ExamFinch.com My Study

Study guide

8.1 Active Directory Architecture & Domain Reconnaissance

Practice this exam

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

8.1 Active Directory Architecture & Domain Reconnaissance

Key Takeaways Explain This Topic AI

Active Directory Domain Services (AD DS) organizes enterprise identity hierarchically into Domains, Trees, and Forests, with Domain Controllers maintaining the directory database and Global Catalog servers replicating a partial attribute set across the entire forest on TCP ports 3268 (LDAP) and 3269 (LDAPS).

The Active Directory Forest represents the true security boundary; trusts between domains within a forest are transitive and do not provide administrative isolation, whereas inter-forest trusts utilize SID filtering to prevent unauthorized cross-forest privilege elevation.

Core Active Directory protocols operate across standardized network ports including Kerberos (TCP/UDP 88), LDAP/LDAPS (TCP 389/636), SMB (TCP 445), RPC Endpoint Mapper (TCP 135), and DNS (TCP/UDP 53), which are discoverable through standardized DNS SRV locator records like _ldap._tcp.dc._msdcs.<domain>.

Anonymous RootDSE LDAP queries reveal critical domain metadata without credentials, while authenticated LDAP queries and BloodHound graph analysis expose attack paths, AdminCount=1 protected objects, and accounts with dangerous UserAccountControl flags such as DONT_REQ_PREAUTH.

Last updated: September 2026

8.1 Active Directory Architecture & Domain Reconnaissance

Active Directory Domain Services (AD DS) is the central identity, authentication, and authorization backbone for over 90% of enterprise environments globally. For security analysts preparing for the CREST Practitioner Security Analyst (CPSA) examination, assessing an Active Directory environment requires moving beyond isolated host testing to evaluating interconnected forest structures, protocol exchanges, directory service queries, and relational access control lists (ACLs).

Active Directory DS Architecture: Forests, Trees & Domains

Active Directory is structured as a hierarchical, distributed database that coordinates access to network resources across an enterprise. +-----------------------------------------------------------------------------+

  • | ACTIVE DIRECTORY FOREST |
  • | (Security Boundary) |
  • | |
  • | +------------------------------------+ +----------------------------+ |
  • | | TREE 1 | | TREE 2 | |
  • | | (corp.internal) | | (partnercorp.net) | |
  • | | | | | |
  • | | [Forest Root: corp.internal] | | [Root: partnercorp.net] | |
  • | | / \ | +----------------------------+ |
  • | | [emea.corp.internal] [apac.corp...] | |
  • | +------------------------------------+ |
  • | |
  • | Forest-Wide Partitions: Schema & Configuration |
  • | Domain-Specific Partitions: Domain (Users, Groups, Computers) |
  • +-----------------------------------------------------------------------------+
  • 1. Logical Hierarchy Components

Domain: The fundamental administrative unit in Active Directory. A domain stores identity objects (users, computers, groups) and security policies that apply uniformly to those objects. Every domain possesses a unique Security Identifier (Domain SID) and DNS namespace (e.g., corp.internal ).

Domain Tree: A collection of one or more domains that share a contiguous DNS namespace. For example, emea.corp.internal and apac.corp.internal form child domains branching from the parent tree root corp.internal .

Forest: The top-level container and ultimate security boundary in Active Directory. A forest consists of one or more trees that share a common directory schema (object definitions and attribute rules), configuration partition (site topology and service bindings), and Global Catalog. The first domain created in a forest is designated as the Forest Root Domain .

2. Active Directory Database Partitions (Naming Contexts)

The directory database ( NTDS.dit ) is partitioned into distinct logical naming contexts:

Schema Partition: Defines every object class (e.g., user , group , computer ) and attribute (e.g., sAMAccountName , servicePrincipalName ) that can exist in the forest. Replicates forest-wide.

Configuration Partition: Contains the physical and logical forest topology, including AD sites, subnets, directory-enabled services, and domain partitions. Replicates forest-wide.

Domain Partition: Stores all directory objects specific to that particular domain (accounts, security groups, OUs, and Group Policy Objects). Replicates exclusively among Domain Controllers within that specific domain.

Application Partitions: Stores application-specific data, such as Active Directory-Integrated DNS zones ( ForestDnsZones and DomainDnsZones ).

  • Domain Controllers & The Global Catalog (GC)
  • Domain Controllers (DCs)

A Domain Controller is a Windows Server running the AD DS server role that stores a replica of the directory database, authenticates user and computer logons, and enforces enterprise security policies. Domain Controllers utilize multi-master replication , meaning changes to directory objects can be made on any writable DC and subsequently replicated to peer DCs. Specific single-master operations that cannot tolerate concurrent modifications are delegated to five Flexible Single Master Operation (FSMO) roles:

Forest-wide: Schema Master and Domain Naming Master .

