Identity / Enterprise
Find the paths from ordinary access to domain control.
Assess how identities, permissions, and trust relationships connect across your Windows environment. Find the attack paths that could turn a compromised workstation or standard account into wider control.
01 / Assessment coverage
How far could an attacker get with a standard domain account?
I examine the relationships between users, computers, groups, and services, then validate agreed paths toward higher privileges and critical assets.
Domain & trust relationships
In-scope domains, trusts, group membership, and paths across administrative boundaries.
Permissions & delegation
Directory object permissions, delegated rights, and configuration that can enable privilege escalation.
Authentication & credentials
Relevant authentication weaknesses, service account exposure, and credential protection controls.
Lateral movement
Controlled checks of how an initial foothold could reach other in-scope systems and privileged sessions.
Certificate services
Active Directory Certificate Services configuration and certificate-based attack paths, when deployed and in scope.
Hardening priorities
Practical recommendations for reducing exposed privileges and breaking the validated attack chains.
The assessment follows the agreed starting position and rules of engagement. Potentially disruptive actions and access to sensitive systems require explicit agreement before validation.
02 / The engagement
Clear scope. Thorough testing. Useful answers.
You know what is being tested, how findings are communicated, and what happens next.
- 01
Agree the scope
Define your objectives, assets, access, testing windows, and rules of engagement. Scope and written authorization come first.
- 02
Test & validate
Combine manual testing with supporting tools. Investigate realistic attack paths and raise critical findings during the assessment.
- 03
Explain the risk
Receive a report with business impact, reproducible evidence, priorities, and practical remediation steps.
- 04
Support the fix
Walk through the findings together. Agree any remediation support and retest window in the proposal.
03 / What you receive
A report your team
can put to work.
Leadership needs the risk. Engineers need the evidence. Your report connects the two.
- Executive summary of risk and business impact
- Validated findings with evidence and reproduction steps
- Prioritized, actionable remediation guidance
- Coverage, limitations, and a findings walkthrough
04 / Before we start
A few good
questions.
Clear expectations make for a better engagement.
Do you start with a standard domain user?
A standard-user starting point is useful for understanding what could follow a compromised employee account. Other starting positions can be agreed, depending on the scenario you want to test.
Will you attempt to obtain domain administrator access?
Only if the engagement explicitly authorizes that objective and its validation steps. Demonstrating a viable path with sufficient evidence can be preferable to taking control of sensitive systems.
Does this include Entra ID or hybrid identity?
An on-premises Active Directory assessment does not automatically include cloud identity. If your environment is hybrid, we define which identity systems and trust boundaries are included in the proposal.
How do you handle confidentiality and sensitive data?
Confidentiality, evidence handling, secure report delivery, and retention requirements are agreed before testing. An NDA can be arranged. Please use the initial enquiry to describe your environment without sending credentials or sensitive records.
Is retesting included?
Retesting scope, timing, and any associated fee are agreed in the proposal. When included, the retest checks the remediated findings and records their status; it is not a fresh assessment of newly added functionality.
Let’s talk about your security
Start with a conversation.
Choose a time to discuss active directory testing, your priorities, and the scope of an assessment.
Choose from my available times through Calendly.