Government cybersecurity agencies have issued updated technical guidance to help organisations defend Microsoft Active Directory environments against credential theft, privilege escalation, lateral movement and long-term persistence attacks.
The revised publication,Detecting and Mitigating Active Directory Compromises, was developed by the US Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Australian Signals Directorate, the Canadian Centre for Cyber Security, New Zealand’s National Cyber Security Centre and the United Kingdom’s National Cyber Security Centre.
Originally published in September 2024 andupdated on September 15, 2026, the guidance examines 17 of the most common techniques used to attack Active Directory Domain Services, Active Directory Certificate Services and Active Directory Federation Services.
The latest version provides expanded defensive information covering DCSync attacks and introduces detailed guidance on shadow credentials—a persistence technique that abuses certificate-based authentication attributes associated with users and computers.
The agencies warned that Active Directory remains one of the most consequential targets in enterprise environments because it controls identities, authentication, permissions and access to critical systems. An attacker who gains sufficient control of a domain can potentially access email systems, file servers, databases, business applications, backups and cloud services.
In hybrid organisations, the damage may extend beyond the on-premises network. Connections between Active Directory and Microsoft Entra ID can provide pathways into Microsoft 365, Azure and other cloud resources.
Active Directory remains a critical enterprise attack surface
Active Directory has been used by organisations for more than two decades to centrally manage users, computers, security policies and access permissions. Its central role makes it essential to business operations—but also gives attackers a powerful route to organisation-wide control.
The joint guidance identifies several characteristics that make Active Directory particularly difficult to secure. These include permissive default configurations, support for legacy authentication protocols, complicated trust relationships, excessive privileges and limited visibility into the relationships between users, groups, computers and services.
Every authenticated domain user is normally allowed to query a significant amount of directory information. This is necessary for many legitimate Active Directory functions, but it also allows an attacker who compromises an ordinary account to enumerate the environment.
Attackers can use that access to identify service accounts, certificate templates, delegated permissions, administrative groups, domain trusts and potential paths to more privileged systems. Graph-based reconnaissance tools can then reveal chains of relationships that allow a seemingly low-privileged identity to reach a domain administrator account.
The guidance notes that attackers can sometimes develop a better operational understanding of an organisation’s directory than its own administrators. Long-established domains often contain abandoned accounts, undocumented delegation, legacy applications and permissions inherited through multiple nested groups.
Microsoft similarly warns in itsActive Directory security guidancethat attackers rarely need to break a single security control directly. Instead, they frequently combine configuration weaknesses, stolen credentials and legitimate administrative functionality until they obtain the required privileges.
From an ordinary account to domain control
Many Active Directory attacks begin after a threat actor has already obtained access to a workstation, VPN account or low-privileged domain identity. The attacker then attempts to find credentials or permissions that will allow access to more sensitive systems.
Kerberoasting is one of the most widely recognised examples. Any authenticated user can request a Kerberos service ticket for an account configured with a service principal name. Part of that ticket is encrypted using material derived from the service account’s password.
An attacker can take the ticket offline and attempt to recover the underlying password without generating repeated authentication failures. If the service account has a weak password or unnecessary administrative privileges, a successful crack can create a direct path to sensitive servers or even complete domain control.
The agencies recommend replacing conventional service accounts with group Managed Service Accounts where possible. A gMSA uses a long, automatically managed password and regularly rotates it, making offline cracking significantly more difficult. When applications cannot support gMSAs, organisations should use unique, unpredictable passwords of at least 30 characters and restrict the account to the minimum privileges required.
Defenders should also investigate bursts of Kerberos service-ticket requests—recorded as Windows Event ID 4769—particularly requests for numerous service accounts within a short period. Requests that use legacy RC4 encryption may be especially significant because attackers often prefer RC4-protected tickets for offline password cracking.
MITRE ATT&CK classifies Kerberoasting as T1558.003and notes that the technique exploits legitimate Kerberos behaviour. That makes behavioural monitoring and strong service-account security more important than relying exclusively on endpoint malware detection.
A related technique, AS-REP roasting, targets accounts configured not to require Kerberos pre-authentication. An attacker can request authentication data encrypted using the account’s password-derived key and attempt to crack it offline.
The joint guidance recommends ensuring that all accounts require Kerberos pre-authentication unless a documented legacy requirement makes this impossible. Any exceptions should be minimally privileged and protected by long, unique passwords. Defenders can search for clusters of Event ID 4768 involving accounts that have pre-authentication disabled.
