I’ve seen people argue that pentesters get Domain Admin on every internal pentest, so Active Directory must be insecure.
That’s not how this works.
I don’t get Domain Admin on every pentest. In fact, it’s getting harder. And Domain Admin isn’t always the goal.
On one engagement, we started from a hybrid joined Windows endpoint. We didn’t find a path to Domain Admin. But we sprayed a weak password and compromised the CFO’s account. There was no MFA on their email, either. We logged in from outside the client’s network, took the screenshot, and called it a day.
Would you call that a successful defense because we didn’t get Domain Admin? I wouldn’t.
I also want to know what happened along the way. Which controls got in my way? What restricted my techniques? What alerted the team? Clients I work with care about those answers as much as the vulnerabilities and misconfigurations I find.
Active Directory is old. It can be clunky. It can also be defensible. Moving to Entra doesn’t make weak passwords, excessive permissions, or missing MFA disappear.
If you manage AD, keep looking for the unglamorous stuff: dangerous permissions, privilege paths, and accounts with more access than they need. Run tools like PingCastle or Purple Knight, ADeleginator, and Locksmith. Pick the three to five highest risk findings, fix them, and do it again next quarter.
Something to consider: If a pentester started from a regular employee endpoint in your environment tomorrow, what could they actually reach, what would stop them, and what would your team detect?
That tells you more than a Domain Admin yes-or-no result.
All the best
Spencer Alessi
by the way - Want more practical Active Directory security discussions? Search “Active Directory” on the Cyber Threat POV YouTube channel.