Path to Domain Admin: three misconfigurations in one chain
Illustrative case study: how three individually minor misconfigurations take a standard user account to full domain takeover, and which fix closes the path.
- Environment
- Test environment: Windows domain, domain controller, AD CS, clients
- Starting point
- Assumed breach, one standard domain user account
- Type
- Internal network penetration test
- Methodology
- PTES, MITRE ATT&CK
1. Executive summary
The assessment examined an Active Directory (AD) domain using the "assumed breach" approach: we started from a single unprivileged domain user account, assuming an attacker had already obtained such access, for example through phishing. During the engagement, a combination of three individually medium-rated misconfigurations led to full domain takeover (domain administrator privileges).
The key lesson is not that any single issue is exotic, but that they can be chained: all three weaknesses are common in production and are each often deferred as "we\'ll get to it". Together they form a path on which an attacker can reach the highest privilege within a few hours, undetected. The report included a step-by-step "path to Domain Admin" diagram for management.
2. Scope and starting assumptions
| Item | Value |
|---|---|
| Environment | Windows Server domain controller, Active Directory Certificate Services (AD CS), member servers and Windows clients in a single forest |
| Starting access | A standard domain user account with no group membership and a domain-joined workstation |
| Type | Internal network penetration test (grey-box) |
| Exclusions | Denial-of-service testing, phishing of end users, systems outside the test environment |
3. Methodology
The assessment followed the PTES (Penetration Testing Execution Standard) and NIST SP 800-115, mapping observed techniques to the MITRE ATT&CK framework. The work comprised the following phases:
- Discovery. Enumerating domain objects through built-in directory queries: users, groups, service accounts, trusts, certificate templates. Only read operations were performed in this phase.
- Path analysis. Building a graph of privilege relationships from the collected data and identifying the shortest paths from the starting account towards privileged access.
- Controlled validation. Practical but careful validation of the candidate paths, in a way that did not endanger production, logging every step.
- Impact analysis and reporting. Determining business impact, rating the findings and producing a prioritised remediation plan.
4. Findings
Severity combines the CVSS v3.1 base score with business context. In chain terms the three findings build on each other: medium risk individually, critical together.
F-01 — Kerberoasting-exposed service accounts with weak passwords
| Severity | High (CVSS 8.1) |
| Weakness | CWE-262 (not using password aging), CWE-522 (insufficiently protected credentials) |
| Technique | MITRE ATT&CK T1558.003 — Kerberoasting |
Description. Several service accounts had a service principal name (SPN), so any authenticated domain user could request a service ticket for them containing material derived from the account\'s password that can be cracked offline. Because the affected accounts used short, dictionary-based passwords that had not changed for a long time, offline cracking was feasible within a realistic timeframe. One affected account was a member of a group with higher privileges than the starting account.
Root cause. Service accounts using human-set passwords without rotation or strength requirements, with unnecessarily high group membership.
F-02 — Misconfigured certificate template (AD CS)
| Severity | High (CVSS 8.8) |
| Weakness | CWE-732 (incorrect permission assignment for a critical resource) |
| Technique | MITRE ATT&CK T1649 — Steal or Forge Authentication Certificates; ESC-class AD CS misconfiguration |
Description. One issued AD CS certificate template simultaneously allowed (a) a relatively broad, non-administrative set of principals to request a certificate, and (b) the requester to specify the certificate subject. This combination belongs to the publicly documented family of AD CS misconfigurations known as "ESC", and allows a requester to obtain a valid certificate for an identity more privileged than their own and then authenticate with it. The domain certificate service is a tier-0 system, so such a flaw directly enables privilege escalation.
Root cause. Certificate template permissions and settings left in a default or overly permissive state without review.
F-03 — Missing segmentation and insufficient security logging
| Severity | Medium (CVSS 6.5), aggravating in the chain |
| Weakness | CWE-778 (insufficient logging), lack of network segmentation |
| Technique | Defensive gap (detection and isolation) |
Description. The administrative and user network segments were not separated, administrators used the same accounts for daily and privileged tasks, and critical directory and certificate operations generated no alerts. As a result, no step in exploiting F-01 and F-02 triggered detection or an obstacle. This finding grants no access on its own, but multiplies the impact of the other two by letting the attacker remain unnoticed.
5. The attack chain from a business perspective
The three findings formed the following high-level path: the starting unprivileged account reached the level of a higher-privileged service account via F-01; from there, exploiting F-02, a valid certificate for a privileged identity could be obtained through the domain certificate service; and this resulted in domain administrator access. Because of F-03, all of this happened without detection.
At that level a real attacker could reach all domain data, disable defences, establish persistence and launch a domain-wide ransomware attack. Once domain administrator privileges are obtained, recovery typically means rebuilding the entire domain, with downtime measured in days and significant cost.
6. Detection opportunities
Every element of the chain could have been detected with appropriate logging and alerting:
- F-01: an unusual number of weak-encryption service ticket requests from a single account (Windows security event 4769), or anomaly detection on service tickets.
- F-02: monitoring certificate authentication requests (AD CS events 4886/4887), especially where the certificate subject differs from the requester, and auditing changes to templates.
- F-03: centrally collecting and correlating privileged group membership changes, replication operations on domain controllers and access to tier-0 systems (SIEM).
7. Recommendations and prioritisation
| Priority | Action | Finding |
|---|---|---|
| 1 — immediate | Restrict the permissions of the misconfigured certificate template and disallow requester-supplied subjects where not justified; treat AD CS as a tier-0 system | F-02 |
| 2 — short term | Move service accounts to group managed service accounts (gMSA) or long random passwords; remove unnecessary SPNs and excessive group memberships | F-01 |
| 3 — medium term | Separate administrative and user environments (tier model) with dedicated admin accounts; centrally log and alert on critical operations | F-03 |
After remediation we performed a free retest and confirmed that the original path from the starting account was no longer viable: the certificate template no longer issued a valid certificate for a higher-privileged subject, the service account passwords were no longer crackable offline, and privileged operations generated alerts.
8. Lessons
A single issue labelled "critical" rarely decides the outcome of an intrusion. Real risk usually comes from several individually medium-rated weaknesses combined, which is why we always assess findings as a chain, and why the "path to the objective" diagram makes this visible to management. Prioritisation therefore follows not simply the highest CVSS score, but which single fix breaks the chain with the least effort — in this case restricting the certificate template.