Password spraying can bypass traditional lockout assumptions
Password spraying remains another common route into Active Directory. Instead of trying many passwords against one account—behaviour likely to trigger a lockout—the attacker tries one or a small number of likely passwords against many accounts.
This method can exploit password reuse while remaining below each account’s lockout threshold. Attack tools may first query the domain’s password and lockout policies, then pace their attempts to reduce the likelihood of detection.
The agencies stressed that MFA is highly valuable but cannot solve every on-premises authentication problem. Once an attacker has reached the internal network, certain NTLM-based authentication paths may not invoke MFA at all.
Security teams should therefore correlate failed logon events across users andrge numbers of Event ID 4625, 4648 or 4771 records involving different usernames over a concentrated period may indicate spraying. Clusters of accounts with nearly identical badPasswordTime values can provide another clue
The guidance also draws attention to credentials stored in network shares. Threat actors routinely scan accessible files for passwords, API keys, certificates, password-manager databases, configuration files and backup material. Organisations should use enterprise credential-management systems and conduct their own periodic searches for exposed secrets.
Default computer-account permissions create additional risk
The report examines abuse of the ms-DS-MachineAccountQuota attribute, which traditionally allows ordinary domain users to create as many as ten computer accounts.
An attacker may create a computer object, give it a name that follows the organisation’s naming conventions and then authenticate using that machine identity. If the Domain Computers group has been granted excessive access, the attacker may inherit permissions that support further compromise.
Machine accounts can also be combined with relay techniques. On systems where LDAP signing or channel binding protections are not properly enforced, an attacker may relay authentication to Active Directory and manipulate objects or privileges.
Administrators should determine whether ordinary users genuinely need permission to join systems to the domain. Where that capability is unnecessary, the machine account quota should be set to zero and computer creation delegated only to authorised provisioning identities. New or modified computer objects should be centrally monitored, including Windows Event IDs 4741 and 4742.
Microsoft’s more recent analysis ofauthentication relay threatssimilarly recommends enforcing LDAP signing and channel binding, reducing NTLM use and monitoring abnormal authentication patterns.
Certificate Services can become an alternative authentication authority
Active Directory Certificate Services has become an increasingly important component of domain security because certificates can be used to authenticate users and computers without their passwords.
If certificate templates or enrolment permissions are misconfigured, a low-privileged attacker may be able to request a certificate representing a more privileged identity. The attacker can then use the certificate to obtain Kerberos credentials and authenticate as the victim.
This can turn a certificate-authority configuration problem into a complete domain compromise.
The guidance recommends inventorying all enterprise certification authorities and certificate templates, removing unused templates, restricting enrolment rights and reviewing template properties that allow requesters to supply identity information.
Security teams should enable and centrally collect relevant CA and domain-controller auditing. Events such as 4886 and 4887 record certificate requests and issuance, while Events 4899 and 4900 can reveal changes to certificate templates or their security settings. Kerberos Event ID 4768 with a certificate-based pre-authentication type can help identify authentication using an issued certificate.
The agencies also cover the “Golden Certificate” technique. Once an attacker obtains a certification authority’s private key, they can forge certificates that the domain trusts.
Changing an affected user’s password does not invalidate a forged certificate. The attacker may retain access until the compromised CA trust is replaced and unauthorised certificates are revoked.
Root and subordinate CAs should consequently receive protection comparable to domain controllers. The agencies recommend tightly restricting administrator access, using application control, securely protecting backups and storing sensitive CA keys in hardware security modules where possible.
Expanded DCSync guidance highlights the danger of replication rights
DCSync abuses the same replication functionality that domain controllers use to exchange directory information. An attacker with the necessary directory-replication permissions can impersonate a domain controller and request credential data directly from Active Directory.
The technique can expose current and historical password hashes, Kerberos keys and other sensitive material without requiring the attacker to interactively log on to a domain controller.MITRE ATT&CK tracks DCSync as T1003.006.
Particularly dangerous targets include the KRBTGT account, domain administrators and service accounts. Access to the KRBTGT secret can enable an attacker to forge Kerberos ticket-granting tickets, creating the foundation for a Golden Ticket attack.
The updated guidance also explains how attackers can combine DCSync with the “store passwords using reversible encryption” setting. If a threat actor enables that option for selected users and waits for their passwords to change, Active Directory can retain recoverable password information. A subsequent replication request may then obtain the password without requiring offline cracking.
