Identity / Sub-service 01
Active Directory security assessment.
Find the paths. Fix them. Prove they're closed.
Most Active Directory environments were never set up securely, and haven't been checked since they were built. We find how an attacker would get from one user account to your whole domain, fix it, and re-test to show the paths are gone. On-premises, in Entra ID, or both.
Service detail
Three tiers. Every one ends with the fixes made.
Start with a read-only health audit, add authorized attack-path testing, or cover on-premises Active Directory and Entra ID together. Each tier includes remediation, a re-test, and a one-page owner summary, not just a report. Pricing is scoped on a call.
Tier 1 · Active Directory health audit (read-only)
- ›Forest and domain functional levels
- ›Domain controller inventory, replication health, FSMO role placement
- ›Schema extensions, OU structure, GPO sprawl and orphaned objects
- ›Privileged group membership (Domain Admins, Enterprise Admins, Schema Admins)
- ›Service account inventory and password hygiene
- ›DNS integration, Sites and Services topology, audit log configuration
- ›Tier-0 protection posture
Tier 2 · Active Directory attack-path review (authorized testing)
- ›Everything in Tier 1
- ›Start from an ordinary user account, the way an attacker would after one phished password
- ›Map and test the routes to Domain Admin: Tier-0 exposure and admin sprawl
- ›Kerberoastable service accounts and weak Kerberos settings
- ›Unconstrained, constrained and resource-based delegation
- ›Certificate-template abuse in Active Directory Certificate Services
- ›Control paths through GPO and object permissions, and local admin password reuse
- ›Written rules of engagement: scope, accounts, windows and stop conditions
Tier 3 · Hybrid Active Directory + Entra ID / Microsoft 365
- ›Everything in Tier 2
- ›Privileged Entra ID roles and standing admin access
- ›Conditional Access gaps and accounts it doesn't cover
- ›App registrations, enterprise apps and high-privilege consents
- ›The sync server and hybrid identity setup, treated as Tier 0
- ›Paths that cross between on-premises Active Directory and Microsoft 365
Included in every tier
- ›Remediation: we implement the fixes, in a safe order, through your change process
- ›Re-test: we re-run the tests and show which paths are closed
- ›Owner summary: one page in plain English for the owner or board
- ›Technical report and a current-state diagram for your IT team
- ›Hand-off: the tool accounts, logins and raw results, all in your organization's name
- ›The same senior engineer from scoping to re-test
Who does the work
One senior engineer, start to finish.
Pro IT NW is a labor-only Microsoft shop. We don't sell managed services, resell licences or take commissions, so the assessment has nothing to sell you at the end. The engineer who scopes it does the testing, the fixes and the re-test: 30 years of Active Directory work, and an active Hack The Box competitor who practices the attacker's side. This is technical and operational work, not legal advice.
Related reading
Further reading on Active Directory security.
- Your PingCastle score is red: what to fix first — how the score works and a safe fix order.
- AD Tier-0 in 90 Days: Mid-Market Edition — the 12-week plan, the four primary controls, and the simplifications that make the model fit a 100–500-user shop.
- Kerberos RC4 enforcement: mid-market triage — what breaks and how to inventory it first.
- Your RMM is Tier 0 — questions to ask the provider whose tool can reach every machine.
FAQ
Common questions about Active Directory security assessments.
What is an Active Directory security assessment?
An Active Directory security assessment checks how an attacker could move from an ordinary account to control of your domain, and how healthy and well-run the directory is underneath. We offer it in three tiers: a read-only health audit, an authorized attack-path review that actually tests the paths, and a hybrid review that adds Entra ID and Microsoft 365. Every tier ends with the fixes made, a re-test, and a plain-English summary for the owner.
What does an Active Directory audit include?
The health audit tier covers forest and domain functional levels, domain controller inventory and replication health, FSMO role placement, schema extensions, OU and GPO hygiene, privileged-group membership (Domain Admins, Enterprise Admins, Schema Admins), service-account inventory and password hygiene, DNS integration, AD Sites and Services topology, audit log configuration, and Tier-0 protection posture. It is read-only.
How is the attack-path review different from the audit?
The audit tells you what is misconfigured. The attack-path review proves which misconfigurations chain together into a working route to Domain Admin, by testing them under written rules of engagement: Tier-0 exposure, Kerberoastable service accounts, delegation, certificate-template abuse in Active Directory Certificate Services, and permissions on GPOs and objects. You see the paths that are real, not a list of hundreds of findings.
Is active testing safe to run in our production environment?
It's done only with written authorization that sets the scope, the accounts we start from, the testing windows, and when we stop. We coordinate with whoever runs your environment, avoid destructive actions, and stop and call you if anything behaves unexpectedly. If you'd rather not test actively, the health audit tier is read-only.
Do you assess Entra ID and Microsoft 365 too?
Yes, in the hybrid tier. Most organizations sync on-premises accounts into Microsoft 365, so a path that starts in Active Directory can end in the cloud and the other way round. We review privileged Entra roles, Conditional Access gaps, high-privilege apps and consents, and the sync server and hybrid identity setup, alongside the on-premises paths.
How do you get access, and who owns the tools and results?
You give us a dedicated account in your own domain. Any assessment tools are registered under your organization's name and run inside your environment, so nothing is tied to our accounts and nothing of yours is mixed with another client's. At hand-off you get the logins, the raw results and the reports. It's your data, and you can re-run or review it yourself.
Do we just get a report?
No. Every tier includes the remediation: we make the fixes, in a safe order and through your change process. Then we re-run the tests to show the paths are closed. You get a one-page plain-English summary for the owner or board, plus the full technical report for your IT team.
How is it priced?
It's scoped on a call. The work depends on the number of domains and trusts, the size of the directory, and whether Microsoft 365 is in scope, so we agree a fixed scope in writing before anything starts.
When was Active Directory last tested like an attacker would?
If the answer is 'never', start with a call. We'll scope the right tier and come back with a written plan.