Active Directory Security Audit

Active Directory Audit, test and audit AD, ransomware defense, second line of defense

Diese Seite ist auch auf Deutsch verfügbar.

An Active Directory Audit is a white-box security assessment of your on-premises Active Directory that identifies misconfigurations, dangerous permissions, and attack paths leading to domain takeover, before an attacker or ransomware can exploit them.

Ransomware attacks are on the rise, and the ones with the highest impact take over the whole Active Directory. We must secure these systems to minimize the risk of having our data encrypted and put up for sale on the internet!

Active Directory delivers extensive functionality; however, its complexity can often lead to security vulnerabilities. Given the critical role it plays in user management, any security flaw can have severe implications, from privilege escalation to full domain takeover.

This audit focuses on on-premise Active Directory. Entra ID (Microsoft’s cloud identity platform) is a different system and is covered by a separate Entra ID Audit.

VidraSec offers services designed to address these challenges head-on. Together, we will develop strategies to fortify your environment against threats.

Scope

This type of test is typically performed as white-box, meaning that the testers receive full access to the tested system and its documentation. This allows a comprehensive analysis of vulnerabilities and misconfigurations in a short time frame. These are the main focus points of the test:

Audit of the implementation status of the tier model and possible vulnerabilities
Review of all accounts and their password age
Review of the permissions of users, computers, and groups
Review of group memberships of highly privileged groups
Interview with administrators on how they typically administer the system
If present: domain and forest trusts
Test for typical vulnerabilities like “Kerberoasting” or (un)constrained delegation

Why

Forgotten, insecure permissions can be a huge security problem, making attacks extremely easy.
These are living systems, and errors occur. Only a regular check can help find them.
Having secure administrative processes makes the lives of the attackers very hard.

For a comprehensive assessment of the on-premise Active Directory, VidraSec recommends conducting this analysis in conjunction with a penetration test of the internal infrastructure. This approach offers a complete overview of your internal systems’ security posture.

Why VidraSec 🦦

I have multiple years of experience attacking and securing Active Directory. If I manage to get Domain Admin permissions after a few days of work, I am sure a real attacker can also do it. Thus, let me demonstrate what is wrong and how to fix it to protect yourself against attacks.

Typical Duration

3-5 days (scope-dependent). Reporting takes roughly 30-50% of the test time on top.

Typical Price

from 8,400 €

The final price depends on the scope of the project and the maturity level of your IT security. It is calculated individually based on the required effort.

Deliverables

Every engagement includes:

Written findings report with all vulnerabilities and misconfigurations, prioritized by severity, with remediation steps
Management summary tailored to your audience (technical or executive)
Live debriefing to walk through findings and answer questions
Retesting after remediation available on request

See example reports for what a VidraSec report looks like.

Compliance

Directly relevant for NIS2, ISO 27001, and TISAX (automotive industry). Active Directory security is a standard checkpoint in information security management audits.

Frequently asked questions

What is the difference between an Active Directory Audit and an internal penetration test?

An Active Directory Audit is a white-box configuration review with full read access. An internal penetration test attacks Active Directory from a normal user’s perspective to see whether Domain Admin is reachable. They are complementary and are often combined for a complete picture.

How long does an Active Directory Audit take?

Typically 3 to 5 days of analysis depending on the size of the environment, plus roughly 30 to 50 percent of that time for reporting.

Will the audit disrupt our production Active Directory?

No. The audit is read-only and white-box. VidraSec reviews configuration and permissions without making changes or running disruptive attacks against your domain controllers.

How much does an Active Directory Audit cost?

From 8,400 euros. The final price depends on the scope and the maturity level of your environment and is calculated individually based on the required effort.