Active Directory and internal penetration testing

Ransomware often starts with a single compromised workstation. What happens next depends on how solid your internal network and Active Directory are. I measure how far an attacker could get from a standard user account, and tell you what to fix first.

What I assess

Rights and delegations: Over-privileged accounts and groups, forgotten delegations, service accounts.
Directory configuration: Password policies, legacy protocols, related directory services.
Workstations and servers: Patching, local administrator accounts, file shares.
Segmentation: What a user workstation can reach on the network.
Sensitive data: What a standard account can read: shares, backups, documents.
Detection: If you have an EDR or a SOC, what they saw during the audit.

How I work

Realistic starting point: one workstation and a standard user account, on-site or through remote access.
Methodology based on PTES and ANSSI’s Active Directory recommendations.
No destructive actions: no denial of service, no production changes without explicit approval.

Full methodology and deliverable

What you get

A PDF report: executive summary, then one entry per vulnerability (proof, CVSS score, impact, fix).
A debrief meeting with your technical team.
A retest of your fixes, offered in the quote.

FAQ

Frequently asked questions

Do you need to be on-site?

Not necessarily. A workstation or small virtual machine on your network, reachable remotely, is enough in most cases. On-site visits are possible.

How is this different from an automated AD audit tool?

A tool lists configuration gaps. A pentest checks which ones are actually exploitable and how they chain together, so you can prioritise fixes instead of working through a 200-item list.

Is it risky for production?

Tests are chosen not to disrupt production, and anything that could have an impact is approved with you first. A technical contact stays reachable throughout the audit.

Another question? Send me a message