I wrote a concise walkthrough of the Active Directory Basics room from the TryHackMe CompTIA Pentest+ path and boiled it down to the tactical things you actually need to remember when doing AD recon and small-scope pentests. Full write-up and answers here.
Why this matters (TL;DR)
-
AD is the central repo for identities, machines, policies , compromise the directory and you compromise the org.
-
OUs are for applying policies (GPOs); Security Groups are for resource permissions , don’t mix them up when planning lateral moves.
Practical enumeration checklist (PowerView first-pass)
Run these to build your map quickly:
Get-NetDomain Get-NetUser Get-NetGroup Get-NetComputer Get-DomainPolicy
What to look for: users in high-priv groups (Domain Admins), service accounts, machines with old password change dates, and machines that are file servers or domain controllers. These commands and filters are shown in the walkthrough.
Auth & trust notes
-
Kerberos is the primary modern auth (tickets), NTLM still exists , both have different attack surfaces (e.g., Kerberoasting vs NTLM relay).
-
Understand trust directions: directional vs transitive trusts change how an account in one domain can access resources in another.
Quick study tips for the room
-
Memorize where GPOs live (
SYSVOL) and what Enterprise Admins vs Domain Admins can do. -
Practice extracting group memberships and filtering by attributes (OS, password last set) , those tiny details guide your attack path.
0 comments