Active Directory Fundamentals

Detecting Kerberoasting with PowerShell and Logs Kerberoasting is an Active Directory attack technique where an attacker requests Kerberos service tickets (TGS) for accounts that have Service Principal Names (SPNs), then cracks the ticket offline to recover the service account password. Because it uses legitimate Kerberos flows, the key to detection is understanding what…

Mapping Legacy Active Directory Groups to Microsoft Entra Roles Legacy Active Directory (AD) group designs often carry years of historical decisions: “one group per admin team,” “one group per tool,” and the classic “Domain Admins-but-not-really” pattern. In Microsoft Entra ID, the control surface changes: privileged actions are driven by roles (directory…

Purple teaming in an Active Directory (AD) context is the discipline of running controlled, authorized attack simulations (red) while observing, tuning, and validating detection + response (blue). Done well, it turns vague goals like “improve AD security” into measurable outcomes: which attacks did we detect, how fast, with what signal quality, and what changed because of it. This guide…

Using BloodHound to Map Privilege Escalation in Active Directory Privilege escalation in Active Directory (AD) rarely happens as a single “big misconfiguration.” It’s usually a chain: a little too much delegated access here, a leftover admin right there, an ACL that nobody remembers, and suddenly an attacker (or a red team) has a clean path to Domain Admin. …

Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…

Mitigating Unconstrained Delegation Vulnerabilities in Active Directory Unconstrained delegation is one of those “it worked in 2006” features that becomes a high-impact breach path in modern AD environments. This guide gives you a field-ready plan to find it, remove it safely, migrate to better models (constrained delegation / RBCD), and set…

AD Indexing Explained — What Admins Need to Know Active Directory indexing is one of the most overlooked yet critical aspects of directory performance. As AD grows to thousands—or millions—of objects, searches and lookups can slow dramatically if the right attributes aren’t indexed (or if too many are). In simple terms, AD…