--- title: "Active Directory Penetration Testing & Entra ID | Mr Cyber" url: https://mr-cyber.com/services/active-directory-penetration-testing language: en description: "Manual Active Directory pentest. Permissions, privileged accounts, attack paths to domain admin and Entra ID hybrid. Fixed price from €3,400, free retest." --- # Active Directory penetration testing An Active Directory penetration test checks how easily a normal user account can be turned into control over your whole Windows domain. Mr Cyber reviews permissions, privileged accounts, policies and the hybrid link to Entra ID, then tests the real attack paths by hand, at a fixed price, with a free retest. Fixed price **from €3,400** · 4 test days · retest included [See my fixed price](https://mr-cyber.com/quote?service=ad) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) One ordinary account, three hops, Domain Admins. - **4–8 test days**4 test days in the starting price - **MITRE ATT&CK**\+ 4 more standards - **Report + debrief**within 5 business days - **Free retest**within 60 days ## Who it’s for - Mittelstand companies whose IT runs on Windows and Active Directory - Companies with a NIS2 duty or an ISO 27001 or TISAX audit - Teams that want to reduce the impact of ransomware - Companies after a merger, a domain migration or years of organic growth ## What we test ### Privileged accounts - Domain and enterprise admins and their use - Service accounts and their rights - Separation of admin and everyday accounts ### Permissions & delegation - Rights on users, groups and organisational units - Delegations and inherited permissions - Paths from a normal user to domain admin ### Policies & authentication - Password and lockout policies - Legacy protocols and authentication settings - Group policies and their security settings ### Infrastructure - Domain controllers and their hardening - Certificate services (AD CS) - Trusts between domains and forests ### Hybrid identity - Synchronisation with Entra ID - Admin roles and conditional access, on request - Rights that reach from the cloud into the domain and back ## How we test your Active Directory. Five phases, one tester. The same senior tester from first scope to retest. test days in the starting price 4 business days to the report 5 days for the free retest 60 Typically 4–8 testing days, depending on the number of users, domains and the Entra ID link. 1. Phase 1 ### Scope & start date Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing. You pick the date 2. Phase 2 ### Directory mapping Users, groups, trusts and policies inventoried. Test day 1 3. Phase 3 ### Privilege paths Routes from a normal account to admin rights. From test day 2 4. Phase 4 ### Report & debrief Audit-ready report and ticket file, then a call. Within 5 business days 5. Phase 5 ### Free retest Your fixes tested again and confirmed in writing. Within 60 days ## Methodology & standards - MITRE ATT&CK - PTES - NIST SP 800-115 - CIS Benchmarks (Windows Server) - CVSS 3.1 ## How we test Active Directory We start with a normal domain user account, the access almost any attacker has after a single phishing email. From there we collect how your directory is configured and look for paths to domain admin. The paths that matter are then confirmed by hand. ### Safe for your domain Checks that could lock accounts or put load on domain controllers are agreed upfront or left out. Changes to the directory only happen with your explicit approval. ### Critical findings don’t wait for the report If we reach domain admin or find something urgent, you hear from us the same day. ### A hardening plan in a clear order The report shows each attack path and the fixes that break most of them. Your IT team knows what to change first. ### Related checks Entra ID and Microsoft 365 are covered in the [cloud pentest](https://mr-cyber.com/services/cloud-penetration-testing#m365). To see what an attacker does with domain access in practice, and what your team detects, ask for an [assumed breach test](https://mr-cyber.com/services/red-teaming#assumedbreach). ## What you get - Executive summary for management and auditors - Attack paths to domain admin, shown step by step - Every finding with evidence and fix guidance - CVSS 3.1 scoring plus business-risk rating and a prioritised hardening plan - Debrief call with your IT team - Free retest and updated report ### Always included - Free retest within 60 days - Debrief call with your team - NDA, DPA and testing authorisation with the offer - Critical findings reported the same day - Testing stops at any time on your call - Audit-ready report (PDF) - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 Pentest report · Admin & Söhne GmbH · MC-2026-024 Risk: Critical CVSS 3.1 · 9.8 Open · retest included ### Domain admin rights reachable without any account Domain ad.admin-soehne.example · service account “svc-backup” CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H #### Description A technical account used by the backup software has full administrator rights in the company’s Windows domain and a short password that never expires. An old setting on this account lets any device in the company network obtain a scrambled copy of the password, without logging in at all. Because the password is weak, the copy could be turned back into the real password within hours. #### Steps to reproduce 1. Connect a test laptop to an office network, without any company account. 2. Request the scrambled password data of the service account, which the old setting allows without login. 3. Recover the password offline and confirm with the client: it grants domain administrator rights. ``` Account: svc-backup · Member of: Domain Admins Old setting: password data handed out without login = yes Password last changed: over 5 years ago Recovered offline: yes (under 3 hours) ``` #### Business impact One device plugged into any office network, or one infected PC, leads to full control of every Windows computer, server and email account, including the backup server. That is the path ransomware groups take to encrypt a whole company and its backups: weeks of downtime, and under NIS2 the management is personally liable. #### Remediation Switch off the old setting, change the password to a long random one, or move to a managed service account that rotates its own password. Remove domain admin rights and give the account only what backups need. Check all other accounts for the same setting, and keep one backup copy offline. CWE-521 (Weak Password Requirements) · CWE-250 (Execution with Unnecessary Privileges) · MITRE ATT&CK T1558.004 (AS-REP Roasting), T1078.002 (Domain Accounts) ## Fixed price from [€3,400](https://mr-cyber.com/quote?service=ad) 4 test days · report in 5 business days · retest included Services exclusively for businesses. · [What drives the price](https://mr-cyber.com/pricing) ## Frequently asked questions How much does an Active Directory pentest cost? Fixed prices start at €3,400 for one domain with up to 500 users. More users, several domains or forests and Entra ID add effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. Will the test lock accounts or slow down the domain? No. We agree upfront which checks run, avoid anything that could lock accounts or overload domain controllers, and make no changes without your explicit approval. What do you need from us? A normal domain user account, network access through a virtual machine or VPN, the domains in scope and a contact for emergencies. What is the difference to an internal network pentest? An internal test looks at the whole network and uses Active Directory where it helps. The AD pentest focuses on the directory itself and reviews its configuration completely, including paths an internal test may not reach in the time available. We already use an AD assessment tool. Why do we need this? Assessment tools list settings. A tester checks which of them can be chained into a real path to domain admin in your environment, and which fixes break most paths at once.