Domain-wide: PDC Emulator (handles password changes and Kerberos time synchronization), RID Master (allocates RID pools to DCs), and Infrastructure Master (updates cross-domain object references).

The Global Catalog (GC)

The Global Catalog is a specialized Domain Controller role designed to facilitate cross-domain searches and accelerate authentication across complex multi-domain forests.

Storage Architecture: The GC maintains a full replica of all objects in its own host domain partition, plus a partial attribute replica (the Partial Attribute Set, or PAS) of every object across every other domain in the entire forest . Attributes in the PAS include commonly queried fields such as sAMAccountName , displayName , userPrincipalName , and object SIDs.

Network Ports:

TCP Port 3268: LDAP queries targeting the Global Catalog (unencrypted).

TCP Port 3269: LDAPS queries targeting the Global Catalog (TLS-encrypted).

Authentication Role: During user authentication, the GC resolves Universal Group memberships. If a GC is unavailable and universal group membership caching is disabled, logon requests in multi-domain environments will fail.

Active Directory Trust Relationships & Security Boundaries

Trusts establish communication channels between domains or forests to enable cross-boundary authentication and resource authorization. TRUST DIRECTION vs ACCESS DIRECTION

  • Trusting Domain (Resource) -------- Trusts --------> Trusted Domain (Account)
  • [Holds File Shares & Services] [Holds User Accounts]
  • User Access Direction <=== Access Granted ====== Enterprise Users
  • Trust Characteristics

Directionality:

One-Way Trust: Domain A trusts Domain B. Users in Domain B can access permitted resources in Domain A. Users in Domain A cannot access resources in Domain B. The direction of access is the exact inverse of the direction of trust.

Two-Way Trust: Both domains trust each other. Users in either domain can access authorized resources in the partner domain.

Transitivity:

Transitive Trust: Trust extends beyond two immediate domains. If Domain A trusts Domain B, and Domain B trusts Domain C, Domain A automatically trusts Domain C. All parent-child and tree-root trusts within an AD forest are two-way and transitive by default.

Non-Transitive Trust: Trust is strictly bounded to the two partner domains. It does not extend to any child or parent domains.

Trust Classifications

Parent-Child & Tree-Root Trusts: Created automatically within a forest; two-way and transitive.

External Trust: A non-transitive trust established between a domain in one forest and a domain in another forest, or with a legacy Windows NT 4.0 domain.

Forest Trust: A transitive trust established between two Forest Root Domains. Permits Kerberos ticket referrals across forests and allows administrators in one forest to grant permissions to users in the other forest.

The Forest as the True Security Boundary

A fundamental security principle heavily tested on CREST examinations is that the Forest is the ultimate security boundary in Active Directory , not the individual domain.

CREST Exam Focus: Domain vs Forest Boundary Individual domains within a forest provide administrative segregation, but not absolute security isolation. An administrator with Domain Admin or local SYSTEM rights on a Domain Controller in a child domain can exploit forest-wide schema and configuration replication, compromise Enterprise Admins, or abuse the krbtgt architecture to gain complete control over all other domains in the forest.

SID Filtering (Quarantine)

When Kerberos authentication traverses an inter-forest trust, the client presents a Privilege Attribute Certificate (PAC) containing the user's SIDs and security group memberships. In legacy configurations, an attacker possessing administrative control over trusted Forest B could inject the Domain Admin or Enterprise Admin SID of Forest A into the PAC's sIDHistory attribute, resulting in unauthorized administrative access within Forest A.

SID Filtering mitigates this vulnerability by inspecting the PAC at the trust boundary and stripping any foreign SIDs that do not belong to the relative namespace of the trusted forest. On external and forest trusts, SID filtering is enabled by default to preserve the security boundary between distinct enterprise forests.

Core Active Directory Network Ports

Assessing an AD environment requires identifying the operational state of core infrastructure ports on Domain Controllers and domain members:

