First audit: get to know the domain, find the privileged accounts
On a real Active Directory domain (CORP.LAB) you use an audit account to find the domain controller, list the users and privileged groups, pick out disabled accounts, catch a password left in a description field and write your findings into a report with risks and advice.
Level 201 · 45 min
CORP's IT manager has called you in for an internal audit. You hold a written authorisation and an audit account with read-only rights: user name denetci, password Denetim.2026. Your job is to review the company's users and permissions and report the risks.
Most companies manage their staff, computers and permissions with Active Directory (AD). Analogy: AD is like a company's staff and key register. It records who works there, which team they are in and which doors their keys open. The server that keeps this register is called a domain controller (DC).
Attackers read this register first too: who is an admin, which account was forgotten? As a defender you must ask the same questions before they do. In this lesson you audit a Windows domain from Linux, from the Kali terminal.
Important: scanning an organisation's directory without permission is a computer crime in most countries. At work an audit is always done with written authorisation and a defined scope. CORP.LAB here is a training network that belongs only to you.
Note: the domain controller can take about 20 seconds to come up after the lab starts. If the first command gets no answer, wait a little and try again.
In the first steps the commands are ready; from the middle you type them by hand, and in the last steps you only see the goal.
What you will do in this lesson
- Find the domain controller
- Look at the DC's doors
- List the users with the audit account
- Audit the privileged groups
- Look at Backup Operators with LDAP
- Find disabled accounts with LDAP
- A password in a description
- The audit report
- Short quiz
Skills you will earn
- Finding the domain controller with a DNS SRV record
- Knowing the DC services and their ports
- Listing users with an audit account
- Auditing the members of privileged groups
- Finding disabled accounts with an LDAP filter
- Finding passwords left in description fields
- Decoding base64 values (base64 -d)
- Writing audit findings into a report
Active Directory security: auditing and hardening · What Active Directory is: domain, forest, OU →
Start for free