Active Directory Security Audit

What is an Active Directory Security Audit?

An Active Directory Security Audit is a deep analysis of AD configuration, permissions, and vulnerabilities — the central identity management system in most organizations. It covers AD structure analysis, GPO policies, RBAC permissions, Kerberos configuration, delegations, group membership and privilege escalation paths (attack paths).

Attribute	Value
Tools	BloodHound, PingCastle, Purple Knight
Scope	Configuration, permissions, attack paths
Duration	1-4 weeks
Deliverable	Attack path map + hardening roadmap

Active Directory is the heart of IT infrastructure — it controls access to all resources. AD compromise means full takeover of the organization.

Hidden paths to Domain Admin

AD environments grow organically over the years: accounts, groups, delegations, GPOs are added — but rarely cleaned up. Over time, a complex web of permissions emerges with hundreds of non-obvious escalation paths. An administrator with permissions to a single server can, through a chain of delegations, obtain Domain Admin.

Without an AD audit:

• You don’t know the privilege escalation paths to Domain Admin
• Service accounts vulnerable to Kerberoasting remain unsecured
• Unconstrained delegation enables TGT ticket theft
• Excessive permissions accumulate for years without verification
• You don’t meet NIS2/ISO 27001 requirements for identity management

BloodHound + nFlo experts = complete threat map

We use specialized tools (BloodHound, PingCastle, Purple Knight) to analyze attack paths and AD configuration. We manually verify: GPO, delegations, group membership, Kerberos, trusts. We identify Tier 0 assets and verify their protection.

What you get:

• Attack path map (BloodHound): privilege escalation visualization to Domain Admin
• AD security scoring: PingCastle assessment with benchmark comparison
• Technical report: AD configuration, GPO, delegations, Kerberos, trusts, attack paths
• Permissions audit: group membership, delegations, service accounts, admin accounts
• AD hardening plan: Tiered Administration, GPO hardening, Kerberos hardening, monitoring
• IT workshop: attack path demonstration and remediation walkthrough

Microsoft 365 and Entra ID tenant compromise review

Microsoft describes token theft as an attack in which a threat actor replays tokens issued to a user — even if that user has completed multifactor authentication (MFA). Microsoft Threat Intelligence has documented a campaign in which attackers, after hijacking a session, created inbox rules that hid correspondence with the fraud target, and, according to Microsoft, the Storm-2372 group registered actor-controlled devices in Entra ID. That is why the audit checks your organization’s tenant for the traces that the Microsoft playbook lists as signs of persistence:

• Sessions and tokens: traces of token replay after a successful MFA sign-in (sign-ins from unusual locations and devices), and whether Conditional Access uses Token Protection, which according to Microsoft is meant to reduce token replay attacks
• Devices: devices registered or joined to Entra ID that your organization does not recognize
• MFA methods: authentication methods added or changed without the user’s knowledge
• Mailbox rules: rules that forward, move or delete mail, and automatic forwarding to external domains — the CISA SCuBA baseline for Exchange Online requires automatic forwarding to external domains to be disabled
• Conditional Access: exclusions, exceptions and coverage gaps in policies
• Roles and permissions: privileged role assignments and consent granted to applications — the CISA SCuBA baseline for Entra ID requires user consent to applications to be restricted

The review is part of the STANDARD and ADVANCED packages if your organization uses Microsoft 365 and Entra ID. Findings go into the audit report and remediation plan. If the review reveals traces of an active compromise, we recommend launching your incident response procedure.

For organizations that need only a tenant review, without an audit of on-premises Active Directory, we offer a separate service: the Microsoft 365 and Entra ID security review.

Who is this for?

This service is for you if:

• You have an Active Directory environment and want to assess its security
• You’re planning an AD migration or Azure AD / Entra ID deployment
• You’ve had an internal pentest with AD compromise and want to harden the environment
• You want to implement a Tiered Administration Model
• You need to meet NIS2/ISO 27001 requirements for identity management

Packages

BASIC

1 domain, up to 500 users:

• Basic assessment and enumeration
• Attack path analysis (BloodHound)
• PingCastle scoring
• Remediation roadmap

From €3,500 | 7 business days

STANDARD

1-2 domains, up to 2,000 users:

• Full assessment with attack paths
• Kerberos deep dive (Kerberoasting, AS-REP)
• GPO security review
• Azure AD integration (if applicable)

From €6,500 | 12 business days

ADVANCED

Multi-forest, up to 5,000 users:

• Full attack simulation
• Privilege escalation testing
• Trust relationship analysis
• IT workshop + re-audit after remediation

From €12,000 | 18 business days

Related Glossary Terms

Learn more about key concepts related to this service:

• Active Directory
• GPO
• Kerberos
• NIS2
• OT (Operational Technology)
• Patch
• RBAC
• Server