AD misconfigurations
Find weak settings and exposed services that make compromise easier.
- Domain controller hardening and patch exposure
- Legacy protocols and unsafe account settings
- Password, lockout, and machine-account policies
We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Microsoft Active Directory Your domain. Under scrutiny.
Active Directory
penetration testing.
Hire experienced BlackSight specialists to manually test your Active Directory setup. Get validated attack paths, clear evidence, and fixes your IT team can act on.
Call to discuss your AD scope +1 (615) 200-7888Forest root
company.example
DC-01
DC-02
West domain
Trusted regional domain
DC-03
DC-04
East domain
Trusted regional domain
DC-05
DC-06
Users & groups
Workstations
App servers
Group Policy
Illustrative enterprise environment
Experienced specialists. Manual testing.
Remote and on-site testing worldwide
Completion certificate includedFree corporate planning guide / 10 pages
Planning your Active Directory pentest?
Prepare your scope, get budget approval, and organise your team before testing begins.
Follow the access. Find the risk.
One account can open a lot of doors.
Our specialists investigate AD misconfigurations and exposed credentials. We then manually validate how those weaknesses could combine to give an attacker access to your servers, sensitive data, or domain.
Microsoft Active Directory
An AD attack path
Illustrative · your test follows the evidence
Standard domain account
The agreed starting point
AD misconfigurations
Exposed credentials
Excessive permissions
Trusts & delegation
Privileged access
Critical systems. Business impact.
What we test in Active Directory
From individual settings to paths across domains, we check where access controls can fail and what that means for your business. Coverage and validation techniques are agreed around your environment.
Credentials & service accounts
Trace exposed or weak credentials to the access they could unlock.
- Secrets in SYSVOL, scripts, and accessible file shares
- Weak passwords and controlled password spraying
- Service accounts, local admins, and Windows LAPS access
Kerberos attacks
Assess whether authentication settings expose credentials or allow account impersonation.
- Kerberoasting and AS-REP roasting exposure
- Service-account encryption and pre-authentication
- Ticket abuse and privileged account exposure
Permissions & Group Policy
Identify who can change sensitive objects, grant access, or control domain-joined systems.
- Excessive group membership and nested privileges
- AD object access control lists (ACLs) and ownership
- Writable Group Policy Objects (GPOs) and linked scripts
NTLM relay & lateral movement
Test whether one compromised system or account could open access to others.
- NTLM relay and authentication coercion exposure
- SMB signing, LDAP signing, and channel binding
- Credential reuse, pass-the-hash, and remote administration paths
Delegation, trusts & replication
Follow privilege escalation paths toward domain control and across trust boundaries.
- Unconstrained, constrained, and resource-based delegation
- Domain and forest trusts, including SID filtering
- Excessive replication rights that could allow DCSync
Extend the scope to your identity infrastructure
When included in your proposalAD Certificate Services (AD CS)
Certificate templates, enrollment permissions, certificate authority settings, and enrollment endpoints that could enable impersonation or privilege escalation.
Microsoft Entra ID & hybrid identity
Entra Connect, synchronization accounts, federation, and privileged access paths between on-premises AD and your cloud identity environment.
You receive evidence, business impact, and prioritized fixes. Password attacks, changes to AD objects, and other intrusive validation follow agreed limits and testing windows.
Get an AD testing quote
Testing that fits how you operate
Remote access.
Or boots on the ground.
Remote AD penetration testing
Through a secure VPN or internal test host, with access and testing windows agreed in advance.
On-site AD penetration testing
At your premises worldwide, with travel and site access agreed in advance. Internal network and wireless testing can be scoped alongside AD.
Evidence for the people who need it
Proof of testing.
Ready to share.
-
Certificate for your cyber insurer
A completion certificate you can submit to your cyber insurance provider after the AD pentest.
-
Findings for your IT team
Documented attack paths, technical evidence, and an executive summary.
