Most Active Directory compromises do not need a vulnerability: they follow a chain of ordinary permissions, group memberships and logged-on sessions from a single user account to Domain Admin. Attackers map those chains with graph tools, and the same graph view is the most efficient way for defenders to find and remove them before anyone else does. This guide explains attack paths and Tier 0 as defenders use them, how BloodHound Community Edition and similar attack path graphs support attack path management, which edge types deserve attention first, how to prioritise and verify remediation, and how to detect directory collection in your own environment. It is written for AD administrators, identity engineers and security teams running attack path management. It stays at concept level: there are no collection commands or abuse queries here.
Key takeaways
- Think in paths, not findings. A misconfiguration matters when it connects a large population of principals to Tier 0; a graph shows which ones do.
- Tier 0 is defined by control, not by group name. Anything that can control domain controllers, AD CS, Entra Connect or their security dependencies is Tier 0, including backup, hypervisor and EDR platforms.
- Cut choke points first. Removing one edge into Tier 0 can break thousands of paths at once; fixing low-impact edges one by one rarely moves the risk.
- Measure exposure as a number. Track how many principals have a path to Tier 0 and how many edges cross into it, and re-run analysis after every change.
- Collection is visible. Graph collection generates LDAP, SAMR and session enumeration that defenders can log and alert on, which also helps catch attackers doing the same thing.
Attack paths, Tier 0 and choke points
SpecterOps, which maintains BloodHound, defines an attack path as a chain of abusable privileges and user behaviours that creates direct or indirect connections between principals, and attack path management (APM) as the ongoing process of identifying, analysing and managing those paths. In the graph, each principal (user, group, computer) is a node and each relationship (a group membership, an access control entry, a session) is an edge.
- Tier 0: SpecterOps defines Tier Zero as the set of assets in control of enterprise identities and their security dependencies. Microsoft's AD tier model lists Tier 0 as administrative accounts and groups (including Backup Operators and Server Operators), domain controllers, Microsoft Entra Connect, Entra application proxy, AD FS and AD CS, plus systems that operate or manage them: backup, monitoring, patching, hypervisor, antivirus and EDR platforms.
- Equivalent sensitivity: Microsoft states that all Tier 0 assets have equivalent sensitivity because they are all effectively in control of each other. A hypervisor host running a domain controller is as sensitive as the domain controller.
- Clean source principle: security dependencies must be as trustworthy as the objects they protect. A Tier 0 admin who signs in from a normal workstation makes that workstation part of Tier 0.
- Choke point: an edge that connects the rest of the environment to a set of objects. Any edge into the Tier 0 set is a Tier 0 choke point, and these are where defenders get the most return for each change.
- Enterprise access model: Microsoft's current model expands Tier 0 into the control plane, splits Tier 1 into management and data/workload planes, and splits Tier 2 into user and app access. Each plane controls the planes beneath it. See the Tiered Administration and Enterprise Access Model Guide.
Protected status is not the same as Tier 0. SpecterOps notes that not every Tier 0 object is covered by AdminSDHolder or the protected accounts and groups list, so a Tier 0 inventory built only from protected groups will miss objects such as GPOs linked to domain controllers, certificate templates and the computer accounts of management servers.
How defenders use BloodHound and attack path graphs
BloodHound Community Edition (CE) is free and open source. Its collector reads directory objects over LDAP (trusts, OUs, sites, user, group and computer properties, and access control lists on AD objects), plus group memberships, active sessions and local group membership (Administrators, Remote Desktop Users, Distributed COM Users and Remote Management Users) from domain-joined Windows computers, and Group Policy links. BloodHound then computes which principals can reach which targets.
The 2024 Five Eyes advisory "Detecting and mitigating Active Directory compromises" (ASD's ACSC, CISA, NSA, the Canadian Centre for Cyber Security, NCSC-UK and NCSC-NZ) lists BloodHound alongside PingCastle and Purple Knight as tools organisations can use to understand their own AD configuration and find weaknesses.
