Security agencies around the globe have released a joint guide warning enterprises about 17 proven tactics attackers use to compromise Active Directory (AD) environments. Published September 15, 2026, the guidance comes from CISA along with counterparts in Australia, Canada, the UK, New Zealand, and the U.S. National Security Agency. Its goal: help organizations defend three key pillars—Active Directory Domain Services, Active Directory Certificate Services, and Active Directory Federation Services.
How Attackers Break In
The document reveals that AD remains an enticing target because it underpins authentication and authorization across many systems. Once compromised, attackers can gain control over user accounts, servers, workstations, email systems, business applications, even cloud connections. These risks are magnified by permissive default settings, reliance on legacy protocols, and complex user-group-system relationships that administrators may overlook.
Here are several of the most critical techniques outlined:
- Kerberoasting: Requesting service tickets for accounts with service principal names (SPNs), then cracking those tickets offline to extract service account passwords.
- AS-REP Roasting: Targeting accounts that don’t require Kerberos pre-authentication by getting encrypted responses and cracking them offline to recover passwords.
- Password Spraying: Trying a few known or common passwords across a wide set of accounts to avoid detection via lockouts.
- Machine Account Quota Abuse: Exploiting the number of computer objects regular users can create, then using the inherited permissions for lateral movement or privilege escalation.
- Unconstrained Delegation: Compromising a server with delegation enabled to pull credentials from LSASS, including tickets of privileged users.
- Group Policy Preferences Password Leak: Extracting legacy “cpassword” values in SYSVOL that can be decrypted with a well-known AES key.
- AD CS Template Misconfiguration: Misconfigured certificate templates or authorities that allow attackers to request certificates for high-privilege users.
- Golden Certificate: Stealing an entire certificate authority’s certificate and private key to forge trusted certificates for users, maintaining persistent access.
- DCSync: Using replication permissions to mimic domain controllers and pull even the most sensitive credential hashes.
- Dumping ntds.dit: Extracting the Active Directory database and SYSTEM registry hive to crack credentials offline.
- Golden Ticket: Forging Kerberos ticket-granting tickets using a compromised hash to gain deep, persistent access.
- Silver Ticket: Forging service tickets from stolen service-account or computer-account hashes to access specific services without full authentication routines.
- Golden SAML: Stealing AD FS’s signing certificate and private key to forge SAML tokens, allowing impersonation of users across services like Microsoft 365 or Azure.
- Microsoft Entra Connect Compromise: Targeting sync features and privileged sync accounts between on-premises AD and Entra ID.
- One-Way Trust Bypass: Using a trusted domain’s hashed credentials to request Kerberos tickets across domains, despite intended trust direction.
- SID History Tampering: Adding privileged security identifiers to sIDHistory attributes to grant elevated permissions while hiding origin.
- Skeleton Key: Modifying the LSASS process so a master password works across accounts, while original passwords still function.
- Shadow Credentials: Injecting a public key into msDS-KeyCredentialLink to support certificate-based logins without altering passwords, evading traditional password monitoring.
How to Defend & Detect These Threats
The guide recommends treating domain controllers, certificate authorities, AD FS servers, and Entra Connect as “Tier 0” assets—requiring the highest protection. Key defensive actions include:
- Enforcing phishing-resistant multifactor authentication.
- Using secure administrative workstations and minimizing delegated permissions.
- Getting rid of unnecessary SPNs and migrating service accounts to group Managed Service Accounts where possible.
- Enforcing Kerberos pre-authentication, ensuring AES encryption, setting MS-DS-MachineAccountQuota to zero, disabling unconstrained delegation, removing legacy Group Policy passwords, and disabling insecure protocols like NTLM and SMBv1 where feasible.
- Regularly protecting LSASS, resetting the KRBTGT account password—twice—after any compromise, and auditing certificate templates, modifications to SID History, or msDS-KeyCredentialLink.
- Strengthening detection by centralizing logs from domain controllers, certificate authorities, AD FS, and Entra Connect; and paying attention to specific event IDs tied to Kerberos anomalies, replication events, unexpected computer account creation, certificate issuance, and directory object changes.
The document notes that many of these attack methods are subtle: attackers often mirror legitimate administrative behavior, making abnormal activity hard to catch unless there’s a strong baseline of what “normal” looks like.
Defending Active Directory isn’t new, but this consolidated, multi-agency guidance frames a coherent roadmap for risk mitigation. Organizations should take this as a wake-up call to audit their AD configurations hard, reduce legacy exposure, and ensure that detection tools are aligned. Expect primary focus areas to include Krbtgt hardening, certificate authorities, SPN inventory, and trust relationships. Continuous monitoring and proactive housekeeping will likely separate safe enterprises from breaches in the next wave of Active Directory attacks.
