How to protect Active Directory from ransomware and lateral movement attacks

By the QuantumSec team

Active Directory (AD) is the heart of identity infrastructure in most companies running Windows environments. It's also the number-one target for ransomware groups: compromising the Domain Controller is equivalent to compromising the entire organization. This technical guide explains why AD is attacked so heavily and which critical configurations you should review.

Why attackers go after Active Directory

Active Directory manages authentication and authorization for the entire organization. Whoever controls AD controls every domain-joined system: file servers, business applications, email, ERPs, backup systems. The most sophisticated ransomware groups (Conti, LockBit, BlackCat) spend between 70% and 90% of their attack time compromising AD before encrypting systems, because from a compromised Domain Controller they can deploy ransomware across the entire network in minutes.

Most common attack techniques against AD

Kerberoasting: requesting Kerberos service tickets for service accounts with SPNs and cracking them offline to obtain their plaintext passwords.

Pass-the-Hash (PtH): reusing NTLM hashes captured from memory to authenticate without knowing the password.

AS-REP Roasting: targeting accounts without Kerberos pre-authentication required to obtain crackable hashes.

DCSync: simulating domain controller behavior to replicate credentials for all users, including the krbtgt hash to create Golden Tickets.

BloodHound: mapping AD trust and delegation relationships to find privilege escalation paths that aren't obvious.

Critical configurations you should review now

Accounts with excessive privileges: identify every account that's a member of Domain Admins, Enterprise Admins and Schema Admins. They should be minimal and reserved for AD administration only, never daily use.

Service accounts without password management: implement Managed Service Accounts (gMSA) to eliminate static, long-lived service passwords that are a Kerberoasting target.

Unconstrained Delegation: a legacy configuration that allows any service to authenticate as any user. You should review it and migrate to Constrained Delegation or Resource-Based Constrained Delegation.

AdminSDHolder and SDProp: verify which objects are protected by AdminSDHolder and whether there are unexpected accounts with blocked inheritance.

LSASS protection: enable Credential Guard and the Protected Users security group to make credential dumping from memory harder.

Tier model: the architecture that changes everything

Microsoft recommends the tiered administration model (Tier Model). The concept is simple: Tier 0 administration accounts (Domain Controllers, PKI, AD) are never used on Tier 1 or Tier 2 systems (application servers, workstations), and vice versa. If a Tier 2 system is compromised, the attacker can't use the captured credentials to move laterally into Tier 0. Correctly implementing the Tier Model is what most complicates an attacker's job.

Detection and monitoring

Hardening isn't enough without detection. Configure advanced AD auditing to log: changes to privileged group membership, creation of privileged accounts, changes to critical GPOs, service account logins outside their usual systems. Attack techniques like DCSync, Golden Ticket and AS-REP Roasting generate specific Windows events that should alert in your SIEM. If you don't have a SIEM, at least enable event forwarding from the DC to a protected log server.

FAQ

Can an Active Directory pentest be run without disrupting operations?

Yes. AD pentesting uses low-impact techniques during reconnaissance and exploitation. The more aggressive tests (such as DCSync or GPO modification) are coordinated in advance and run in agreed maintenance windows.

What tools does a pentester use to audit Active Directory?

The most commonly used in a professional pentest: BloodHound/SharpHound for mapping relationships and attack paths, Impacket for Kerberos authentication techniques, PowerView/PowerSploit for AD enumeration, Mimikatz (in a controlled environment) to validate credential extraction, and CrackMapExec for validating lateral movement.