Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
Active Directory Security Assessment
A focused review of your identities, admin rights and access.
Most of what ransomware relies on sits in a handful of well-known misconfigurations.
- Run together over screen share
- report ranked by ransomware risk
- fixed scope
- From €1,900
This assessment can be booked on its own, or scheduled for you inside the Retained Security Partner retainer at the point where it adds the most.
The Challenge
From never-reviewed to kept-in-check
Stale admin accounts, weak service accounts, legacy authentication, risky delegation and over-broad permissions build up quietly in Active Directory. Ransomware uses exactly these to spread from one machine to the whole domain, and a focused assessment finds them without the cost of a full internal penetration test.
Phase 1
Never Reviewed
Identity and access have never been checked, so misconfigurations pile up unseen until an incident exposes them.
Phase 2
One-Off Snapshot
A single assessment names the issues. Fixing them takes time, and the environment keeps drifting as accounts, devices and policies change.
Phase 3
Scheduled in a Retainer
The assessment repeats at a set interval inside a retainer, and the fixes are tracked between rounds.
Scope
What's in scope
A configuration and exposure review of Active Directory. A full internal network penetration test is a separate engagement.
How the attack progresses
What we check
Initial access
Someone clicks
Phishing · malicious attachment
Outside this assessment. Covered by a phishing simulation.
Credential access
Credentials left lying around
Cached credentials · password reuse
- Password policy and credential exposure
- Stale objects, inactive accounts, and clean-up debt
Privilege escalation
A service account with too much power
Kerberoasting · over-privileged service account
- Weak, stale, and over-privileged service accounts
- Kerberos exposure and risky delegation
Lateral movement
Hop between servers
Legacy authentication · risky delegation
- Legacy authentication and outdated protocols
- Group policy weaknesses and insecure settings
Domain compromise
Domain Admin
Full directory control
- Privileged account hygiene and admin sprawl
- Trust relationships across domains and forests
The attacker's path, top to bottom
Initial access
Someone clicks
Phishing · malicious attachment
Outside this assessment. Covered by a phishing simulation.
Credential access
Credentials left lying around
Cached credentials · password reuse
What we check
- Password policy and credential exposure
- Stale objects, inactive accounts, and clean-up debt
Privilege escalation
A service account with too much power
Kerberoasting · over-privileged service account
What we check
- Weak, stale, and over-privileged service accounts
- Kerberos exposure and risky delegation
Lateral movement
Hop between servers
Legacy authentication · risky delegation
What we check
- Legacy authentication and outdated protocols
- Group policy weaknesses and insecure settings
Domain compromise
Domain Admin
Full directory control
What we check
- Privileged account hygiene and admin sprawl
- Trust relationships across domains and forests
Game over
Domain Admin ends the chain. Whoever holds it controls every account, every server and every backup the directory reaches, which for most companies is every system the business runs on. It is the position ransomware operators work toward before anything is encrypted.
Microsoft 365 / Entra ID hardening is handled as ongoing consultation rather than a fixed-scope audit - see the Retained Security Partner retainer.
Requirements
Inputs we need from you
A guided session over screen sharing. Your administrator runs the data collection on a domain-joined machine while we guide each step. We need no account and no remote connection into your network.
A short scoping call. Enough to confirm domain size, who joins the guided session, and scheduling.
One technical contact for the debrief. Whoever owns the domain day to day.
Pricing
Indicative pricing
What affects the final price
Environment Size
The number of domains and forests in scope. A single domain is quicker to assess than a multi-forest estate with several trusts.
Documentation & Availability
Existing network diagrams, an asset register, and an administrator who is free for the guided session let the assessment start faster and go deeper.
Lead Time saves money
Booking at least three weeks ahead lowers the quote. Urgent engagements carry a premium.
Process
How We Collaborate
We confirm the size of your environment, who joins the guided session, and the schedule. Usually 30 minutes.
Over a shared screen, your administrator runs the collection across Active Directory while we guide it, gathering the configuration and exposure data.
We prioritise the findings by real-world risk and write a hardening report with concrete, ordered steps.
We walk through the findings together, focus on what reduces ransomware risk first, and agree the next steps.
Get started