  • Service / Protocol Transport & Port Functional Role in Active Directory
  • DNS TCP / UDP 53 Active Directory locator service, SRV host resolution, zone transfers
  • Kerberos TCP / UDP 88 Primary AD authentication mechanism (TGT and Service Ticket exchanges)
  • MSRPC Endpoint Mapper TCP 135 RPC service lookup, dynamic high port mapping, named pipe negotiation
  • NetBIOS Name Service UDP 137 Legacy NetBIOS name resolution and broadcast registration
  • NetBIOS Datagram UDP 138 NetBIOS connectionless transport and domain browsing announcements
  • NetBIOS Session TCP 139 Legacy SMB session transport over NetBIOS
  • LDAP TCP 389 Directory interrogation, object querying, authentication, GPO queries
  • SMB Direct-Hosted TCP 445 Group Policy download (SYSVOL/NETLOGON), RPC transport, file sharing
  • Kerberos Password (kpasswd) TCP / UDP 464 Kerberos user password changes and administrative resets
  • LDAPS (LDAP over TLS) TCP 636 Encrypted directory queries and secure directory modifications
  • Global Catalog (LDAP) TCP 3268 Forest-wide cross-domain directory queries and universal group resolution
  • Global Catalog (LDAPS) TCP 3269 Forest-wide encrypted directory queries and SSL/TLS validation
  • Dynamic RPC Ports TCP 49152-65535 Ephemeral ports allocated for SAMR, LSARPC, DRSUAPI, and Netlogon
  • DNS SRV Record Discovery for Active Directory

Active Directory clients locate Domain Controllers dynamically using Domain Name System (DNS) Service (SRV) records. SRV records map a requested service and protocol to the fully qualified domain name (FQDN) and listening port of the authoritative host. _Service._Proto.Name TTL Class Priority Weight Port Target

_ldap._tcp.corp.local. 3600 IN SRV 0 100 389 dc01.corp.local.

Essential SRV Records for Assessment

Penetration testers query specific SRV records under the _msdcs.<forest-root> sub-domain to enumerate infrastructure roles from an unauthenticated network position: # Enumerate all Domain Controllers offering LDAP services in the domain

nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.internal

  • # Query using dig to resolve all Kerberos Key Distribution Centers (KDCs)
  • dig -t SRV _kerberos._tcp.corp.internal
  • # Discover all Global Catalog servers across the forest root
  • dig -t SRV _gc._tcp.corp.internal
  • # Locate the Primary Domain Controller (PDC) Emulator
  • nslookup -type=SRV _ldap._tcp.pdc._msdcs.corp.internal
  • LDAP Reconnaissance: Unauthenticated vs Authenticated

The Lightweight Directory Access Protocol (LDAP) is the primary mechanism for interrogating and updating the Active Directory database.

1. Anonymous / Unauthenticated LDAP Reconnaissance (RootDSE)

Most modern Domain Controllers restrict anonymous directory searches. However, RFC 4512 mandates that every LDAP server maintain a RootDSE (Root Directory System Agent Specific Entry) object that clients can query without authentication to determine the server's capabilities, supported protocols, and directory naming contexts.

An unauthenticated tester can query the RootDSE to extract foundational domain intelligence: ldapsearch -x -H ldap://192.168.10.10 -s base -b "" "(objectclass=*)" namingContexts defaultNamingContext dnsHostName domainFunctionality # Critical Metadata Returned by RootDSE:

  • defaultNamingContext: DC=corp,DC=internal
  • configurationNamingContext: CN=Configuration,DC=corp,DC=internal
  • schemaNamingContext: CN=Schema,CN=Configuration,DC=corp,DC=internal
  • dnsHostName: DC01.corp.internal
  • ldapServiceName: corp.internal:dc01$@CORP.INTERNAL
  • supportedLDAPVersion: 3
  • supportedLDAPVersion: 2
  • domainFunctionality: 7 (Windows Server 2016 / 2019 / 2022 level)
  • 2. Authenticated LDAP Enumeration

Once a tester obtains valid domain credentials (even for a low-privileged user or service account), LDAP provides broad visibility into the domain's objects, group memberships, and security configurations.

  • A. High-Value Object Queries
  • Domain Users: (&(objectCategory=person)(objectClass=user))
  • Domain Groups: (objectCategory=group)
  • Domain Controllers: (&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))
  • Organizational Units (OUs): (objectCategory=organizationalUnit)
  • B. Identifying Protected Administrative Objects: AdminCount=1

Active Directory protects high-privilege accounts (e.g., Domain Admins, Enterprise Admins, Backup Operators) using a background system thread called AdminSDHolder . Every 60 minutes, the SDProp (Security Descriptor Propagator) process runs on the PDC Emulator, copies the restrictive security descriptor from CN=AdminSDHolder,CN=System,DC=domain,DC=com to all protected objects, and sets their adminCount attribute to 1 .

