Top 10 Active Directory misconfigurations to fix first
An Active Directory that has been running for fifteen years accumulates delegations, service accounts and migrations nobody remembers. Most of them are harmless. Ten of them are not. Here are the ten that open a path to domain administration, and what closes each one.
Why this list looks nothing like the cloud one
On a tenant, the risk is that someone signs in as somebody they should not be. On a directory, the risk is that someone who has already signed in as a perfectly ordinary user finds a chain of rights that ends at a domain controller. That is why this list is about paths rather than about settings: individually, most of these are defensible; together, they are a route.
1. Rights held by “Domain Users” over a privileged object
The single worst finding an audit can return. A GenericAll, WriteDACL or WriteOwner right on a privileged group, held by a principal every account in the domain belongs to, means every user is one command away from domain administration. It is almost never deliberate: it is the residue of a migration or of a tool that asked for “full control” once.
Fix: remove the ACE. Then look for its siblings — this kind of right rarely appears alone.
2. Service accounts in the administration groups
A service account in Domain Admins is a permanent privileged credential, usually with a password that has not changed in years, often with a service principal name attached — which makes it kerberoastable: any user can request a ticket for it and crack the password offline, at leisure, without triggering a single failed logon.
Fix: take service accounts out of the administration groups, use group managed service accounts where possible, and treat any remaining SPN account as a credential to rotate.
3. Replication rights outside the domain controllers
The two replication rights that together enable DCSync let their holder ask a domain controller for the password hashes of the entire domain, including krbtgt — which is the key to a Golden Ticket, and therefore to persistence that survives every password reset you will perform afterwards.
Fix: the only principals that need these rights are the domain controllers themselves. Anything else is a finding.
4. Unconstrained delegation
A machine trusted for unconstrained delegation caches the tickets of everyone who connects to it. Compromise that one server, wait for an administrator to connect, and you have their ticket. It is a design from another era that still runs in production far more often than anyone expects.
Fix: move to constrained delegation, and mark privileged accounts as sensitive so they cannot be delegated at all.
5. Permissive certificate templates (AD CS)
A template that lets a requester supply their own subject name, published to a broad group, allows any user to request a certificate for a domain administrator and then authenticate as them. The ESC family of techniques turned a quiet, ten-year-old PKI into one of the most reliable escalation paths there is.
Fix: review who can enrol on each template, disable the “supply in request” flag where it is not needed, and require manager approval on the sensitive ones.
6. AdminSDHolder and the protected groups
Rights placed on AdminSDHolder propagate to every protected account, on a timer, silently. An attacker who obtains write access there does not need to keep their foothold: the directory itself will restore their access every hour.
Fix: audit its ACL specifically, and treat any non-default entry as a compromise indicator rather than as a misconfiguration.
7. Trusts without SID filtering
An inbound trust from a forest you do not administer, without SID filtering, lets the other side assert privileged identifiers from your domain. A partner's compromise becomes your compromise. Add TGT delegation across the trust and the problem stops being theoretical.
Fix: enable SID filtering, enable selective authentication, and re-read the list of trusts — one of them is usually older than everyone in the room.
8. LAPS deployed “almost everywhere”
Local administrator password solution coverage is a percentage, and the machines that are missing are rarely random: they are the old ones, the ones nobody dares touch. A shared local administrator password across those machines gives lateral movement for free.
Fix: measure coverage rather than assume it, and treat the uncovered machines as a list to close, not as an acceptable remainder.
9. Passwords that never expire on privileged accounts
Break-glass accounts, application accounts, the account created for a project in 2016. Each one is a credential that has had years of exposure to every keylogger, every leaked backup and every departed administrator.
Fix: inventory them, justify each survivor in writing, rotate the rest, and monitor use of the ones you keep.
10. Legacy protocols still enabled on the controllers
SMBv1, LLMNR and NetBIOS name resolution, unsigned LDAP: the plumbing that makes relay and poisoning attacks work. None of them is exploited on its own — they are what turns a foothold into a credential.
Fix: disable them, in that order, measuring what still depends on them first.
The order matters more than the list. Fix what is reachable by every user first — items 1, 2 and 3 — then what shortens an attacker's path, then the hygiene. The maturity model encodes exactly that order, which is why it makes a better remediation plan than a percentage.