Active Directory Offensive Security: Zero to Domain Admin

Course overview

A complete Active Directory offensive-security curriculum, taking you from foundational AD concepts through to full domain compromise. Every lesson explains the underlying Windows and Kerberos mechanism first (often with a diagram) before covering the tools you'd actually reach for and why, a hands-on lab to practice it yourself, and a defender's-eye view of how the same activity gets caught and stopped. The path runs foundations, building your own lab, enumeration, credential attacks, lateral movement, ACLs and delegation, NTLM relay and coercion, AD Certificate Services, trusts, full domain compromise, red-team tradecraft, and professional reporting, in the order a real internal assessment actually unfolds.

What you'll learn

• Explain DNS, LDAP, NTLM and Kerberos authentication flows without relying on tool output
• Enumerate an AD domain from Linux and Windows, and manually validate BloodHound attack-path edges
• Calculate a safe password-spray plan from a domain’s real lockout and observation-window settings
• Execute and defend against AS-REP Roasting and Kerberoasting, including targeted variants
• Map local admin and remote access, choose an appropriate lateral-movement method, and pivot through segmentation
• Interpret dangerous ACL rights and turn a delegated permission into proven, reversible impact
• Reproduce unconstrained, constrained and resource-based Kerberos delegation end to end
• Build an NTLM relay prerequisites matrix and execute a safe relay chain, including coercion
• Assess AD Certificate Services by understanding templates, enrollment and mapping, not by memorizing ESC numbers
• Recognize how GPO, MSSQL, SCCM, Exchange, WSUS and DNS enter real AD attack paths
• Map trust direction across domains and forests and explain why the forest is the true security boundary
• Execute DCSync, offline NTDS extraction and ticket forgery as end-game techniques, and know why they come last
• Operate a C2 framework in a lab with full logging, cleanup and deconfliction discipline
• Write a professional finding that connects root cause, attack path, evidence, business impact, remediation and detection

Who this course is for

Penetration testers and red-teamers who already have basic Windows/Active Directory administration knowledge and want a structured, in-depth path into AD-specific offensive security: real protocol theory and mechanism, not just a command cheat-sheet. Every lab assumes an isolated environment or a written, authorized engagement; nothing in this course should ever be run against a network you don't own or don't have explicit permission to test.

Curriculum