B2: Enterprise Deep Ops
Active Directory Deep: DCSync, Relay, Tickets & Delegation
How enterprise identity breaks: replication rights, NTLM relay, Kerberos abuse, and delegation risk.
Open the interactive lesson & lab →
Active Directory is the center of most enterprise compromises. A top-tier pentester does not memorize tool commands first; they understand identity, trust, authentication, and which permissions create domain-level impact.
| Area | What to understand | Defensive question |
|---|---|---|
| DCSync | Directory replication rights can let an account request password material like a domain controller. | Who has Replicating Directory Changes permissions? |
| NTLM Relay | Unsigned or weakly protected protocols can accept relayed authentication. | Where are SMB signing, LDAP signing, and EPA enforced? |
| Kerberos Tickets | Golden and Silver ticket abuse depends on key material, service scope, and ticket validation. | How are krbtgt rotations and service account hygiene handled? |
| Delegation | Unconstrained, constrained, and resource-based constrained delegation can create lateral paths. | Which principals can impersonate users to sensitive services? |
| AD CS | Certificate templates and enrollment rules can become alternate paths to authentication. | Which ESC paths are present and who can enroll? |
- Build a graph of users, groups, computers, sessions, ACLs, trusts, certificate templates, and delegation settings.
- Prioritize paths that produce business impact: domain admin, tier-0 assets, sensitive data stores, and identity infrastructure.
- Validate only inside written scope and prefer proof that demonstrates control without unnecessary disruption.
- Translate every path into a fix: permission cleanup, protocol hardening, tiering, monitoring, and credential rotation.