Identity and Privileged Access Security
Active Directory Security
We map the paths from a standard account to domain admin in your Active Directory. We help you eliminate them with minimal changes.
What it is
Active Directory is the central point for users, servers and privileges in many organizations. Over time, delegations, nested groups and legacy settings create hidden paths to admin rights. In ransomware attacks, domain admin rights allow simultaneous access to all servers in the domain. The assessment maps these paths in a privilege graph and identifies the changes that cut the most paths.
Scope
- Privileged groups, nested memberships and accounts protected by AdminSDHolder
- Object permissions (ACLs) and delegations on organizational units
- Kerberos delegation settings
- Domain and forest trusts
- Group Policy objects and the accounts that can edit them
- Legacy authentication protocols and domain controller settings
The need
When organizations need it
- After a merger or acquisition, when two organizations' domains are connected.
- When a penetration test or incident shows a standard account quickly gained admin rights.
- When the domain has grown over years and no one knows why rights were granted.
Method
How we work
-
Data collection
We read directory data using a standard user account. No changes are made to the environment.
-
Privilege graph
We combine users, groups, computers and permissions in a single graph.
-
Path analysis
We calculate how many accounts can use each path and which single change eliminates the most paths.
-
Admin tiers
We recommend a tiered model that separates domain administration from server and workstation administration.
Outcome
What you have at the end
You have a map of the paths from standard accounts to domain admin. You know how many paths each change eliminates, and the changes are ordered accordingly.
Frequently asked questions
Do we need to grant admin rights for the analysis?
No. Most directory data can be read with a standard user account. This also shows what an attacker can see immediately after gaining access.
Will it affect domain controller performance?
Data is collected using standard directory queries, and the load is low. If needed, it is scheduled outside business hours.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting