---
title: "What pentesters fix first: 5 Active Directory hardening wins"
description: "AI makes old Active Directory attacks faster, not new. Pentester Spencer Alessi shares 5 hardening fixes to make first, and how to roll them out."
locale: "en"
updated_at: "2026-10-21T10:13:04.068Z"
canonical: "https://www.isdecisions.com/en/authentication-insights/what-pentesters-fix-first-active-directory-hardening"
---

# What pentesters fix first: 5 Active Directory hardening wins

_Authentication Insights webinar recap_

AI hasn't changed how attackers break into Active Directory. It has made the old attacks cheaper. Pentester and Microsoft MVP Spencer Alessi shares five high-impact fixes he recommends first.

**AI hasn't given attackers new ways into Active Directory. It has made the old ones cheaper, faster and easier to run at scale. The fixes pentesters have recommended for years still work, and skipping them is riskier than it used to be.**

That was the main message of the first Authentication Insights webinar on October 14, 2026. Spencer Alessi, senior penetration tester at SecurIT360 and Microsoft MVP, joined cybersecurity journalist John E. Dunn. They covered the five [Active Directory hardening](/blog/active-directory/active-directory-hardening) fixes Spencer makes first, how to decide what to prioritize, and a pentest where the defenses held.

### What AI changes for Active Directory attacks, and what it doesn't

Spencer opened with a line he repeats often: "You can't get away with as much anymore." Ransomware exposed IT teams that skipped the basics. AI raises the stakes again.

He grounded the discussion in two recent reports.

- [Anthropic's threat intelligence report](https://www.anthropic.com/threat-intelligence-report-september-2026) shows attackers using AI to write and rewrite their tools, and to chain vulnerability discovery and exploitation into automated pipelines. Rewritten tools carry no known signatures, so static detections lose value. Behavior-based detection matters more.
- [GreyNoise's report on a PaperCut exploitation campaign](https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf) describes a Russian group that targeted about 500 organizations and reached domain admin in some of them. None of the techniques were new: Kerberoasting, certificate abuse, credential dumping, and well-known offensive tools such as Mimikatz, Impacket, NetExec, Certify and Rubeus.

"When we're talking about Active Directory, all the attacks, all the abuses, they're all known," Spencer said. "We know how to defend against them."

**The takeaway for admins: obscurity and attacker effort no longer protect you. But the defenses are the same ones that have always worked.**

### How to decide which findings to fix first

Free tools will find plenty of problems. The hard part is deciding what to fix first. 

"If you have a report with 20 findings, you can't fix all of them," Spencer said.

He ranks findings with four questions, which he calls the P.R.I.D. model:

- **Privileges:** What can an attacker do?
- **Reach:** Where can they go?
- **Impact:** How bad would it be?
- **Detection:** Would you see it?

The goal is to raise the cost of an attack. A finding with broad privileges, wide reach, high impact and little chance of detection goes to the top of the list.

Privileges need special attention. In Active Directory, every object has permissions, and AD gives no warning when you grant a dangerous one. Most environments have dangerous permissions nobody knows about.

Spencer's advice is to document your access model, by department and role or by application, and to track every change. 

On one pentest, he found the Everyone group with full control over the root of the domain. Nobody on the IT team knew when or how it was set, or whether an attacker had done it. Without a record, nobody could say whether reverting it would break anything.

### 5 Active Directory hardening wins, in order of effort

Spencer picks fixes with high impact, a low chance of breaking things, and the most protection per hour of work. Three are quick wins that take hours to days. Two are longer projects.

**1. Deploy LAPS (quick win)**

Windows LAPS randomizes the local administrator password on every machine. One compromised workstation no longer hands an attacker a shared password to move across the network. LAPS is built into Windows, Active Directory and Intune. It takes hours to deploy in a small organization and days to a couple of weeks in a large one.

Spencer sees shared local admin rights less often than he used to. They're still common in education, where staff get local admin to install software.

**2. Audit and fix certificate templates (quick win)**

Misconfigured Active Directory Certificate Services (AD CS) templates are one of the attack paths Spencer finds most often on internal pentests. Many teams don't know they run AD CS at all, because an MSP or vendor set it up and left. Some vendor software also requires insecure template settings by design.

Run [Locksmith](https://github.com/jakehildreth/Locksmith), a free PowerShell tool by Jake Hildreth. It checks for known AD CS misconfigurations, explains each risk and, for many issues, gives a PowerShell snippet to fix it. Review those snippets before you run them. Start with ESC1, ESC2, ESC4 and ESC8, the most dangerous.

Spencer recommends running Locksmith after every AD CS change and once a quarter.

**3. Fix dangerous permissions (quick win)**

Spencer's method works at any skill level: look for dangerous groups with dangerous permissions on privileged resources.

- **Dangerous groups:** Domain Users, Authenticated Users, Domain Computers, Everyone, and non-admin groups such as Accounting or Sales.
- **Dangerous permissions:** Full Control, change ownership, create and delete objects, and similar rights that are normal for admins but not for anyone else.
- **Privileged resources:** Tier 0, meaning domain controllers, the Domain Controllers OU, Domain Admins and Enterprise Admins.

Start with Tier 0 and work outward. ADeleg lists every non-default delegation in the domain, and [ADeleginator](https://github.com/techspence/ADeleginator) automates the search for risky ones. The NetTools permission viewer highlights dangerous permissions in red.

[HardenAD](https://github.com/LoicVeirman/HardenAD), an open-source PowerShell toolkit also helps automate detection of AD misconfigurations and helps implement Tier Modeling (ESAE) delegation models to stop privilege escalation.

**4. Lock down service accounts (longer project)**

Service accounts help attackers move laterally and stay in an environment. Spencer's priorities:

- Long, unique passwords that aren't stored in web.config files or scripts.
- Least privilege. A SQL service account should never be a member of Domain Admins, and the built-in Administrator account should never run a service.
- Fewer SPNs. Audit service principal names and remove the ones you don't need to reduce Kerberoasting risk.
- Restricted group membership.

Group managed service accounts (gMSAs) remove much of the password work. Map dependencies before you change anything, because service account changes can break applications.

**5. Phase out NTLM (longer project)**

NTLM survives partly because third-party products, from virtualization platforms to storage appliances and firewalls, still depend on it. Spencer says vendors share responsibility with Microsoft for updating their software.

Treat this as a long project. Start at LAN Manager authentication level 3, the default. Then move to levels 4 and 5 on workstations, then servers, then domain controllers. Audit NTLM use before each step.

### How to roll out changes without breaking production

For every fix on the list, Spencer's rule is the same: never switch a change on everywhere at once. Start with a test group of machines and a few power users. Move department by department, then to servers. Small steps keep the work manageable and protect the IT team's credibility.

He learned this early. As a new security admin, he uninstalled an outdated Microsoft XML 4.0 component from an application server. Ten minutes later, the application admin told him the whole company was down.

The lesson isn't to avoid change. "Sometimes things have to break, so you know what to fix," Spencer said. Break them on purpose, with documentation and a rollback plan.

The hardest part is often not technical. Spencer sees many teams that want to harden their environments but stall on management, team dynamics, or one admin who refuses a separate admin account and [MFA](/userlock/features/multi-factor-authentication-mfa-active-directory). 

**"The technical stuff is easy," he said. "Working with the business, testing it, rolling the changes out, communicating, that's the hard part."**

### Case study: a pentester with domain admin credentials and nowhere to go

Spencer closed with a pentest that shows hardening works. A law firm asked him to test identity-based attacks: pass-the-hash, pass-the-ticket, silver tickets and golden tickets. The firm gave him a domain admin credential on a domain-joined machine. In most environments, that's the worst case.

Every attack failed. The firm's third-party identity protection tool held.

Then the firm tried something else. It removed the third-party tool and relied only on built-in Windows and Active Directory features: Protected Users, logon restrictions, authentication policies and Windows Firewall. The defenses still held. Even with domain admin credentials, Spencer couldn't move off the first endpoint.

**"[In] Active Directory, even though it's 26 years old, the features are there to defend it well," he said. "You just have to work a little bit harder."**

He compared it to remodeling a bathroom. You can do it yourself, which takes longer but teaches you the skills, or hire a contractor. Teams that struggle to keep track of their environment may get further, faster with a third-party tool. Teams with the time and skills can do it themselves. Many combine both.

### How to measure your progress

Spencer suggests using the scores PingCastle and Purple Knight give you. Record your score, fix what you can, and run the tool again every quarter or twice a year.

For a hardening plan, there's no single guide that fits every environment. Combine the published guidance, such as CISA's recommendations, the Australian Signals Directorate's guide to detecting and mitigating Active Directory compromises, and MITRE ATT&CK mitigation M1015 (Active Directory Configuration). Then compare it with your own environment and build a plan.

One warning from the Q&A: moving to Microsoft Entra ID doesn't fix an insecure Active Directory, especially when the two are synced. Entra ID also takes a different skill set, and many teams find the gap only after they go hybrid.

**[Watch the full webinar](https://www.youtube.com/watch?v=ERhZ7m-fOu0&t=1s)**