TL;DR: Active Directory remains the identity backbone for most enterprises, while identity-based attacks now dominate modern campaigns and can reach domain compromise in under two minutes, according to Delinea and cited industry reporting. The control gap is continuous visibility and remediation, not another quarterly review cycle.
At a glance
What this is: This is a practitioner analysis of why Active Directory remains a high-risk identity backbone in 2026, and why continuous visibility and remediation matter more than periodic review cycles.
Why it matters: It matters because hybrid IAM programmes still inherit AD-driven privilege, delegation, and account lifecycle risk that traditional PAM and quarterly governance miss.
By the numbers:
- Microsoft's 2024 Digital Defense Report documented 600 million identity attacks per day.
- CrowdStrike reported that 80% of their detections now involve identity-based techniques rather than malware.
- CrowdStrike reported a 583% year-over-year increase in Kerberoasting in 2023.
Context
Active Directory risk is the accumulation of identity misconfigurations, legacy protocol dependencies, and privilege sprawl across hybrid estates. The problem is not that AD is old, but that many enterprises still treat it as a static directory rather than a live control surface.
In practice, AD often remains the authoritative identity source while cloud directories sync downstream. That means domain compromise can still cascade into broader enterprise access, making AD governance a direct IAM and NHI concern, not a narrow Windows administration issue.
The article frames the issue around continuous control because the attack surface changes faster than quarterly access review cycles can track. That is typical of large hybrid environments, not an edge case.
Key questions
Q: Where do Active Directory controls fail in practice?
A: They fail when security teams measure only formal privileged groups and miss the effective rights hidden in ACLs, delegation, nested groups, and service account settings. In that state, attackers can use legitimate directory features to reach domain-level access without tripping the controls most programmes rely on.
Q: Why do service accounts and delegation settings create so much risk in Active Directory?
A: Service accounts often run with persistent privileges and weak password practices, while delegation settings can let an attacker reuse authentication material or impersonate trusted systems. Together, they create low-noise paths to escalation that do not depend on malware. The risk is not the account name itself, but the effective access it can provide if abused.
Q: What are the signs that an AD hardening programme is not working?
A: Common signals include service accounts that still use old passwords, unconstrained delegation flags that remain in place, and privileged rights that appear outside formal review records. If posture data and review data do not match, the programme is already missing exploitable exposure.
Q: How should IAM teams balance PAM with continuous AD posture control?
A: Use PAM to govern enrolled privileged sessions, but do not assume that covers the full directory estate. Continuous posture control is needed for service accounts, nested privilege, and other identity drift that lives outside the vault and between quarterly access reviews.
Technical breakdown
Why Active Directory misconfigurations remain exploitable
Most AD compromises do not require a zero-day. They exploit durable configuration weaknesses such as permissive ACLs, weak service account passwords, unconstrained delegation, and legacy protocol support that persists for compatibility. Because Kerberos, NTLM, LDAP, and GPO are deeply embedded in enterprise operations, attackers can abuse legitimate authentication paths instead of deploying obvious malware. The result is an attack surface that looks normal to administrators but still supports credential theft, privilege escalation, and domain takeover. Practical implication: treat AD posture as an active attack surface and not just a directory administration task.
Practical implication: Map AD misconfigurations to their actual abuse paths, then prioritise remediation by exploitability and blast radius.
Kerberoasting, shadow administrators, and delegation abuse
Kerberoasting works because authenticated users can request a service ticket for a service account and crack the ticket offline if the password is weak or never rotated. Shadow administrators arise when direct ACL rights grant admin-equivalent power without formal group membership, which makes them invisible to many review processes. Unconstrained Kerberos delegation is more dangerous still because it can expose a domain controller's ticket material after coercion. These are not separate quirks; they are different expressions of the same control gap: identity authority that is not visible where governance expects it to be. Practical implication: inspect effective permissions and delegation paths, not only named privileged groups.
Practical implication: Review effective rights and delegation settings, not just group membership, when hunting AD privilege pathways.
Why PAM does not close the full AD control gap
PAM is designed to govern enrolled privileged credentials and sessions, but AD risk extends into service accounts, legacy accounts, and nested group privilege that never enters the vault. That creates a governance blind spot between enrollment and discovery. Identity security posture management closes that gap by continuously discovering identities, analysing posture, and surfacing drift before the next governance cycle. In other words, PAM protects the known subset, while posture management is needed for the rest of the directory estate. Practical implication: use PAM and posture control together, not as substitutes.
Practical implication: Pair vaulted privileged access with continuous discovery so shadow accounts and silent privilege creep do not escape governance.
Threat narrative
Attacker objective: The attacker aims to achieve domain-level control of Active Directory so they can extract credentials, expand access, and take over connected enterprise environments.
- Entry often begins with an authenticated domain user or a socially engineered help desk foothold that can request or influence directory-relevant access.
- Credential access follows through Kerberoasting, credential dumping, or ticket abuse that exposes service account or domain controller material.
- Escalation occurs when attackers exploit shadow admin rights, unconstrained delegation, or coercive authentication flows to reach domain admin capability.
- Impact is full domain compromise, often enabling credential database extraction, broad lateral movement, and downstream control of connected enterprise systems.
Breaches seen in the wild
- Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous identity controls are now the only practical way to govern Active Directory risk. Quarterly review cycles were designed for slower-moving privilege environments, but AD posture changes as accounts, groups, delegation settings, and service identities drift between governance events. The field should stop treating directory governance as an episodic certification problem and instead treat it as an always-on exposure problem. The practitioner conclusion is simple: continuous discovery and remediation now define defensible AD governance.
