Topic starter
16/04/2026 8:02 pm
TL;DR: Active Directory remains the identity backbone for most enterprises, while identity-based attacks now dominate modern campaigns and can reach domain compromise in under two minutes, according to Delinea and cited industry reporting. The control gap is continuous visibility and remediation, not another quarterly review cycle.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Five security controls that can reduce your AD risk”.
By the numbers:
- Microsoft's 2024 Digital Defense Report documented 600 million identity attacks per day.
- CrowdStrike reported that 80% of their detections now involve identity-based techniques rather than malware.
- CrowdStrike reported a 583% year-over-year increase in Kerberoasting in 2023.
Key questions
Q: Where do Active Directory controls fail in practice?
A: They fail when security teams measure only formal privileged groups and miss the effective rights hidden in ACLs, delegation, nested groups, and service account settings.
Q: Why do service accounts and delegation settings create so much risk in Active Directory?
A: Service accounts often run with persistent privileges and weak password practices, while delegation settings can let an attacker reuse authentication material or impersonate trusted systems.
Q: What are the signs that an AD hardening programme is not working?
A: Common signals include service accounts that still use old passwords, unconstrained delegation flags that remain in place, and privileged rights that appear outside formal review records.
Practitioner guidance
- Enforce tiered administration boundaries Separate Tier 0, Tier 1, and Tier 2 access so privileged credentials never touch lower-trust systems, and use dedicated privileged access workstations for domain controller and PKI administration.
- Remove unconstrained Kerberos delegation Find every system with TRUSTED_FOR_DELEGATION set, replace it with Resource-Based Constrained Delegation where needed, and treat new unconstrained delegation as a critical exposure.
- Replace service accounts with gMSAs Move SPN-bearing user accounts to Group Managed Service Accounts so passwords are auto-rotated and offline cracking is no longer the default Kerberoasting payoff.
Bottom line: Active Directory risk is driven by living misconfiguration, hidden privilege paths, and legacy protocol dependencies rather than by age alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:44 pm
Continuous identity controls are now the only practical way to govern Active Directory risk. Quarterly review cycles were designed for slower-moving privilege environments, but AD posture changes as accounts, groups, delegation settings, and service identities drift between governance events. The field should stop treating directory governance as an episodic certification problem and instead treat it as an always-on exposure problem. The practitioner conclusion is simple: continuous discovery and remediation now define defensible AD governance.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should IAM teams balance PAM with continuous AD posture control?
A: Use PAM to govern enrolled privileged sessions, but do not assume that covers the full directory estate. Continuous posture control is needed for service accounts, nested privilege, and other identity drift that lives outside the vault and between quarterly access reviews.
👉 Read our full editorial: Active Directory risk in 2026 demands continuous identity controls