Active Directory penetration testing

Active Directory is the system that decides who your company is. It is also the system most Canadian companies have never had anyone attack on purpose, which is why a first engagement so often ends with the tester holding the keys to everything.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

An Active Directory penetration test in Canada costs roughly $12,000 to $35,000 CAD and takes five to ten tester days. It is normally bought as the internal, assumed-breach half of a network penetration test rather than as a product with its own name on the invoice. The tester starts where a phished employee starts, with a domain-joined workstation and one ordinary user account, and tries to reach domain administrator. Against a forest that has grown since 2012 and has never been tested, that path is usually short.

What an Active Directory penetration test actually covers

The engagement is not a scan of your domain controllers. Patch level barely features. The tester is looking for the accumulated permissions, trusts and legacy settings that let one ordinary account become another, and then another, until one is privileged. That chain is the deliverable. A finding that says "user JSMITH can read the password of the account that runs the backup service, which is a member of Domain Admins" is worth more than a hundred CVE lines. It describes something an attacker will do.

Three artefacts come out of a good engagement: the path itself with every hop reproducible, a graph of the privilege relationships the tester found, and a remediation order that says which single change breaks the most paths. The last one saves the most money and is the one buyers under-value. Active Directory findings are rarely independent of each other.

What it is not

It is not a red team assessment. A red team measures whether your detection and response notice an intruder, under stealth constraints that cost time and therefore coverage. An Active Directory test is loud on purpose. You are buying map coverage, not a fire drill. Buying the red team first, before the domain has ever been tested openly, wastes money proving something a week of open testing would have shown you.

The attack paths a tester will try

Most of these need no exploit and no malware. They are features of the protocol or of a configuration somebody chose years ago for a reason that has since expired.

Kerberoasting

Any authenticated user can request a service ticket for any account that has a service principal name, and that ticket is encrypted with the service account's password hash. The tester takes it away and cracks it offline. Old service accounts with human-chosen passwords and no rotation are the reason this still works.

AS-REP roasting

Accounts with Kerberos pre-authentication disabled hand out a crackable blob to anyone who asks, without any credentials at all. The setting is usually a leftover from an integration that needed it in 2015.

NTLM relay

The tester coerces a machine into authenticating to them, then forwards that authentication somewhere useful. It works where SMB signing is not required and where channel binding is not enforced, which on a default-built member server is the normal condition rather than the unusual one.

Certificate services abuse

If you run Active Directory Certificate Services, a template that lets a low-privileged user request a certificate on behalf of someone else is a direct route to domain administrator. The SpecterOps research that named these patterns catalogued ESC1 through ESC8, and later work has extended the list well past that. ADCS is the single highest-yield area in most engagements because it is installed once, by someone who has moved on, and never reviewed.

Delegation abuse

Unconstrained delegation on a member server means any account that authenticates to it leaves a usable ticket in that server's memory, including a domain controller's. Resource-based constrained delegation can be written by anyone holding the right permission on a computer object, and that permission is handed out more often than people think.

Passwords sitting in the domain

Group Policy Preferences passwords, encrypted with a key Microsoft published, still turn up in SYSVOL in domains that have been through a migration. Descriptions and comments on user objects still contain passwords. Both are readable by every authenticated user.

The order the tester works in

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Why these are design problems, not missing patches

Almost nothing in the list above is fixed by patching. Kerberoasting is fixed by using group managed service accounts so the password is 120 characters and rotates itself. Relay is fixed by requiring SMB signing everywhere and turning off the legacy authentication paths. Certificate template abuse is fixed by reviewing who may enrol for what. Delegation is fixed by removing it and, where it is needed, constraining it.

Every one of those is a change to how the directory is designed, which is why Active Directory findings have a long remediation tail. A web finding is a code change that ships on Thursday. A tiering model is a project. Budget for that when you plan the retest window: a thirty-day retest clause is generous for an application and unrealistic for a directory rebuild. The retest planner gives you the last day your fixes can ship and still be verified for free.

How to scope one

Give the tester one standard domain user account and a domain-joined machine, and nothing else. That is the assumed-breach position, and it is where a real attacker starts after phishing one person. Do not give them an administrative account to save time. The time they spend finding the path is the product.

Say how many domains and forests you have, whether there are trusts to partners or to acquired companies, how many domain controllers, whether ADCS is deployed, and whether you are hybrid-joined to Entra ID. Each of those changes the day count. Trusts in particular do: a two-way trust with a company you bought in 2019 means their directory is part of your attack surface whether you think of it that way or not. The method is on how to write a penetration test scope, and the questions to put to the firm before you sign are on questions to ask a penetration testing vendor.

Testing runs against production. There is no staging copy of a directory with fifteen years of accumulated permissions in it. That makes the rules of engagement document matter more here than almost anywhere else. Agree in writing that the tester will not disable accounts, will not modify group membership outside a named test account, and will tell you immediately if they obtain domain administrator rather than continuing quietly.

When you should not buy this

If you have no on-premises domain, this engagement is not for you and a firm that sells it to you anyway has not asked enough questions. A company entirely on Entra ID or Google Workspace, with laptops managed by Intune or Jamf and no domain controller anywhere, has a different problem: conditional access policy, token theft, OAuth application consent and the permissions granted to third-party apps in your tenant. That is a cloud identity review, and it belongs next to cloud penetration testing rather than here.

The other case is the company that already knows the answer. If your domain has never had a password policy stronger than eight characters, has service accounts in Domain Admins, and has a dozen unmanaged servers running Windows Server 2012 R2, you do not need $20,000 CAD of evidence to establish that. Spend it on the tiering project and test afterwards, when the report will tell you something you did not already know. Buying the test first buys an expensive confirmation.

If the reason you are here is a compliance clause rather than a worry about your directory, check what the clause says first. Neither SOC 2 nor ISO 27001 names Active Directory testing. Both want evidence that you identify technical vulnerabilities and act on them, and an internal network test that includes the directory satisfies that at a lower price.

Common questions