DCSync cannot be eliminated entirely because legitimate domain controllers and some identity-management systems require replication permissions. Organisations can, however, reduce exposure by identifying every user, group, service and computer with replication rights and removing permissions that are not operationally required.
Replication traffic should normally originate from known domain controllers. Directory-replication requests from workstations, member servers or other unexpected addresses should receive immediate investigation.
Theft of ntds.dit may require rebuilding the domain
Another route to credential theft is copying ntds.dit, the database used by Active Directory Domain Services. The file contains directory objects and password hashes and is present on writable domain controllers.
Because the live database is normally locked, attackers may use legitimate tools such as Volume Shadow Copy Service or ntdsutil to create an accessible copy. They also need the corresponding SYSTEM registry hive to decrypt protected information.
Backups create another risk. A well-protected domain controller provides little security if an attacker can retrieve the same database from an inadequately secured backup share.
The agencies describe unauthorised loss of ntds.dit as evidence of complete domain compromise. Recovery may require coordinated resets of user, service, machine and trust-account passwords. In the most serious cases, the organisation may need to construct a new forest and retire the compromised one.
This is a significantly more disruptive process than rebuilding several infected workstations. It can affect every application, server and business process dependent on the original domain.
Forged Kerberos tickets provide durable access
Golden Ticket and Silver Ticket attacks allow adversaries to forge Kerberos credentials.
A Golden Ticket is created using the secret belonging to the domain’s KRBTGT account. It can allow an attacker to claim almost any identity or group membership when requesting access across the domain.
A Silver Ticket is generally narrower. It uses the password hash of a service or computer account to forge a ticket for a particular service, such as a database or web application. However, these tickets can be difficult to detect because the attacker may communicate directly with the target service without obtaining a new service ticket from a domain controller.
MITRE describes stolen or forged Kerberos tickets as a mechanism for bypassing conventional authentication and supporting lateral movement and persistence. A pass-the-ticket attack can also reuse an already issued ticket without knowledge of the user’s password, according toMITRE’s T1550.003 documentation.
If the KRBTGT account is compromised, its password must normally be reset twice, with sufficient time allowed for replication between resets. Resetting it only once may leave older key material valid. Organisations must carefully plan the operation because improperly coordinated changes can disrupt authentication.
Hybrid identity expands the potential blast radius
The guidance warns that on-premises compromise can spread into cloud services through AD FS and Microsoft Entra Connect.
In a Golden SAML attack, an adversary steals the token-signing certificate and private key used by AD FS. The attacker can then forge SAML responses that appear to come from the trusted identity provider.
This can enable impersonation of users and access to connected cloud services. If a relying party accepts the identity provider’s MFA claim, the forged response may also appear to have satisfied MFA even though no legitimate authentication took place.
Golden SAML is particularly difficult to identify after the attacker has obtained the signing material because fabricated responses can resemble valid activity. Defenders should monitor certificate export events, AD FS configuration changes and discrepancies between cloud sign-ins and corresponding AD FS authentication records.
The agencies recommend protecting AD FS servers at the same security tier as domain controllers, using a gMSA for the AD FS service, limiting administrative pathways and rotating token-signing and token-encryption certificates after any suspected compromise. The updated guidance recommends periodic certificate rotation even in the absence of a confirmed incident.
Microsoft Entra Connect represents another high-value bridge. Depending on its configuration, it may hold or facilitate access to credentials and permissions that affect both on-premises Active Directory and Microsoft Entra ID.
A compromised synchronisation server could allow an attacker to extract service-account credentials, obtain directory-replication rights or manipulate cloud identities. In password hash synchronisation deployments, the associated on-premises account has access that can resemble the permissions needed for DCSync. The cloud synchronisation identity can also hold powerful directory privileges.
Microsoft documented the operational impact of this trust relationship in its investigation ofStorm-0501’s movement from on-premises networks into cloud environments. In observed attacks, stolen credentials supported lateral movement, compromise of domain administrators and eventual ransomware deployment.
The joint agencies recommend keeping on-premises and cloud administrator identities separate, avoiding synchronisation of privileged AD accounts into Entra ID, enforcing phishing-resistant MFA for cloud administrators and severely restricting administrative access to Entra Connect servers.
Shadow credentials create password-reset-resistant persistence
One of the most significant additions to the updated guidance concerns shadow credentials.
The technique modifies the msDS-KeyCredentialLink attribute of an Active Directory user or computer object. That attribute supports certificate-backed and passwordless authentication mechanisms, including Windows Hello for Business.
