Discovery and Enumeration

Active Directory is the identity and access backbone of most enterprise Windows networks. This lesson explains how AD organizes users, computers, groups, and policies into a hierarchical structure, why that structure matters for both administrators and attackers, and how to explain it clearly in interviews.

BloodHound maps Active Directory relationships into a graph that reveals privilege escalation paths invisible to manual enumeration. This lesson explains what an attacker does with BloodHound during an AD engagement, what it takes to use it effectively, what the attacker gains, and how to explain BloodHound findings clearly in interviews, reports, and stakeholder conversations.

Enumerating privileged groups is a concrete discovery technique that identifies which accounts have elevated control over an Active Directory environment. This lesson explains what the attacker is looking for, which groups matter and why, what group membership reveals about paths to domain compromise, and how to communicate findings clearly in interviews, reports, and stakeholder conversations.

Enumerating the domain password policy is a concrete discovery technique that directly informs credential attack decisions. This lesson explains how to retrieve the policy, what each setting means for attack planning, what the attacker gains from this information, and how to explain the findings in interviews, reports, and stakeholder conversations.

Identifying Kerberoastable service accounts is a targeted discovery technique that finds user-based accounts with Service Principal Names registered in Active Directory. This lesson explains what makes an account a viable Kerberoasting target, how to distinguish high-value targets from noise, what the attacker gains before the actual roasting step, and how to communicate this discovery work clearly in interviews and reports.