AD Governance: control & audit of Active Directory

AD Governance refers to the set of policies, processes, and technical controls that enforce control and audit of Active Directory environments. Active Directory remains the central identity fabric in most enterprise networks. Poor governance directly enables privilege escalation, lateral movement, and persistent access by attackers. AD Governance covers four core pillars: account lifecycle management, privilege delegation models, group membership hygiene, and audit policy enforcement. The Tier model (Tier 0, Tier 1, Tier 2) structures administrative boundaries to limit the blast radius of a compromised account. Delegation must follow least-privilege principles: no account should hold rights beyond its operational scope. Group Policy Objects define baseline security settings across the domain. Stale accounts, over-permissioned groups, and orphaned service accounts are the most common governance failures exploited in real-world intrusions. AD Governance is therefore not a compliance checkbox — it is a direct attack surface reduction discipline that shapes the difficulty of every post-exploitation phase an adversary attempts inside a Windows environment.

Blue Team detection of AD Governance failures relies heavily on Windows Security event logs. Event ID 4728, 4732, and 4756 track membership additions to privileged groups such as Domain Admins, Enterprise Admins, and Administrators. Event ID 4670 captures permission changes on Active Directory objects. Event ID 5136 logs directory service object modifications, including delegation attribute changes such as 'msDS-AllowedToDelegateTo'. LDAP queries enumerating AdminSDHolder-protected objects or accounts with 'AdminCount=1' should be flagged in network traffic. Tools such as Microsoft Sentinel, Splunk, and Elastic SIEM can correlate these events into detection rules. BloodHound-based queries run against AD data help identify attack paths through misconfigured delegations, nested group memberships, and ACL abuses. Scheduled tasks that review group membership changes on a weekly basis complement real-time alerting. Anomalous Service Principal Name registrations (Event ID 4769) indicate potential Kerberoasting reconnaissance. A mature SOC should also monitor for changes to Default Domain Policy and Default Domain Controllers Policy, as these GPOs control domain-wide authentication and audit settings.

Red Team operators targeting AD Governance weaknesses focus on three primary vectors: ACL abuse, delegation misconfigurations, and stale privileged accounts. WriteDACL, GenericAll, and GenericWrite permissions on high-value objects allow an attacker to grant themselves additional rights without touching privileged groups. Tools such as BloodHound, PowerView, and ADACLScanner enumerate these misconfigurations efficiently. Unconstrained Kerberos delegation on non-DC machines is a critical finding: any account authenticating to that machine exposes its TGT, enabling pass-the-ticket attacks. Constrained delegation with protocol transition (RBCD) can also be abused when an attacker controls a computer account. Shadow Credentials attacks abuse 'msDS-KeyCredentialLink' attribute write permissions. Against these vectors, hardening measures include enabling Protected Users security group membership for Tier 0 accounts, removing legacy unconstrained delegation, auditing ACLs with tools like PingCastle or Purple Knight, enforcing Tiered Administration with Privileged Access Workstations, and applying fine-grained password policies. Regular AD attack path reviews using BloodHound Community Edition or BloodHound Enterprise should be part of every organisation's continuous AD Governance program.