| Approach | What it answers | Strength | Limit |
|---|---|---|---|
| Attack path graph (BloodHound CE) | Who can reach Tier 0, through which chain | Shows transitive risk and choke points | Point-in-time unless run on a schedule; needs skilled interpretation |
| Commercial APM platform (for example BloodHound Enterprise) | Same, continuously, with exposure scoring and custom zones | Trend data, prioritised remediation lists | Licence cost; still depends on collection coverage |
| AD health check (PingCastle, Purple Knight) | Which known misconfigurations exist | Fast, scored, easy to report | Lists findings, not how they chain |
| Identity threat detection (for example Microsoft Defender for Identity posture assessments) | Which risky settings exist and which attacks are happening | Combines posture with live alerts | Assessments are per setting, not path based |
| Penetration test or red team | Can a skilled person actually get there | Proves exploitability | One path found, not all paths; expensive to repeat |
Privilege zones: BloodHound groups objects into zones arranged in a hierarchy of control. Each object belongs to one zone, the highest-priority one whose rules match it. CE ships with the default Tier Zero zone only; custom zones (for example Tier 1 servers) and zone analysis are BloodHound Enterprise features. When an object in a lower zone can control an object in a higher zone, BloodHound flags it as a violation on its Attack Paths and Posture pages. Tag your real Tier 0 objects, not just the defaults, or the analysis will understate exposure.
Run it as a sanctioned activity: collection touches every domain-joined host and reads sensitive authorisation data. Get written approval, run it from a Tier 0 or dedicated assessment host, store the output as Tier 0 data (it is a map to your crown jewels), and tell your SOC in advance so the detections in this guide fire and are closed as expected.
Edge types that create paths to Tier 0
The table groups the risky relationships defenders most often find, with the fix that removes the edge rather than hiding it. The related attack techniques (ATT&CK v20) explain why each matters; this guide does not describe how to abuse them.
| Edge category | What the graph shows | Why it is a path | Remediation |
|---|---|---|---|
| Excessive or nested group membership | Broad groups (for example a helpdesk or "IT All" group) nested into Account Operators, Backup Operators or local Administrators on Tier 0 servers | Every member inherits Tier 0 control (T1078.002 Domain Accounts) | Flatten nesting, remove broad groups from privileged groups, treat Account Operators and Backup Operators as Tier 0 or leave them empty |
| ACL misconfigurations | GenericAll, GenericWrite, WriteDacl, WriteOwner or reset-password rights on privileged users, groups, OUs or the domain object | Control over an object means control over its owner's privileges | Remove the ACE, fix inheritance on the OU, review AdminSDHolder ACL, delegate with least privilege |
| Replication rights | Non-DC principals holding Replicating Directory Changes All on the domain | Lets a principal request password data from a DC (T1003.006 DCSync) | Remove from all non-Tier 0 principals; Five Eyes advises reviewing these rights at least every 12 months. See the Golden Ticket, Silver Ticket and DCSync Guide. |
| Privileged sessions on lower-tier hosts | Domain Admin or Tier 0 service account sessions on workstations and member servers | Whoever controls the host can reuse credentials in memory. See the Pass-the-Hash and Pass-the-Ticket Guide. | Enforce logon restrictions by tier, PAWs, Protected Users, no Tier 0 service accounts on member servers |
| Unconstrained delegation | Non-DC computers or accounts trusted for unconstrained delegation | The host can impersonate any user who authenticates to it, to any service | Convert to constrained or resource-based constrained delegation; mark admins "Account is sensitive and cannot be delegated". See the Kerberos Delegation Security Guide. |
| AD CS template and CA risk | Templates that let low-privileged users enrol and supply the subject name, writable templates, CA flag EDITF_ATTRIBUTESUBJECTALTNAME2 | A certificate for a privileged identity is a credential (T1649) | Remove "supply in request", restrict enrolment and template write rights, require CA manager approval. See the AD CS Security Guide. |
| Group Policy control | Write rights on GPOs linked to the Domain Controllers OU or Tier 0 server OUs | Editing a GPO runs settings on every linked machine (T1484.001) | Restrict GPO edit and link rights to Tier 0 admins; monitor GPO changes |
| Kerberoastable privileged accounts | User accounts with SPNs that are also privileged | Service tickets can be cracked offline if the password is weak (T1558.003) | Move to gMSA, remove privilege, disable RC4. See the gMSA Guide. |
| Management agent control | Admin rights over backup, patching, EDR or hypervisor consoles that manage DCs | Control of the agent is control of the DC | Classify those platforms and their admins as Tier 0, or stop them managing DCs |
Where identity fits: service accounts are over-represented on attack paths because they are rarely reviewed, often sit in privileged groups, log on interactively to many servers and keep the same password for years. Inventory them and map each to a single tier. See the Service Account Security Guide.
