases. However, attacks with an increased risk of this are always discussed with you in advance and only carried out after your approval. We are also happy to exclude particularly sensitive systems from the test or parts of it after consultation. Thanks to these precautionary measures, there have never been any major failures during our AD penetration tests.
My Active Directory has already been tested once. Does a new penetration test still make sense?
The answer to this question is a clear “Yes!”. In our practice, we have seen time and again that the main reason for misconfigurations and vulnerabilities is the great complexity of larger AD environments in particular. Especially when such an environment has been in place for a long time, errors creep in over time, for example temporary authorizations are not deleted, which means that certain users permanently have more rights than they should. A regular retest is therefore highly recommended, especially after conversions and major configuration changes. Existing test results also enable a test focus based on them, whereby measures already implemented to rectify the weaknesses found are checked for their effectiveness and a more in-depth test scope can be defined. For example, aspects such as cross-domain attacks (i.e. attacks across domain boundaries) can be examined in greater depth in such a test.
All systems in my Active Directory correspond to the latest patch level. Should the environment therefore not be secure?
The patch level of the systems in your AD is a very important component in the overall security concept for an AD. You have therefore already taken a very important step! However, there are numerous legitimate functions in AD whose exploitation opens up many avenues of attack and which cannot be remedied via updates. More complex attack paths in particular, which combine the authorizations of different users, often exist despite the latest patch level. For this very reason, efforts made to date should not be undermined by overlooking such attack possibilities. Our customized penetration tests are the ideal aid for this.
Is the internal perspective useful for an Active Directory test? After all, my perimeter is heavily hardened and I want to know how attackers can access my networks.
Perimeter protection is undisputedly important. However, practice shows that this is repeatedly breached. Whether it’s a malware infection on an Office client or an Azure identity stolen via phishing – “Assume the Breach” is unfortunately now a reality. To make it as difficult as possible for attackers to achieve their goals, a “defense in depth” approach is a good idea. Similar to a castle with several castle walls, overcoming a single line of defense is not enough. Even if an attacker makes it into your Active Directory, he should not have a free hand there – on the contrary, the hard part should be in front of him. Perimeter protection and a high internal security level: not a contradiction, but two sides of the same coin.
Which package is right for me?
Choosing the right package depends on the size and complexity of your environment, your objectives and your budget. You can use the following rule of thumb as a guide: For small to medium-sized AD environments (up to approx. 500 users and 100 servers) where a penetration test has never been carried out, an Essential Test is a good choice. For environments that are larger or have already been tested, we recommend at least an Advanced Test. Large environments, especially if several domains and forests are to be considered, benefit from a Comprehensive Test. Especially for SMEs, we offer a dedicated SME package that covers the most important configurations and most serious vulnerabilities. Are you unsure which package suits your environment? Simply write to us using our contact form.
