Grown over years
Administrators and providers changed; nobody knows who holds which rights.
Active Directory Security Assessment
Clarity about the system every sign-in depends on.
You learn which paths would let an attacker take over your domain and which fixes come first. We assess and test AD DS, AD CS, Group Policy and Entra Connect and deliver prioritised findings with evidence for auditors.
Example from a findings report, sorted by priority: domain admins sign in on workstations, a certificate template is open to all accounts, a service account has domain rights, all rated high; legacy authentication is still enabled, rated medium. Every finding comes with remediation direction and a mapping to NIS2 and ISO 27001.
- For
- Companies with an on-premises or hybrid Active Directory
- Scope
- AD DS, AD CS, Group Policy, Entra Connect
- Approach
- Written authorisation, read-only inventory
- Result
- Prioritised findings, tiering target model, mapping to NIS2 and ISO 27001
- Price
- from €5,900 excl. VAT, fixed price after scoping
Sound familiar?
When is an AD assessment worth it?
Evidence required
An audit, customer or insurer wants proof of hardening.
Ransomware preparedness
Would one compromised device take the whole domain, and will the backup hold?
Tiering
How far does an attacker get from one workstation?
A typical finding, simplified as an example. Switch the view to see what tiering changes at every tier boundary.
1 A workstation is compromised
For example through a phishing email. The tiering model assumes this will happen.
Tier 2
Workstations and devices
Compromised One device affected
2 Admin credentials on the workstation
A server admin signed in there. Their credentials open the way to the servers.
2 No admin sign-ins on workstations
Admins use separate accounts per tier, and local passwords differ on every device.
Tier 1
Servers and applications
Taken over Protected
3 Service account with domain rights
A service on one server runs with domain admin rights. Whoever controls the server reaches the domain.
3 Tier 0 rights stay in Tier 0
Service accounts get only the rights they need, and domain admins sign in only on Tier 0 systems.
Tier 0
Domain controllers, AD CS, Entra Connect
Domain taken over Protected
Result
The attacker controls every account, server and workstation. The path ends at the first tier boundary.
What do we check in the directory?
Tiering and admin accounts
Tier 0 accounts only on Tier 0 systems, no orphaned rights.
Service and local admin accounts
Passwords that rotate automatically, through group managed service accounts (gMSA) and Windows LAPS.
Legacy authentication
Planned phase-out of NTLM and broadcast name resolution, signing enforced.
Certificate templates in AD CS
No account can issue itself an administrator certificate.
Delegation and Group Policy
Only intended accounts act on behalf of others or change policies.
Entra Connect and domain controllers
Hardened as Tier 0, patched, with recovery rehearsed.
How does the assessment work?
-
In writing
Scope and authorisation
No test without your written authorisation.
-
Read-only
Inventory
Rights and relationships read with an ordinary domain account.
-
Test window
Verify paths
Controlled, within the agreed test window.
-
Report and workshop
Prioritised findings, mapping and a tiering target state.
-
Optional
Re-test
Confirms that the measures work.
Who controls your domain today?
What changes after the assessment?
Today
- Unclear who holds domain rights
- Admins sign in on workstations
- Service accounts with old passwords
- Recovery never rehearsed
Afterwards
- Tier 0 inventory with owners
- Tiering target state with clear order
- Findings mapped to NIS2 and ISO 27001
- Evidence for auditors and insurers
Further reading: Security assessmentsGap assessmentManaged SecurityBlog: Entra ID securityBlog: Ransomware preparedness
Frequently asked questions
Why do we need an AD assessment if we are moving to the cloud?
Because hybrid environments take their identities from on-premises Active Directory. The sync server therefore counts as Tier 0, like a domain controller.
What is the tiering model?
It groups accounts and systems by scope of control: Tier 0 controls identities, Tier 1 servers and applications, Tier 2 workstations. Higher-tier credentials are never used on a lower tier.
How long does an Active Directory assessment take?
It depends on forests, domains and test scope. After the introductory call you receive a binding schedule.
What evidence do we get for NIS2 or ISO 27001?
A report with scope, method and risk rating, a management summary and a mapping to NIS2, ISO 27001 and BSI IT-Grundschutz. An optional re-test confirms the effect.
Have your Active Directory reviewed
Report, data and documentation stay with you.