Prioritising remediation
A first BloodHound run in a mature-looking domain often shows that a large share of users have some path to Domain Admins. The answer is not to fix everything at once but to rank fixes by how much exposure each removes.
- Define Tier 0 properly. Start from Microsoft's Tier 0 asset list and the community TierZeroTable on GitHub, then add your own management platforms. Tag them in BloodHound so analysis uses the real boundary.
- Find choke points into Tier 0. List every edge that crosses into the zone. Rank by the number of principals upstream of each edge.
- Remove edges with no business need first. Stale ACEs, abandoned delegations and inherited rights from old migrations can usually be removed with low risk. Record each change.
- Redesign edges that are needed. Where a team genuinely needs a right (for example helpdesk password resets), scope it to a non-privileged OU and make sure that OU contains no Tier 0 or Tier 1 admin accounts.
- Break session paths. Apply logon restrictions so Tier 0 credentials are only used on Tier 0 systems. Microsoft's guidance is that a Tier 0 session must originate from a Tier 0 PAW and that administrators never use higher-tier credentials on lower-tier systems.
- Shrink Tier 0. Microsoft recommends fewer than five people with Domain Admins-equivalent access and no Domain Admins service accounts. Each removed member removes their whole upstream path.
- Verify and lock in. Re-collect, confirm the path count dropped, and add the removed edge to a regression check so a later change does not reintroduce it.
Test and roll back: before removing an ACE or group membership, export the current ACL or membership, check sign-in and audit logs for actual use over at least 30 days, make the change in a change window, and keep the export to restore if a service breaks. For delegation and AD CS changes, test the dependent application in a pilot first.
Decision guidance: scope, cadence and organisation size
- Small organisations (one domain, a few admins): run BloodHound CE quarterly and after major changes, alongside a free AD health check. Focus on empty privileged groups, no unconstrained delegation, no non-admin replication rights and Domain Admins used only from a dedicated admin workstation.
- Large or multi-forest estates: continuous collection is worth the cost because the graph changes daily. Include trust relationships (T1482 Domain Trust Discovery is what an attacker would do; you need the same view) and hybrid edges into Entra ID. See the Active Directory and Entra ID Hardening Guide.
- CE or commercial: CE is enough to find and fix paths if someone owns the work. A commercial APM platform adds continuous analysis, exposure scores and custom zones; it is worth evaluating once you need trend reporting for management or multiple tiers.
- Graph or health check first: a health check is faster for a first baseline of known bad settings. A graph is required once those are fixed, because the remaining risk sits in how ordinary permissions combine.
- Session collection: sessions change constantly, so a single collection undercounts them. Treat session paths as a symptom and fix the cause with logon restrictions rather than chasing individual sessions.
Detecting directory collection
Attackers run the same collectors defenders do, usually soon after initial access. Domain account and group discovery (T1087.002, T1069.002), Group Policy discovery (T1615) and trust discovery (T1482) generate signals that can be logged. Your own sanctioned runs are the best test that the detections work.
| Signal | Source | What to look for |
|---|---|---|
| Security principal reconnaissance (LDAP), external ID 2038 | Microsoft Defender for Identity | Suspicious LDAP enumeration or queries for sensitive groups using methods not seen before (15-day learning period per computer) |
| User and Group membership reconnaissance (SAMR), external ID 2021 | Microsoft Defender for Identity | SAM-R enumeration of users and groups against DCs (four-week learning period per DC) |
| Account Enumeration reconnaissance (LDAP), external ID 2437 | Microsoft Defender for Identity | LDAP ping (cLDAP) user name guessing |
| Honeytoken was queried via LDAP, external ID 2429 | Microsoft Defender for Identity | Any LDAP query touching a decoy account |
| Event 1644 (expensive, inefficient or long LDAP searches) | Directory Service log on DCs | One client issuing large searches across all users, groups and ACLs; enable via the "15 Field Engineering" diagnostic value (heavy logging, use for targeted periods) |
| Event 4662 on directory objects | Security log on DCs (Directory Service Access auditing with SACLs) | Reads of a decoy object's attributes; replication rights used from a non-DC source |
| Event 5136 / 4728, 4732, 4756 | Security log on DCs | Changes to ACLs, GPOs and privileged group membership, which are how paths are created |
| Connection fan-out | EDR, NDR or firewall logs | One workstation making SMB/RPC connections to hundreds of hosts in minutes (session and local group collection) |
Decoy accounts with attractive names and attributes, monitored for any query or sign-in, are a cheap and reliable tripwire. See the Deception Technology Guide. For what usually follows enumeration, see the Lateral Movement Guide.
