Skip to content

Active Directory penetration testing

An Active Directory penetration test checks how easily a normal user account can be turned into control over your whole Windows domain. Mr Cyber reviews permissions, privileged accounts, policies and the hybrid link to Entra ID, then tests the real attack paths by hand, at a fixed price, with a free retest.

Fixed price from €3,400 · 4 test days · retest included

See my fixed price

Prefer to talk first? Book a call

1 2 3 admin-soehne.example j.doe WS-17 SRV-FILE Domain Admins
One ordinary account, three hops, Domain Admins.
  • 4–8 test days4 test days in the starting price
  • MITRE ATT&CK+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Mittelstand companies whose IT runs on Windows and Active Directory
  • Companies with a NIS2 duty or an ISO 27001 or TISAX audit
  • Teams that want to reduce the impact of ransomware
  • Companies after a merger, a domain migration or years of organic growth

What we test

Privileged accounts

  • Domain and enterprise admins and their use
  • Service accounts and their rights
  • Separation of admin and everyday accounts

Permissions & delegation

  • Rights on users, groups and organisational units
  • Delegations and inherited permissions
  • Paths from a normal user to domain admin

Policies & authentication

  • Password and lockout policies
  • Legacy protocols and authentication settings
  • Group policies and their security settings

Infrastructure

  • Domain controllers and their hardening
  • Certificate services (AD CS)
  • Trusts between domains and forests

Hybrid identity

  • Synchronisation with Entra ID
  • Admin roles and conditional access, on request
  • Rights that reach from the cloud into the domain and back
See my fixed price

Prefer to talk first? Book a call

How we test your Active Directory. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
4
business days to the report
5
days for the free retest
60

Typically 4–8 testing days, depending on the number of users, domains and the Entra ID link.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Directory mapping

    Users, groups, trusts and policies inventoried.

    Test day 1

  3. Phase 3

    Privilege paths

    Routes from a normal account to admin rights.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • MITRE ATT&CK
  • PTES
  • NIST SP 800-115
  • CIS Benchmarks (Windows Server)
  • CVSS 3.1

How we test Active Directory

We start with a normal domain user account, the access almost any attacker has after a single phishing email. From there we collect how your directory is configured and look for paths to domain admin. The paths that matter are then confirmed by hand.

Safe for your domain

Checks that could lock accounts or put load on domain controllers are agreed upfront or left out. Changes to the directory only happen with your explicit approval.

Critical findings don’t wait for the report

If we reach domain admin or find something urgent, you hear from us the same day.

A hardening plan in a clear order

The report shows each attack path and the fixes that break most of them. Your IT team knows what to change first.

Entra ID and Microsoft 365 are covered in the cloud pentest. To see what an attacker does with domain access in practice, and what your team detects, ask for an assumed breach test.

What you get

  • Executive summary for management and auditors
  • Attack paths to domain admin, shown step by step
  • Every finding with evidence and fix guidance
  • CVSS 3.1 scoring plus business-risk rating and a prioritised hardening plan
  • Debrief call with your IT team
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-024
Risk: Critical CVSS 3.1 · 9.8 Open · retest included

Domain admin rights reachable without any account

Domain ad.admin-soehne.example · service account “svc-backup”

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A technical account used by the backup software has full administrator rights in the company’s Windows domain and a short password that never expires. An old setting on this account lets any device in the company network obtain a scrambled copy of the password, without logging in at all. Because the password is weak, the copy could be turned back into the real password within hours.

Steps to reproduce

  1. Connect a test laptop to an office network, without any company account.
  2. Request the scrambled password data of the service account, which the old setting allows without login.
  3. Recover the password offline and confirm with the client: it grants domain administrator rights.
Account: svc-backup · Member of: Domain Admins
Old setting: password data handed out without login = yes
Password last changed: over 5 years ago
Recovered offline: yes (under 3 hours)

Business impact

One device plugged into any office network, or one infected PC, leads to full control of every Windows computer, server and email account, including the backup server. That is the path ransomware groups take to encrypt a whole company and its backups: weeks of downtime, and under NIS2 the management is personally liable.

Remediation

Switch off the old setting, change the password to a long random one, or move to a managed service account that rotates its own password. Remove domain admin rights and give the account only what backups need. Check all other accounts for the same setting, and keep one backup copy offline.

CWE-521 (Weak Password Requirements) · CWE-250 (Execution with Unnecessary Privileges) · MITRE ATT&CK T1558.004 (AS-REP Roasting), T1078.002 (Domain Accounts)

Fixed price from

€3,400

4 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does an Active Directory pentest cost?
Fixed prices start at €3,400 for one domain with up to 500 users. More users, several domains or forests and Entra ID add effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
Will the test lock accounts or slow down the domain?
No. We agree upfront which checks run, avoid anything that could lock accounts or overload domain controllers, and make no changes without your explicit approval.
What do you need from us?
A normal domain user account, network access through a virtual machine or VPN, the domains in scope and a contact for emergencies.
What is the difference to an internal network pentest?
An internal test looks at the whole network and uses Active Directory where it helps. The AD pentest focuses on the directory itself and reviews its configuration completely, including paths an internal test may not reach in the time available.
We already use an AD assessment tool. Why do we need this?
Assessment tools list settings. A tester checks which of them can be chained into a real path to domain admin in your environment, and which fixes break most paths at once.

Related services

NIS2 & Compliance

Active Directory pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call