TRAINING COURSES
Adversary Perspectives: Active Directory
WHAT TO EXPECT
Know your Active Directory better than attackers do
Active Directory remains the foundation of identity and access management for countless organizations, yet its complexity creates security risks that many network defenders struggle to understand. Kerberos, ADUC, Golden Tickets, Security Principals—these terms appear in penetration test reports and security bulletins, but do your defenders truly understand what they mean?
This foundational course demystifies Active Directory (AD) components and architecture from a security perspective, teaching participants to identify common misconfigurations before attackers do. Whether you’re new to AD security or seeking to strengthen your organization’s defensive posture, understanding your Active Directory environment better than potential attackers is essential for effective protection.
key takeaways
Course summary
Kerberos, ADUC, Golden Tickets, Security Principals – have you come across these or similar words in penetration test reports or security bulletins and felt a little… lost?
Active Directory comprises many components that fulfill complex architectural requirements but can also open cracks through which attackers may slip. The Active Directory: Security Fundamentals course demystifies the various Active Directory components and illustrates how they can potentially introduce risks to your organization. This course empowers network defenders to look under the hood of their Active Directory architecture and understand their environment better than attackers.
Participants will learn
How to enumerate and analyze Active Directory environments using industry-standard tools via hands-on experience with an Active Directory domain that simulates a real corporate environment
How to leverage industry standard tools to proactively identify misconfigurations and determine actionable courses for remediation
How all components of Active Directory fit together and how degradation over time can lead to the appearance of attack paths and misconfigurations
A CLOSER LOOK AT THE COURSE
Adversary Perspectives: Active Directory
This course provides hands-on experience in Active Directory (AD), enabling participants to confidently respond when questions surrounding their organization’s AD architecture arise. Students learn AD components; not only how they work together but also how they can work against your organization’s security posture. Countless organizations leverage AD to provide the foundation or entirety of their production environment’s identity and access management. But widespread usage doesn’t mean AD is simple; beyond its architecture and design considerations lie security implications that can directly impact your organization.
Dig into Active Directory
This course details key components of AD technology and architectures, focusing on the security implications of each. Topics include physical & logical components, forests & domains, Kerberos, and various tooling like ADUC — all from a security perspective. Course participants gain hands-on experience enumerating the architectures and security controls of a live Active Directory environment and analyze the data extracted.
Here’s what we’ll cover:
- Introduction
- Physical and Logical Overview
- Accounts and Access
- LDAP
- Groups
- Forests and Domains
Here’s what we’ll cover:
- AD Security Principles and Models
- Kerberos
- Kerberos Delegation
- Identifying Misconfigurations
- AD Degradation
- Attack Paths
Overview
Dig into Active Directory
This course details key components of AD technology and architectures, focusing on the security implications of each. Topics include physical & logical components, forests & domains, Kerberos, and various tooling like ADUC — all from a security perspective. Course participants gain hands-on experience enumerating the architectures and security controls of a live Active Directory environment and analyze the data extracted.
Day 1
Here’s what we’ll cover:
- Introduction
- Physical and Logical Overview
- Accounts and Access
- LDAP
- Groups
- Forests and Domains
Day 2
Here’s what we’ll cover:
- AD Security Principles and Models
- Kerberos
- Kerberos Delegation
- Identifying Misconfigurations
- AD Degradation
- Attack Paths
Before you attend
Who should attend
This course is intended for security professionals of any experience level looking to learn more about the foundations of Active Directory security and analysis methods.
Prerequisites
This course assumes no prior Active Directory knowledge, though participants would benefit from previous exposure to an enterprise Active Directory environment.
What to bring
Participants must provide their own computer with a modern web browser installed to access training materials and complete the course’s labs. The SpecterOps training platform URL (specterops.training) must be accessible from the participant’s computer throughout the duration of the course.
There are no local virtual machines or special software required to fully participate in the course or labs.
What you receive
During the course, participants receive access to a hands-on training range where they complete labs and work through course objectives.
Upon completion of the course, participants receive:
- A copy of the course slides
- A certificate of completion
- A course challenge coin
- A digital badge
Accepting your digital badge confirms your SpecterOps Training alumni status, which conveys exclusive discounts to future SpecterOps hosted training.
MORE WAYS TO TRAIN
Private and custom training
SpecterOps courses, delivered exclusively for your team. Need something beyond our current offerings? We develop custom curriculum, labs, and CTFs designed around your team’s specific goals and threat landscape. Our training is taught by the same front-line practitioners who conduct our engagements, bringing real-world experience into every course.
DEEPEN YOUR TRADECRAFT
Explore additional training courses
Adversary Perspectives: Azure
Discover how adversaries view, target, and exploit Azure and Entra ID environments.
Adversary Tactics: Red Team Operations
Go beyond Domain Admin and sharpen your offense-in-depth skills.
Adversary Tactics: Identity-Driven Offensive Tradecraft
What turns a path into an attack path? Learn how to find and abuse them.
Adversary Tactics: Detection
Stop chasing indicators. Build detections that focus on how attackers operate.
Adversary Tactics: Tradecraft Analysis
Deconstruct how attack techniques really work, then build detections or learn how to evade them.
SpecterOps Tradecraft Academy
Hands-on offensive and defensive security training built by SpecterOps practitioners, available on demand and designed to be completed at your own pace.
