Active Directory Security Assessment and Hardening

No, and we put that in writing because the distinction has teeth. A penetration test exploits weaknesses to demonstrate impact and often carries accreditation requirements (for compliance frameworks or insurers). This assessment analyzes your directory's configuration against the same attack paths a competent attacker would use — without exploitation — and tells you what to fix in what order. If your obligation says 'penetration test by a certified firm', commission exactly that; many clients run this assessment first so the pen test they pay for finds interesting things instead of a stale krbtgt password.

The full assessment of one forest and domain across all the listed areas, the scored findings report, the prioritized hardening roadmap, the admin-tiering roadmap, the agreed quick-win fixes implemented during the engagement, and both readout sessions — executive and technical. Fixed price, quoted in writing before we start; you pay after you approve delivery. Multi-domain or multi-forest scopes are agreed and priced at scoping, not discovered in week two.

The krbtgt account's password signs every Kerberos ticket in the domain. If it has not been rotated in years — common, because rotation is scary without a procedure — then anyone who ever extracted its hash can mint golden tickets that impersonate any user, indefinitely, surviving every other password reset you do. The assessment reports its age and hands you Microsoft's supported double-reset procedure with the timing caveats, so rotation becomes routine hygiene instead of folklore.

Tiering separates control of the directory itself (Tier 0: domain controllers, privileged accounts, and everything that can reach them) from server and workstation administration, so a phished helpdesk account can no longer become Domain Admin by lunchtime. Full enforcement touches accounts, workstations, policies, and habits — it is weeks of change management, not an afternoon, and pretending it fits inside an assessment would shortchange both. You get a staged roadmap sized to your team, with stage one concrete enough to start immediately; implementation is separately scoped if you want our hands on it.

The assessment itself is read-oriented collection and analysis — it changes nothing. The only changes made during the engagement are the quick wins, and those are: agreed with you item by item beforehand, low-risk and reversible by design, and executed through your change process with before/after state documented. Anything with real breakage potential is explicitly routed to the roadmap instead.

Time-bound, least-privilege access that you create and you disable afterward — the same discipline we publish for our Microsoft 365 engagements. Collection runs with read-oriented rights; certain checks that need elevation are agreed explicitly and individually. We never ask for standing Domain Admin, and if a provider assessing your directory does, that is itself a finding.

Often, yes — third-party findings tell you that a problem exists; this assessment tells you why, what else sits in the same category, and in what order to fix it all without breaking authentication for a plant floor at 2 a.m. Bring the report: we map our findings to theirs, close the overlap, and give your insurer or auditor a documented remediation plan, which is frequently what they actually wanted.

Because 'eventually' is the attacker's favorite word. As long as domain controllers authenticate your users, AD is your security foundation, and a compromised domain also compromises everything it syncs to — including your Microsoft 365 tenant via the identities it masters. Harden what you run today; and if cloud-only is the genuine direction, we will say so in the readout and point you at a planned Entra ID transition rather than selling you hardening forever.

The documented, repeatedly-breached routes: privilege escalation through group nesting and ACLs, DCSync rights outside domain controllers, kerberoastable service accounts, AS-REP roasting, unconstrained and resource-based delegation abuse, NTLM relay exposure via missing signing and channel binding, credential artifacts in SYSVOL, exploitable AD CS template configurations, stale privileged accounts, machine-account quota abuse, and trust misconfigurations, among others. The methodology is attack-path-first: we report what an adversary could chain together in your domain, not an alphabetical list of settings that differ from a benchmark.

Both, in the only order that works: tooling collects and correlates at a scale no human can, then an engineer verifies, contextualizes, and scores every finding that makes the report. What you will not get is a raw tool export with a cover page — a finding only appears if a person confirmed it is real in your environment and understood what it enables.

We stop assessing, tell you immediately through the agreed contact, and help you engage a proper incident-response process — preserving evidence rather than trampling it. An assessment quietly upgraded into incident response serves neither purpose well, and you deserve to know the moment the engagement changes character.

Sequence and product. This is the fixed-fee assessment: two weeks, a scored report, a roadmap, a tiering plan, and the agreed quick wins — you know exactly what it costs and what you get. The hardening service is the remediation arm: hourly engineering that executes roadmap items across your broader on-premises environment. Assessment first is the honest order; buying remediation hours before anyone has scored the risks is how budgets get spent on the wrong fixes.

Annually as a baseline, and after anything that reshapes the directory: a merger or acquisition, a domain migration, major delegation changes, or turnover in privileged staff. Directories drift toward entropy — group memberships grow, exceptions outlive their reasons — and the second assessment is typically faster and cheaper to act on because the roadmap infrastructure already exists.