Overview
In Indian enterprises, Active Directory usually sits behind email, file shares, core applications and sometimes the plant floor, and many domains have grown through acquisitions and handovers between system integrators. We map privilege paths from a standard domain user up to full domain admin rights, review hybrid links to Entra ID and explain each path in terms your IT team or managed service partner can fix. Testing runs remotely in IST working hours.
Active Directory grows by accumulation. Years of groups, delegations, service accounts and permissions build up until an ordinary user, through no single dramatic flaw, has a path to Domain Admin that no one intended or can see. An AD assessment exists to find those paths, because controlling the directory means controlling nearly every system and account that trusts it.
We focus on the abuses that define real intrusions rather than generic misconfiguration. Kerberos weaknesses such as roastable service accounts and unconstrained or resource-based delegation, dangerous access-control entries that let one principal reset another's password or take ownership, over-privileged service accounts, and risky domain and forest trusts are all examined. We model how these combine, because the danger is rarely one setting but a chain of small permissions that together hand over the directory.
Our reporting turns that complexity into action. Alongside scored findings we provide attack-path diagrams that show how initial access becomes domain dominance, mapped to MITRE ATT&CK so your defenders can align detection. Recommendations are prioritised and practical: tiered administration, cleaning up delegation and ACLs, protecting privileged accounts, and the specific changes that collapse the most paths for the least disruption.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Access & enumerationFrom a standard account we collect the directory's objects and relationships.
- Path analysisWe model permissions and trusts to reveal routes toward privileged access.
- Technique testingKerberos, ACL, delegation and credential techniques are tested along those routes.
- Dominance demonstrationWe safely demonstrate the shortest realistic path to domain control.
- Report & debriefAttack-path diagrams, ATT&CK mapping and a prioritised hardening plan are delivered.
What you receive
- Attack-path diagrams from standard account to Domain Admin
- Findings mapped to MITRE ATT&CK with CVSS v4.0 scores
- Review of Kerberos, delegation, ACL and trust risks
- Prioritised tiering and hardening roadmap
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CIS Benchmarks
- CVSS v4.0
- CWE
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
What access do you need for an AD assessment?
A single standard domain user account and network reachability to the domain controllers is enough to begin. Most of the value comes from showing how ordinary access escalates, which is exactly what a low-privileged starting point lets us demonstrate.
Is enumeration safe to run in production?
Yes. The collection techniques we use read the directory in the way ordinary domain-joined systems do and do not change objects. Any technique that could affect accounts or tickets is discussed with you first and run carefully, avoiding disruption.
How is this different from an internal network test?
An internal test covers the whole network and all its services; an AD assessment drills specifically into the identity layer, the permissions, Kerberos, delegation and trusts that turn a foothold into domain control. They complement each other and are often run together.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.