Final task: the CORP.LAB audit report

With everything you learned in the course you audit CORP.LAB end to end, unguided: effective admins, accounts exposed through Kerberos, stale accounts, the password policy, delegation, plain passwords on shares and in SYSVOL. You write each finding with its evidence to a file, then everything with risk ratings and advice into one audit report. Most findings differ in every lab.

Level 201 · 75 min

CORP’s board asked for the yearly security audit and gave you written authorisation: audit account denetci, scope the CORP.LAB domain and its shares, method read-only (change nothing). The audit date is 12 March 2026.

This is a final task: I give no commands. In each step you only see the goal and the file to deliver. If you get stuck, the hint reminds you of the method, and after two wrong tries the solution appears. Going back to earlier lessons is allowed; real auditors use notes and documents too.

Part of this lab’s findings is planted at random in the background; wait 30 seconds before your first queries. ~/.ldaprc, ~/.ad-pass and ~/.smb-auth are ready.

What you will do in this lesson

Scope and the report skeleton
1. Effective administrators
2. Accounts exposed through Kerberos
3. Stale accounts
4. The password policy
5. Unconstrained delegation
6. Passwords on shares
7. A password in SYSVOL
8. The audit report
Short quiz

Skills you will earn

Writing audit findings into a report
Finding admins hidden through nested groups
Auditing accounts with SPNs exposed to Kerberoasting
Finding accounts without Kerberos pre-authentication
Finding accounts and computers that haven’t logged on for long
Reading the domain’s password and lockout policy
Finding unconstrained delegation (TRUSTED_FOR_DELEGATION)
Searching shares for plain passwords
Finding GPP cpassword in SYSVOL (MS14-025)

← The krbtgt password, backup and recovery · Active Directory security: auditing and hardening

Start for free