Active Directory Assessment skill for Codex

The goal is a defensible directory: fewer and longer paths to Tier 0 (Domain Admins and the systems that control them), least privilege on everything that can escalate, and modern defaults for credentials and signing. Done well means the review was authorized and read-only, each finding names the exact objects it concerns, and the fixes are ordered by how much exposure they remove, with change control for anything touching domain controllers.

Gate 0: authorization and read-only scope

Assessment tools query every object in the directory and EDR products flag that activity. Before running anything, confirm in writing with the user:

• Written approval from the AD owner, and notice to the SOC, naming the assessor, the domains and in-scope trusts, and the window.
• This is a read-only hardening assessment. Interpreting collected data and recommending fixes is the scope here; actively exploiting findings is a separate engagement with its own rules of engagement and is not covered by this skill.
• Who applies changes, and the change-control process for domain controllers.

Run collection from an account with normal domain-user read rights where possible; no step here needs to write to the directory.

Inputs to work from

Prefer existing exports the owner already produced. The common sources:

Source	Gives you
PingCastle health report (HTML/XML)	A scored risk report: stale accounts, trusts, delegation, obsolete OS, GPO issues
BloodHound CE data (collected with SharpHound, read-only)	Graph of rights between principals; shortest paths to high-value groups
Get-ADUser/Get-ADGroup/Get-ADObject (RSAT PowerShell, read-only)	Specific object attributes to confirm a finding
AD CS inspection (certificate template ACLs and flags)	Risky certificate templates that allow privilege escalation

Treat these exports as sensitive: they map the whole org’s privilege. Store them in a restricted location and never upload them to third-party services.

What to look for, and the fix

Area	Finding	Hardening
Tiering	DAs log on to workstations; no admin tier separation	Implement a tier model; Tier 0 accounts only on Tier 0 hosts; authentication policy silos
Privileged groups	Large or stale Domain/Enterprise/Schema Admins; nested groups hiding members	Empty standing membership; just-in-time elevation; review nested paths
Kerberos	Service accounts with SPNs and weak/old passwords (Kerberoastable)	Move to Group Managed Service Accounts (gMSA); strong passwords; remove unused SPNs
Delegation	Unconstrained delegation on non-DC hosts; risky constrained/RBCD config	Remove unconstrained delegation; mark Tier 0 accounts “sensitive, cannot be delegated”
Local admin	Shared local admin password across machines	Deploy Windows LAPS; unique rotated local admin passwords
AD CS	Templates allowing requester-supplied subject + client auth to low-priv users	Fix vulnerable template ACLs and flags; restrict enrollment; enforce manager approval
Signing	LDAP signing not required; SMB signing off	Require LDAP channel binding and signing; enforce SMB signing via GPO
Protocols	NTLMv1 or LM allowed; legacy auth	Disable NTLMv1/LM; plan NTLM reduction; audit before enforce
Hygiene	Stale accounts/computers, passwords that never expire, krbtgt not rotated	Disable stale objects; rotate krbtgt twice (with the documented interval between); enforce password policy and MFA for admins

Prioritise by path reduction

Use the BloodHound graph to rank fixes by effect, not by raw count:

1. List the shortest paths to Tier 0 groups.
2. For each, find the single edge whose removal breaks the most paths (an over-permissive group ACL, an unconstrained-delegation host, a reused local admin credential).
3. Fix the edges with the widest effect first. One corrected ACL often removes dozens of paths.
4. Re-collect and re-run the pathing query to confirm the paths are gone.

Applying changes safely

• Everything touching domain controllers or domain-wide GPOs goes through change control and the owner’s maintenance window, never ad hoc. Propose the change and get explicit confirmation; the user applies it.
• Roll out signing and NTLM changes in audit mode first (log what would break), fix the flagged legacy clients, then enforce. Enforcing LDAP signing or SMB signing cold can lock out line-of-business apps and appliances.
• krbtgt rotation twice in quick succession invalidates existing tickets; schedule it and warn the owner about the short-lived disruption.
• Keep a rollback for each GPO change and test on a pilot OU before domain-wide linkage.

Gotchas

• Collection data is a point in time; privilege changes daily. Date every export and note the collection account’s own rights (they appear in the graph).
• “Domain Admins is small” can still be unsafe if a group it is nested in, or a GPO it depends on, is writable by many users. Follow the edges, not just the memberships.
• Disabling, not deleting, stale privileged accounts first; deletion can break services that silently depend on them.
• Azure AD / Entra ID hybrid paths (Entra Connect sync account, PHS/PTA servers) extend Tier 0 into the cloud; include the sync server as a Tier 0 host.

Verification and output

• Re-run PingCastle and the BloodHound path queries after fixes; the risk score drops and the targeted paths no longer resolve.
• Confirm LAPS is populating and rotating, gMSA accounts are in use, and signing GPOs applied (gpresult, event logs) without new auth failures.

## AD hardening assessment: CONTOSO.LOCAL (collected 2026-10-20, read-only, PingCastle 3.x + BloodHound CE)
Score: 70 -> target < 30 | Paths to Domain Admins: 214 -> after top 5 fixes (modelled) 23

| # | Finding | Objects | Paths cut | Fix | Change window |
|---|---|---|---|---|---|
| 1 | Unconstrained delegation on APP03 | APP03$ | 88 | Remove delegation; mark Tier 0 sensitive | CR-1420, Sat 02:00 |
| 2 | Helpdesk group has GenericAll on Servers OU | GG-Helpdesk | 46 | Scope ACL to needed objects | CR-1421 |
| 3 | 12 Kerberoastable SPNs, passwords > 2y | svc-* | 31 | Migrate to gMSA; remove dead SPNs | CR-1430 |

Validation that a specific change is appropriate for the environment rests with the AD owner; flag anything that could disrupt authentication before it is enforced.