Querying for (adminCount=1) reveals all current and historically privileged accounts in the domain: ldapsearch -x -H ldap://192.168.10.10 -D "user@corp.internal" -W -b "DC=corp,DC=internal" "(adminCount=1)" sAMAccountName description

C. Identifying Kerberoastable Accounts via SPNs

Any domain user account with a registered servicePrincipalName can be targeted for Kerberoasting. By excluding computer accounts, testers extract high-value user service accounts: ldapsearch -x -H ldap://192.168.10.10 -D "user@corp.internal" -W -b "DC=corp,DC=internal" "(&(servicePrincipalName=*)(!(objectCategory=computer)))" sAMAccountName servicePrincipalName

D. UserAccountControl (UAC) Flags & Bitwise LDAP Filters

The userAccountControl attribute is an integer bitmask that controls account properties. LDAP filters utilize the Extensible Match Rule 1.2.840.113556.1.4.803 ( LDAP_MATCHING_RULE_BIT_AND ) to evaluate individual bits within the bitmask:

  • Flag Name Hex Value Decimal Security Assessment Implication
  • ACCOUNTDISABLE 0x0002 2 Disabled account; cannot be used for direct interactive logon
  • PASSWD_NOTREQD 0x0020 32 Account permitted to have an empty/blank password
  • DONT_EXPIRE_PASSWORD 0x10000 65536 Password never expires; frequent target for credential spraying
  • SERVER_TRUST_ACCOUNT 0x2000 8192 Domain Controller computer account

DONT_REQ_PREAUTH 0x400000 4194304 Vulnerable to AS-REP Roasting (Kerberos pre-auth disabled) # Query for accounts vulnerable to AS-REP Roasting (DONT_REQ_PREAUTH = 4194304)

ldapsearch -x -H ldap://192.168.10.10 -D "user@corp.internal" -W -b "DC=corp,DC=internal" "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" sAMAccountName

# Query for active accounts with non-expiring passwords (DONT_EXPIRE_PASSWORD = 65536)

ldapsearch -x -H ldap://192.168.10.10 -D "user@corp.internal" -W -b "DC=corp,DC=internal" "(&(userAccountControl:1.2.840.113556.1.4.803:=65536)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" sAMAccountName

Graph-Based Attack Path Modeling: BloodHound & SharpHound

Traditional enterprise security reviews evaluate Active Directory through static checklists (e.g., checking if password policies enforce 14 characters). However, modern adversaries and penetration testers analyze Active Directory as a directed graph . +-----------------------------------------------------------------------------+

  • | BLOODHOUND ATTACK PATH GRAPH |
  • +-----------------------------------------------------------------------------+
  • | [Standard User] |
  • | | |
  • | | (MemberOf) |
  • | v |
  • | [Helpdesk Group] |
  • | | |
  • | | (AdminTo) |
  • | v |
  • | [Workstation WS-042] <---- (HasSession) ---- [Domain Admin Session] |
  • | | | |
  • | | (Dump LSASS Credentials) | |
  • | +--------------------------------------------->+ |
  • | | |
  • | | (MemberOf) |
  • | v |
  • | [Domain Admins Group] |
  • +-----------------------------------------------------------------------------+
  • Conceptual Mechanics

Graph Primitives: BloodHound represents AD entities as nodes (Users, Computers, Groups, OUs, GPOs, Domains) and administrative relationships or privileges as directed edges .

Relational Attack Vectors: High-privilege access is rarely achieved via a single vulnerability. Instead, attackers chain non-obvious relationships:

MemberOf : Nested group memberships.

AdminTo : Local administrative rights over endpoints.

HasSession : Active user logon sessions residing in workstation LSASS memory.

GenericAll / WriteDacl : Object-level discretionary access control list (DACL) permissions granting the ability to grant oneself full rights or reset passwords.

GenericWrite : Ability to alter attributes (e.g., modifying scriptPath or servicePrincipalName ).

ForceChangePassword : Direct password reset capability over target user objects.

SharpHound Ingestion Mechanics

SharpHound is the data collection engine for BloodHound. It queries Domain Controllers via authenticated LDAP, invokes MSRPC/NetAPI ( NetSessionEnum , NetLocalGroupGetMembers ) over SMB port 445 against domain endpoints, and collects directory metadata:

DCOnly : Collects only directory data stored directly on Domain Controllers (group memberships, domain trusts, object ACLs, SPNs). Generates zero network traffic to individual workstations, making it fast and stealthy.

Session : Interrogates domain workstations using MSRPC ( NetWkstaUserEnum ) or the Windows Registry to determine where high-privilege users (such as Domain Admins) are actively logged in.

ComputerOnly / LoggedOn : Resolves local group memberships (Administrators, Remote Desktop Users) on individual endpoints.

By computing the shortest path from a compromised standard user node to the Domain Admins or Enterprise Admins group, BloodHound reveals complex, multi-hop privilege escalation paths that are impossible to identify through manual inspection.