Knowledge base
Active Directory attack paths, explained
What each weakness is, why attackers want it and how to fix it, written so anyone responsible for Active Directory can act on it.
Start with the concepts
New to attack paths? These short pages explain the ideas every finding builds on, in plain language.
- What is Tier Zero?Tier Zero explained in plain language: the accounts, servers and objects that control an Active Directory domain, what belongs in it, and how Pathwarden finds and protects it.
- Attack pathsWhat an Active Directory attack path is: chains of group memberships, permissions, logons and delegation that lead from an ordinary account to Tier Zero, and how Pathwarden finds them.
- Exposure and Tier Zero protectedHow Pathwarden counts the accounts with an attack path to Tier Zero, sets the Tier Zero status, rates each finding from its exposure, and counts the Tier Zero objects no open attack path reaches.
- The remediation pathHow Pathwarden's remediation path works: a minimum cut between exposed accounts and Tier Zero, what each plan step means, and how plan steps relate to findings.
- Findings lifecycle and retestHow Pathwarden tracks findings across runs (new, open, back, fixed), retests them after a fix (Fixed, Still open, Can't tell), and why a failed collection never closes a ticket.
- Privilege ZonesPrivilege Zones in plain language: tiering beyond Tier Zero, how zones relate to Tier Zero, and how Pathwarden measures and defends each zone.
- Accepted riskHow to accept a risk in Pathwarden: matching a finding or a rule, the required reason, review dates, and how accepted risks affect the headline numbers, tickets and reports.
- GlossaryEvery term Pathwarden uses, defined once.
Every weakness Pathwarden checks
Pathwarden runs 38 rules against your directory. Each article explains the weakness in plain language, how attackers use it, how Pathwarden finds it, and how to fix it step by step, with PowerShell, verification and rollback. The same guides are built into the binary: pathwarden guide PW-015.
Control and privilege paths
Permissions, group nesting, logons and delegation that let an ordinary account take over the domain. These are the paths attackers map first.
- PW-001Broad group has a path to Tier ZeroAttack path
- PW-002Account or group outside Tier Zero can DCSyncAttack path
- PW-003Account or group outside Tier Zero controls a Tier Zero objectAttack path
- PW-004Tier Zero account logged on to computers outside Tier ZeroAttack path
- PW-005Unconstrained delegation outside domain controllersAttack path
- PW-022Account or group outside a Privilege Zone controls a zone objectAttack path
- PW-023Account or group outside Tier Zero can log on to domain controllersHygiene
Kerberos, passwords and credentials
Weak or exposed credentials that turn a single foothold into privileged access: roastable accounts, unprotected admins, stale and shared passwords.
- PW-006Kerberoastable account with Tier Zero accessAttack path
- PW-007Kerberos pre-authentication disabled (AS-REP roasting)Attack path
- PW-008Tier Zero accounts without delegation protectionHygiene
- PW-009Stale Tier Zero accountsHygiene
- PW-010Old Tier Zero passwordsHygiene
- PW-011Computers without LAPSHygiene
- PW-013Accounts that may have an empty passwordHygiene
- PW-014krbtgt password not rotatedHygiene
- PW-033Tier Zero account's password stored on computers outside Tier ZeroAttack path
- PW-037Seamless SSO Kerberos key not rolled overHygiene
Certificate Services (AD CS)
Misconfigured certificate templates and CAs that hand out logon certificates for any identity, often to every domain user.
- PW-015AD CS ESC1: template lets requesters choose any identityAttack path
- PW-016AD CS ESC3: enrollment agent abuseAttack path
- PW-017AD CS ESC4: write access to a template from outside Tier ZeroAttack path
- PW-018AD CS ESC6: CA accepts requester-supplied SANsAttack path
- PW-019AD CS ESC8: NTLM relay to web enrollmentAttack path
- PW-020AD CS ESC9/ESC10: weak certificate mappingAttack path
- PW-021AD CS ESC13: issuance policy linked to a groupAttack path
- PW-036AD CS ESC11: NTLM relay to the CA's RPC interfaceAttack path
Group Policy and SYSVOL
Passwords and write access hiding in the SYSVOL share, where every computer and user picks up its policy.
Trusts, management planes and other systems
The routes into Tier Zero that AD permissions alone don't show: forest trusts, management servers, and other systems that hold the keys.
- PW-012Trust between forests with weak SID filteringHygiene
- PW-025Tier Zero computers managed by a system outside Tier ZeroAttack path
- PW-028Possible management plane: review whether it manages Tier ZeroHygiene
- PW-029ESX Admins group open to accounts outside Tier Zero (CVE-2024-37085)Hygiene
- PW-030Object outside Tier Zero controls a Tier Zero object through another systemAttack path
- PW-034SQL Server runs as a Tier Zero accountAttack path
- PW-035Tier Zero computer managed by SCCM from outside Tier ZeroAttack path
- PW-039Tier Zero computers are virtual machines of an unmodeled hypervisorHygiene
Entra ID and hybrid
Paths that cross between on-premises Active Directory and Microsoft Entra ID, in either direction.