Performing Active Directory Vulnerability Assessment

Overview

Active Directory (AD) is the primary identity and access management system in most enterprise environments, making it a critical attack target. This skill covers comprehensive AD security assessment using PingCastle for health checks, BloodHound for attack path analysis, and Purple Knight for security posture scoring. These tools identify misconfigurations, excessive privileges, Kerberos weaknesses, and lateral movement opportunities.

When to Use

• When conducting security assessments that involve performing active directory vulnerability assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Domain-joined workstation or domain admin access for scanning
• PingCastle (https://github.com/netwrix/pingcastle)
• BloodHound Community Edition with SharpHound collector