Ethical Hacking & Penetration Testing
Active Directory
Domain identity, Kerberos, paths, and DC hardening — lab-safe.
Eight practical Active Directory labs on an isolated synthetic domain: directory fundamentals, GPO password/lockout baselines, authorized LDAP discovery, Kerberos TGT/TGS/SPN concepts, BloodHound-style attack-path remediation, NTLM relay risk reduction, privilege delegation/gMSA, and DC hardening with event-log audit reporting. Conceptual offensive awareness only — no production attack runbooks.
- Level
- Intermediate
- Duration
- 5–7 weeks
- Modules
- 4 modules · 8 lessons
- Learning method
- Lessons + labs
What you will learn
- Map forest, domain, DC, OU, users, groups, and computers
- Apply GPO password and lockout hygiene without reversible encryption
- Perform authorized LDAP naming-context discovery for inventory and exposure review
- Explain Kerberos TGT/TGS/SPN flows and service-account hardening
- Prioritize BloodHound-style path remediation and least privilege
- Reduce NTLM relay risk and harden delegation, DC logging, and credentials
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
Directory structure and GPO baselines
Forest/domain/DC/OU objects and password/lockout Group Policy.
0/2 lessons
Module 1
Directory structure and GPO baselines
Forest/domain/DC/OU objects and password/lockout Group Policy.
0/2 lessons
Lessons
- 1. Forest, Domain, DC, and OUspreview~20 min
- 2. GPO Password and Lockout Policies~20 min
Enrol to unlock full lessons and track module progress.
Module 2
Authorized discovery and Kerberos concepts
LDAP inventory framing and TGT/TGS/SPN mental models.
0/2 lessons
Module 2
Authorized discovery and Kerberos concepts
LDAP inventory framing and TGT/TGS/SPN mental models.
0/2 lessons
Lessons
- 1. Authorized LDAP Domain Discovery~20 min
- 2. Kerberos TGT, TGS, and SPNs~20 min
Enrol to unlock full lessons and track module progress.
Module 3
Attack paths and NTLM risk reduction
BloodHound-style remediation and Kerberos-first NTLM hardening.
0/2 lessons
Module 3
Attack paths and NTLM risk reduction
BloodHound-style remediation and Kerberos-first NTLM hardening.
0/2 lessons
Lessons
- 1. Attack Path Analysis and Remediation~20 min
- 2. NTLM vs Kerberos and Relay Risk Reduction~20 min
Enrol to unlock full lessons and track module progress.
Module 4
Delegation and DC hardening audit
gMSA/least privilege delegation and event-driven DC audit report.
0/2 lessons
Module 4
Delegation and DC hardening audit
gMSA/least privilege delegation and event-driven DC audit report.
0/2 lessons
Lessons
- 1. Privilege Delegation and Service Accounts~20 min
- 2. DC Hardening and Credential Protection Audit~20 min
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- Active Directory FundamentalsUnlock via course or plan
- Group Policy Hardening BasicsUnlock via course or plan
- Authorized LDAP Domain DiscoveryUnlock via course or plan
- Kerberos Tickets and SPNs (Concepts)Unlock via course or plan
- Attack Path Analysis & RemediationUnlock via course or plan
- NTLM vs Kerberos & Relay Risk ReductionUnlock via course or plan
- Privilege Delegation & Service AccountsUnlock via course or plan
- DC Hardening & Credential Protection AuditUnlock via course or plan
Track quiz
99 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.