An attacker with permission to modify the target object can add unauthorised public-key material and then authenticate as that identity using the corresponding private key. The attacker can request a Kerberos ticket-granting ticket and inherit the permissions of the targeted user or computer.
This is especially dangerous because legitimate and malicious key credentials can coexist. Resetting the account’s password may not remove the attacker’s certificate-based access.
The agencies recommend limiting membership of Domain Admins, Key Admins and Enterprise Key Admins, reviewing delegated permissions that permit changes to msDS-KeyCredentialLink, and periodically examining users and computers for unexpected key credentials.
Organisations should enable Directory Service Changes auditing and configure appropriate system access control lists. A modification can generate Event ID 5136 on the domain controller that processed the change. Records in which the LDAP attribute is msDS-KeyCredentialLink and the modifying identity is not an approved passwordless provisioning service should be investigated.
In an environment that does not use passwordless authentication, the presence of any key credential in that attribute may be suspicious.
Canary objects can reveal reconnaissance before escalation
The guidance acknowledges that many Active Directory attacks are difficult to detect because they use legitimate features and generate events that also occur during normal administration.
To improve visibility, the agencies recommend strategically deploying canary objects. These are decoy users or other directory objects that have no legitimate operational purpose but are designed to attract automated enumeration.
A canary can be configured so that attempts to read it produce an audited access failure. If its unique identifier appears in Event ID 4662, the organisation may have detected an attacker or reconnaissance tool enumerating Active Directory.
Canaries can provide early warning of Kerberoasting, AS-REP roasting, DCSync and broader directory discovery. They are particularly useful because the alert is based on interaction with an object that legitimate users should never access.
They are not a complete replacement for event correlation, however. A careful attacker targeting one known account may never touch the decoy. Organisations still need centralised collection and timely analysis of domain controller, certificate authority, federation and synchronisation logs.
Privileged-access separation is the central defence
Across the guidance, the strongest recurring recommendation is to isolate the organisation’s most powerful identities and systems.
The agencies advise organisations to apply a tiered administrative model in which lower-trust systems cannot influence higher-trust infrastructure. Tier 0 includes domain controllers, enterprise certification authorities, AD FS systems, Entra Connect servers, backup infrastructure and accounts with control over the domain.
Tier 0 administrators should not browse the web, read ordinary email or sign in to standard workstations using privileged credentials. Administration should take place through dedicated privileged access workstations or hardened jump systems.
Microsoft’scurrent tier model for Active Directoryapplies an integrity principle under which lower-trust assets must not be able to control higher-trust ones. The architecture is intended to limit credential exposure and prevent the compromise of an ordinary workstation from becoming a path to domain control.
Phishing-resistant MFA remains important, particularly for remote access and cloud administration. But the guidance makes clear that MFA must operate alongside privilege separation, credential isolation, secure administration, protocol hardening and comprehensive logging.
An attacker who steals a domain administrator’s session, compromises an identity server or forges trusted authentication material may be able to bypass controls that would stop a conventional password attack.
Organisations urged to treat identity systems as critical infrastructure
The updated publication reframes Active Directory security as an enterprise resilience issue rather than a routine server-hardening exercise.
For many organisations, losing control of the directory means losing the trust foundation on which the rest of the network depends. Incident responders may no longer be able to assume that accounts, group memberships, certificates, Kerberos tickets or federated authentication assertions are legitimate.
The NSA previously described Active Directory as an attractive target offering attackers the “keys to the kingdom.” Itsannouncement accompanying the original joint reportwarned that domain control could allow adversaries to bypass other protections and access email, file servers and critical applications.
The practical message from the updated guidance is that organisations should not wait for an incident before mapping their directory, auditing privileged relationships and testing recovery procedures.
Priority work should include reducing privileged group membership, separating administrative identities, replacing conventional service accounts with gMSAs, disabling unnecessary legacy authentication, reviewing certificate templates, auditing replication permissions, protecting backups, monitoring sensitive attribute changes and securing the systems that connect Active Directory to cloud identity platforms.
Once an attacker has stolen the domain’s most sensitive cryptographic secrets, routine remediation measures may no longer be enough. Password resets, endpoint reimaging and malware removal can leave forged certificates, federation keys, shadow credentials and Kerberos persistence mechanisms untouched.
Preventing domain-level compromise—and maintaining the evidence needed to identify it quickly—is therefore far less disruptive than attempting to restore trust after the directory itself has fallen under an attacker’s control.
