Active Directory challenges: defend the domain
In the CORP.LAB domain you find hidden misconfigurations and attack traces, then close each one as a defender and prove it.
Level 401 · 14 lessons · 0 practice labs
Lessons
Misconfigurations
- An admin hidden through nested groups
- A privileged account whose password never expires
- A service account with a weak password
- A Group Policy anyone can edit
- Short task: fix the four issues and prove it with an LDAP query
Attack traces
- The trace of password spraying in event logs
- Unusual service ticket requests
- Replication from a machine that is not a DC
- A new admin added at night
- Short task: place the four traces on one timeline
Hardening and recovery
- Splitting admin accounts into tiers
- Enforcing SMB and LDAP signing
- Rotating the krbtgt password safely twice
- Capstone: clean up a compromised domain and write the audit report
About this course
In the CORP.LAB domain you find hidden misconfigurations and attack traces, then close each one as a defender and prove it.
What you will learn
- Misconfigurations
- Attack traces
- Hardening and recovery
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.