Services / Microsoft 365 and endpoint security
Security Assessment of Microsoft Active Directory Environments
Active Directory is usually the oldest thing in the estate and the most load-bearing: nearly every attack that reaches a domain controller ends the argument. We assess what has accumulated over the years — delegations nobody remembers granting, service accounts with passwords older than the servers, trust relationships kept for a project that finished — and set out what to fix, in the order that reduces risk fastest.
What usually gets in the way
- Privileged group membership that has grown without anyone reviewing it.
- Service accounts with old passwords, excessive rights and no clear owner.
- Delegations and ACLs granted years ago for reasons nobody can now explain.
- Kerberos configuration that leaves accounts open to well-known attacks.
- Legacy protocols and trust relationships kept alive long past their purpose.
- No tiering between domain admin, server admin and workstation access.
- Password policy that has not moved with current guidance.
- Little visibility of authentication activity or the ability to spot abuse.
How we approach it
- Collect the current state with read-only tooling — no agents, no changes.
- Map privileged access paths and identify the routes to domain compromise.
- Review delegations, ACLs and service account rights against what is needed.
- Assess Kerberos, protocol and trust configuration against current guidance.
- Check the environment against CIS benchmarks and Microsoft baselines.
- Prioritise findings by real exploitability, not raw severity scores.
- Provide a remediation plan sequenced so the riskiest gaps close first.
- Walk your team through the findings so the fixes stick after we leave.
What you end up with
- A clear picture of who can reach domain admin, and by which routes.
- Privileged access reduced to what the roles actually require.
- Legacy protocols and stale trusts removed or knowingly accepted.
- A prioritised remediation plan your team can work through.
- Evidence of assessment that satisfies auditors and insurers.
- Monitoring in place to catch the next problem earlier.
Start with a conversation
Tell us where you are with security assessment of microsoft active directory environments and we’ll tell you what it actually takes.