Measuring attack path exposure
- Principals with a path to Tier 0: count and percentage of enabled users and computers. The headline metric; it should fall steadily.
- Tier 0 choke point edges: number of distinct edges crossing into Tier 0 from outside. Target: only documented, approved edges.
- Tier 0 size: number of accounts with Domain Admins-equivalent control, against the fewer-than-five benchmark.
- Tier violations: sessions of Tier 0 accounts on non-Tier 0 hosts per collection.
- Reintroduction rate: removed edges that reappear within 90 days, which shows whether change control and provisioning are fixed.
- Detection coverage: share of sanctioned collection runs that raised an alert within one hour.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05; ID.RA-01 | Permissions managed with least privilege and reviewed; weaknesses identified and recorded |
| NIST SP 800-53 Rev. 5 | AC-2, AC-3, AC-6, RA-3, RA-5, CA-8, SI-4, AU-6 | Account management, access enforcement, least privilege, risk and vulnerability assessment, testing, monitoring |
| CIS Controls v8.1 | Control 5 Account Management; Control 6 Access Control Management | Inventory and restrict admin and service accounts |
| ISO/IEC 27001:2022 Annex A | A.5.15 Access control; A.5.18 Access rights; A.8.2 Privileged access rights | Privilege allocation and review |
| MITRE ATT&CK v20 | T1087.002, T1069.002, T1482, T1615, T1003.006, T1558.003, T1649, T1484.001, T1078.002 | Discovery and privilege techniques that attack paths enable |
| MITRE D3FEND | D3-UAP User Account Permissions; D3-UGPH User Group Permissions; D3-DAM Domain Account Monitoring; D3-DTP Domain Trust Policy | Hardening and monitoring counter-measures |
Common failure patterns
- Tier 0 defined as Domain Admins only: paths through AD CS, Entra Connect, backup consoles and hypervisors stay invisible, so the graph reports false comfort.
- Running BloodHound once: a single report produces a burst of fixes, then new projects and helpdesk delegations rebuild the paths within months. Schedule it.
- Fixing leaves, not choke points: teams remove hundreds of low-impact ACEs while one nested group into Backup Operators still exposes most of the domain.
- Treating collection output as harmless: the export is a complete map to Tier 0. Leaving it on a file share hands an intruder the same view.
- No SOC hand-off: sanctioned collection is never correlated with detections, so nobody knows whether an attacker's enumeration would be caught.
- Privileged accounts used everywhere: admins sign in to workstations and member servers with Tier 0 accounts, recreating session paths faster than they can be removed. Logon restrictions are the fix, not repeated clean-ups.
Practitioner checklist
- Write down your Tier 0 asset list by control, including AD CS, Entra Connect, AD FS and every platform that manages DCs.
- Get approval, notify the SOC, and run BloodHound CE (or your APM platform) from a protected host; store output as Tier 0 data.
- Tag Tier 0 objects in the graph and list every edge into the zone, ranked by upstream principals.
- Remove non-admin replication rights, unconstrained delegation on non-DCs and broad groups nested into privileged groups.
- Fix AD CS templates that let low-privileged users supply the subject, and restrict template write rights.
- Enforce tiered logon restrictions, PAWs, Protected Users and the "sensitive and cannot be delegated" flag for admins.
- Move privileged service accounts to gMSA and out of privileged groups.
- Enable LDAP and SAMR reconnaissance detections and decoy accounts; test them with each sanctioned run.
- Track principals with a path to Tier 0, choke point edges and Tier 0 size every cycle.
- Add removed edges to a regression check and to change control.
Standards and references
- ASD ACSC, CISA, NSA, CCCS, NCSC-UK, NCSC-NZ: Detecting and Mitigating Active Directory Compromises
- Microsoft: Enterprise access model
- Microsoft: Active Directory tier model
- SpecterOps: BloodHound glossary
- SpecterOps: BloodHound Privilege Zones
- Microsoft: Security assessment, unsecure Kerberos delegation
- Microsoft: Defender for Identity security alerts
- ANSSI: Recommandations pour l'administration sécurisée des SI reposant sur AD
Related NHI Mgmt Group resources: Top 10 Active Directory Security Risks · Tiered Administration and Enterprise Access Model Guide · Privileged Access Management Guide · Identity Recovery Guide