You’ve commissioned your first internal penetration test, the tester connects to your network and begins hunting for vulnerabilities and misconfigurations, and before lunch, you’re getting high severity alerts from Defender about lateral movement and suspicious logins to Domain Controllers (DCs). What happened? Here are three high-impact Active Directory (AD) vulnerabilities which Bastion regularly encounters on internal penetration tests and red team exercises which allow for privilege escalation to the highest levels.
Active Directory Certificate Services (AD CS)
Bastion routinely identifies AD CS configuration weaknesses within customer environments which could allow an attacker to rapidly escalate privileges. The most common of these weaknesses were publicised in 2021 by Will Schroeder and Lee Christensen in their whitepaper “Certified Pre-Owned".
The most common misconfigurations Bastion are encountering in 2026 are ESC1 and ESC4, which grant standard users excessive enrolment rights and privileges, and ESC8 where an attacker present on the network can relay another user or machine’s authentication message to request a certificate for that user via an NTLM Relay attack.
The ESC1 attack is the most straight forward to execute. A misconfigured template vulnerable to ESC1 allows low-privileged users the ability to request a certificate for another user by supplying a Subject Alternative Name (SAN), provided there aren’t other non-default protections enabled such as Manager Approval. The account impersonated by the attacker can be any user or machine within the domain, including Domain Administrators (DAs).
These issues are security misconfigurations, rather than technical vulnerabilities. There have been several vulnerabilities related to AD CS over the years; Most recently, the Certighost vulnerability (CVE-2026-54121) which allowed for the impersonation of DCs. CVE-2026-54121 has been patched in Microsoft’s July 2026 “Patch Tuesday” release.
LDAP Signing and Channel Binding
LDAP Signing and LDAPS Channel Binding protect the integrity of communication and authentication between DCs and their clients. Without these protections, attackers can intercept and relay authentication from legitimate clients, abusing the privileges of the relayed account to modify AD configuration and access other servers.
An attacker present within a corporate network could perform an NTLM relay attack, setting up a rouge authentication server which can relay any client authentication it receives to a DC. An attacker can induce clients to authenticate to their rouge server by impersonating other clients (DNS Poisoning), coercing authentication from clients using Remote Procedure Calls (RPC), or planting files on SMB shares which prompt a client to authenticate.
Prior to the release of Server 2025, DCs did not require LDAP signing and LDAPS Channel Binding by default. New AD deployments with Server 2025 DCs now require LDAP Signing and enforce LDAPS Channel Binding “when supported”. However, DCs upgraded to Server 2025 will not adopt these new defaults. Any existing group policy settings will also take precedence over these new defaults.
Good security practice recommends setting LDAP Signing to ‘Require signing’, and LDAPS Channel Binding to ‘Always’ within a GPO applied to all DCs within the environment.
Over-privileged Accounts
Bastion regularly sees user accounts with excessive privileges assigned, the worst of which could allow an attacker to escalate from such an account to Domain Administrator. These privileges are often assigned temporarily for a user to perform a specific task, or assigned to service accounts to get them working quickly, however these privileges are often forgotten about and persist years later.
Microsoft recommends following a three-tier model for managing privileges within an AD environment. Tier 0 covers accounts and services with domain-wide control over identity and privileges, such as DAs, DCs, and other identity services such as Certificate and Federation services. Tier 1 covers servers and their administrators, while Tier 2 covers end user devices and administrators.
Conclusion
These vulnerabilities and misconfigurations are routinely used by attackers to move laterally, escalate privileges, and achieve domain dominance within on-premises or hybrid AD domains.
Here are five actions which your organisation can take to harden your AD environment:
- Ensure your systems are up to date with the latest patches, including the July 2026 “Patch Tuesday” release which patched a critical AD CS vulnerability (Certighost).
- Review your AD CS certificate templates for common misconfigurations.
- Enable LDAP Signing and LDAPS Channel Binding across all domain controllers within your environment.
- Apply the Principal of Least Privilege when granting permissions. Provide the minimal set of permissions to a user necessary to complete their task and remove elevated permissions once they are no longer actively needed.
- For users who require administrator privileges, create separate accounts for their day-to-day use and administrative tasks. Ensure that these accounts do not share the same password.
An internal penetration test or AD configuration review can be an excellent starting point to identify these issues and more before committing to a red or purple team exercise. If you are unsure about the current security posture of your corporate network and AD domain, or whether an internal penetration test or red/purple team exercise would be best for your organisation, please contact us – we are here to help.