Active Directory Attack Paths: The Routes to Domain Admin We See Most

Active Directory attack paths are the routes an intruder follows from a single foothold to complete control of your network, and for most Australian organisations that network still runs on Active Directory. It manages identity, authentication and access across the estate, which makes it both the crown jewel and the busiest hunting ground for attackers. When we run internal penetration tests, the path to Domain Admin is rarely a single clever exploit. It is a chain of small weaknesses, each unremarkable on its own, that together hand over the keys.

This article walks through the attack paths we see most often, why they keep working, and how to find and fix them before a real adversary does the same.

How Attackers Get Their First Foothold

Most Active Directory compromises begin quietly, with credential material rather than malware. On internal engagements the earliest wins usually come from legacy protocols and predictable defaults.

• LLMNR and NBT-NS poisoning. These legacy name resolution protocols broadcast lookups across the local subnet when DNS fails. An attacker can answer those broadcasts, coax a machine into authenticating to them, and capture credential hashes for offline cracking.
• NTLM relay. Rather than crack a captured hash, an attacker can relay it in real time to another service that accepts NTLM and lacks signing. This turns one careless authentication into access on a second system.
• Weak and reused passwords. A single guessable password on a shared account, or a password reused from a breach, is often all it takes to convert network access into a valid domain identity.

None of these needs a zero-day. They rely on protocols that should have been retired years ago and on password hygiene that has not kept pace. The good news is that they are equally cheap to close once you know they are there.

Harvesting Credentials Once Inside

With a foothold established, the objective shifts to gathering more and better credentials. Active Directory offers several reliable ways to do this.

• Kerberoasting. Any valid domain account can request Kerberos service tickets for accounts that run services. Those tickets can be cracked offline, and because service accounts are often highly privileged with weak, non-expiring passwords, one crack can be decisive.
• AS-REP roasting. Accounts configured without Kerberos pre-authentication expose crackable material to any attacker who asks, no prior access required beyond visibility of the domain.
• Credentials in memory and on disk. Privileged sessions leave hashes and tickets behind on the machines where they log in. A compromised workstation that a domain admin recently used is a gift.

The theme here is that Active Directory happily answers questions it should be more careful about, and that privileged accounts leave traces wherever they go. Detection matters as much as prevention. Many of these techniques generate distinctive signals, such as unusual service ticket requests or authentication from unexpected hosts, but only if logging is turned on and someone is watching. On too many engagements we find the telemetry that would have caught us was never collected, which means a real attacker could have taken the same steps unseen for weeks.

Moving Laterally and Escalating Privilege

Captured credentials become powerful when they can be reused elsewhere. This is where lateral movement and privilege escalation blur together.

• Pass-the-Hash. An NTLM hash can be used to authenticate to other systems that accept NTLM, no plaintext password required. Shared local administrator passwords make this devastating, because one cracked hash can open every workstation in the estate.
• Pass-the-Ticket. Kerberos tickets, including forged golden and silver tickets, let an attacker impersonate users and services without touching a password at all.
• Delegation abuse. Misconfigured Kerberos delegation, whether unconstrained, constrained or resource-based, can let an attacker impersonate high-privileged accounts and reach systems they were never meant to touch.

Each hop widens access. The attacker follows the trust relationships you built for convenience, using them exactly as designed but for the wrong ends.

ADCS Abuse: The Path Many Teams Miss

Active Directory Certificate Services deserves its own section because it is so often overlooked. Many organisations treat certificate services as quiet infrastructure, yet a misconfigured template can be one of the fastest routes to Domain Admin we find.

The best-known example is the ESC1 misconfiguration, where a low-privileged user can request a certificate that authenticates as any account they nominate, including a domain administrator. There are several related escalation paths in the same family, collectively covering permissive templates, weak enrolment controls and vulnerable certificate authority settings.

Path	What goes wrong	Impact
ESC1	Template lets a user supply an arbitrary subject	Authenticate as any user, including Domain Admin
Template permissions	Low-privileged users can edit or enrol on sensitive templates	Escalation to privileged accounts
CA configuration	Weak issuance or approval controls	Attacker mints trusted credentials

Because certificates are trusted for authentication across the domain, abusing them effectively lets an attacker forge identity. Testing should always include ADCS, not just domain controllers and workstations.

Reaching Domain Admin and Staying There

The final steps of an attack path convert accumulated access into total control, and then into durable persistence.

• Privilege escalation to Domain Admin. By chaining the techniques above, an attacker eventually captures or forges credentials for an account with domain-wide authority.
• Persistence. Once in control, an attacker plants mechanisms to survive password resets and clean-ups. Techniques include forged Kerberos tickets, rogue accounts added to privileged groups, and abuse of directory replication rights to extract every password hash in the domain.

At this point the environment is fully compromised. The uncomfortable truth is that eviction is far harder than prevention, which is exactly why finding the path early matters so much. Once an attacker holds directory replication rights or a forged ticket signed with the domain's own key, a password reset achieves nothing on its own. Genuine recovery can mean rebuilding trust from the ground up, an expensive and disruptive undertaking that dwarfs the cost of the small fixes that would have broken the chain in the first place.

How to Find and Fix These Paths

You cannot defend a path you cannot see. The most effective way to understand your exposure is to have expert operators follow the same chains an attacker would, then map every link so you can break it. A well-scoped internal penetration testing engagement will surface these issues in the context of your real environment rather than as a generic checklist.

Practical priorities we recommend to Australian organisations include:

• Disable LLMNR and NBT-NS, and enforce SMB and LDAP signing to defeat relay attacks.
• Treat service accounts as privileged: use long, managed passwords and group managed service accounts where possible.
• Deploy unique local administrator passwords so a single cracked hash cannot open every host.
• Audit Kerberos delegation and remove unconstrained delegation wherever it is not strictly required.
• Review every certificate template and certificate authority setting for the ADCS escalation paths.
• Limit where privileged accounts log in, and use tiered administration to keep domain admin credentials off ordinary workstations.

For organisations that want to test not just the technical paths but their people and detection capability, a full red teaming exercise simulates a determined adversary end to end. Where you need a broader inventory of weaknesses across the estate first, vulnerability assessments provide the wider view, and our AI offensive security work helps model how attackers are accelerating these techniques in 2026.

Closing the Chain Before Someone Else Follows It

Active Directory attack paths keep working because they exploit convenience, legacy defaults and trust rather than exotic bugs. That is also why they are so fixable. Break one link and the whole chain fails.

If you want to know which paths lead to Domain Admin in your environment, and how to close them, our team of expert operators can map them for you. Explore our penetration testing services or get in touch for a scoping conversation. You can also call StrikeCyber on 1300 654 898.