-
A practical remediation plan
Prioritized fixes and a results walkthrough. Retesting is defined in your proposal.
blacksight.
Security assessment
Certificate
of completion
Active Directory penetration testing
Prepared for
Your organization
Scope
Agreed AD environment
Assessment date
Your engagement dates
Approved
With observations
Example assessment
BlackSight LLC
Documented assessment.
Issued by BlackSight.
AD testing pricing
Get a price for
your AD pentest.
Request a quote for manual Active Directory testing. We’ll follow up to confirm the scope and price. No technical details needed to get started.
Want to discuss pricing first?
Discuss pricing with an expertFrom the blog
Active Directory security briefings
Recent attack reports and authentication changes, with practical checks for your IT team.
Report:
A Fake IT Support Call Can Become an Active Directory Incident
Microsoft's September 2026 investigation connects fake IT support to AD reconnaissance and lateral movement. Learn which internal boundaries to test.
Read the analysisUpdate:
Kerberos RC4 Hardening: What to Check After the July 2026 Updates
July 2026 updates remove the Kerberos RC4 audit-mode rollback. Review service accounts, AES compatibility, and remaining exceptions in Active Directory.
Read the analysisAnnouncement:
Microsoft's NTLM Retirement Roadmap: Build Your AD Migration Plan
Microsoft's 2026 NTLM roadmap gives AD teams a reason to audit legacy authentication. Map dependencies, test Kerberos, and plan changes without blind spots.
Read the analysisBefore we test your Active Directory.
Who performs our Active Directory penetration test?
Experienced BlackSight specialists carry out manual testing of your agreed AD environment, validate attack paths, and document the evidence and remediation priorities.
What is Active Directory penetration testing?
Our specialists manually investigate whether an attacker could turn a standard domain account or internal network access into greater access. We validate attack paths within your authorized scope and report evidence, impact, and fixes.
What do you test during an Active Directory pentest?
We assess AD misconfigurations, domain controller hardening, exposed credentials, service accounts, Kerberos attacks such as Kerberoasting and AS-REP roasting, NTLM relay, lateral movement, AD object permissions, Group Policy, delegation, trusts, and replication rights that could allow DCSync. Coverage and validation techniques depend on the agreed environment and scope. AD Certificate Services and Microsoft Entra ID or hybrid identity can be included explicitly.
Do we receive a certificate for our cyber insurance?
Yes. After your AD pentest, BlackSight provides a completion certificate you can submit to your cyber insurance provider, alongside your assessment report. Share any insurer-specific evidence requirements during scoping so we can confirm what the engagement will document.
Can you test Active Directory remotely?
Yes, through an agreed secure connection such as a VPN and an internal test host. We confirm access, accounts, and testing windows together. Domain controllers do not need to be exposed to the public internet.
When should we choose on-site testing?
Choose on-site testing when access must stay local or your scope includes work across locations and network segments. We travel worldwide and agree site access and travel costs in your proposal.
How is this different from an Active Directory health check?
A health check reviews configuration and operational health. A pentest investigates how weaknesses combine into attack paths and validates their impact within agreed boundaries.
Does the assessment include Microsoft Entra ID or AD Certificate Services?
These can be included when explicitly scoped. AD CS testing covers certificate templates, enrollment permissions, certificate authority settings, and enrollment endpoints. Hybrid identity testing can cover Entra Connect, synchronization accounts, federation, and privileged access paths between AD and Microsoft Entra ID.
How much does an AD penetration test cost?
Your quote depends on domains and forests, access, testing depth, delivery, and travel. We confirm pricing, timing, deliverables, and any retesting before work begins.
What access do you need, and how do you protect operations?
We agree starting access, systems, exclusions, testing windows, and escalation contacts with your team. A standard domain account can support an assumed-breach scenario. Privileged access and disruptive techniques require separate agreement.
Scope your AD assessment
Need broader coverage? Explore our penetration testing services.