Shadow privilege is the hidden failure mode in Active Directory governance. The most dangerous rights are often not visible in formal privileged groups but encoded in ACLs, nested groups, delegation settings, and service account configurations. That means governance based only on group membership produces false confidence. The implication for identity teams is that effective access, not declared access, is the real control object.
Identity security posture management is the named concept this article strengthens. PAM secures enrolled privilege, but it cannot govern the broader shadow estate of unregistered service accounts, inherited rights, and delayed remediation. ISPM becomes the control plane that connects discovery, posture analysis, and action across the full hybrid identity surface. The practitioner conclusion is to evaluate governance on continuous posture visibility, not vault coverage.
AD attack techniques remain a blueprint for adversaries because enterprise dependencies preserve them. Kerberos, NTLM, LDAP, PKI, and delegation patterns are not legacy in the operational sense, even if they are legacy architecturally. The persistence of those dependencies keeps old abuse paths viable in modern campaigns. The practitioner conclusion is to align hardening with the protocols and trust relationships attackers actually use.
The most exposed AD estates fail at lifecycle discipline, not just technical configuration. Temporary access that is never revoked, service accounts that never rotate, and inherited privilege that never gets revalidated create durable attack conditions. This is an identity lifecycle failure as much as a configuration failure. The practitioner conclusion is to bring joiner-mover-leaver discipline, privilege review, and posture monitoring together for directory assets.
From our research library:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: Identity Security Posture Management (ISPM) Guide
What this signals
Identity drift is the central Active Directory governance problem. Access in AD changes through delegation, service accounts, nested groups, and emergency exceptions long before the next formal review. Programmes that still depend on quarterly certification are measuring a snapshot while attackers operate against a moving target.
ISPM becomes the missing control layer for hybrid identity estates. Continuous discovery and posture analysis are what let teams see the effective state of the directory, not the intended state. For most enterprises, that is the difference between knowing an account exists and knowing whether it can be abused right now.
For practitioners
- Enforce tiered administration boundaries Separate Tier 0, Tier 1, and Tier 2 access so privileged credentials never touch lower-trust systems, and use dedicated privileged access workstations for domain controller and PKI administration.
- Remove unconstrained Kerberos delegation Find every system with TRUSTED_FOR_DELEGATION set, replace it with Resource-Based Constrained Delegation where needed, and treat new unconstrained delegation as a critical exposure.
- Replace service accounts with gMSAs Move SPN-bearing user accounts to Group Managed Service Accounts so passwords are auto-rotated and offline cracking is no longer the default Kerberoasting payoff.
- Audit effective rights and shadow administrators Review ACL-based admin-equivalent access on AD objects, including GenericAll and nested group paths, because formal group membership will miss these privilege routes.
- Disable legacy exposure points Turn off LLMNR and NBT-NS, require SMB signing, and deploy unique local admin passwords so lateral movement paths are reduced while directory controls are being hardened.
Key takeaways
- Active Directory risk is driven by living misconfiguration, hidden privilege paths, and legacy protocol dependencies rather than by age alone.
- The article shows why PAM and quarterly reviews leave a structural gap when service accounts, delegation settings, and nested rights drift outside the vault.
- Continuous discovery and posture remediation are the practical controls that change the attack window, because they expose what review cycles miss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on excessive AD rights, shadow admins, and inherited privilege paths. |
| NHI-07 — Long-Lived Secrets | Service accounts with static passwords and delayed rotation are a core abuse path. | |
| NHI-03 — Vulnerable Third-Party NHI | The article's hybrid estate discussion includes legacy and external systems that expand AD attack surface. | |
| Recommendation — Inventory effective permissions and remove overprivileged AD access that exceeds business need. Rotate service account credentials and eliminate static secrets that persist across AD workflows. Review third-party and legacy identity dependencies for hidden AD privilege exposure. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Kerberoasting, DCSync, and delegation abuse map directly to credential theft and movement. |
| Recommendation — Map observed AD abuse to credential access and lateral movement to prioritise detections and containment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article argues for continuous control of effective entitlements in hybrid identity estates. |
| Recommendation — Continuously validate entitlements so effective AD permissions match authorised business access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is undermined by shadow admin rights, nested groups, and unconstrained delegation. |
| Recommendation — Enforce least privilege across AD objects, groups, and delegation paths rather than only at login. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The hybrid identity posture discussion fits cloud IAM governance over synchronized directories. |
| Recommendation — Align directory controls with cloud IAM governance so hybrid identity drift is visible and remediated. | ||
Key terms
- Shadow Administrator: A shadow administrator is an account that can perform administrative actions without appearing in a normal privileged group. The rights usually come from direct ACL assignments, inherited permissions, or nested group paths, which makes the account easy to miss in standard reviews.
- Kerberoasting: Kerberoasting is an Active Directory attack that targets service accounts by requesting Kerberos tickets and attempting to crack the underlying password offline. It is dangerous because weak service account passwords and excessive permissions can turn one ticket into elevated access across critical systems.
- Resource-Based Constrained Delegation: Resource-Based Constrained Delegation is a delegation model that limits which systems can act on behalf of others. It reduces the abuse potential of older delegation settings by making the target resource control the trust relationship rather than the delegating account.
- Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
Deepen your knowledge
NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.
Published by the NHIMG editorial team on June 2, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org