Active Directory security just became more urgent for small and mid-sized businesses. The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and allied agencies from Australia, Canada, New Zealand, and the United Kingdom released detailed guidance on 17 techniques attackers use to compromise Active Directory environments. If your business runs Windows servers or uses domain logins, this applies to you.
Why does Active Directory security matter to a 50-person manufacturing shop?
Active Directory (AD) is the identity backbone for most Windows-based businesses. It controls who logs in, what files they can access, and which systems they can touch. When attackers compromise AD, they do not just steal one file or lock one computer. They own the entire network.
A machining company in Hartford learned this the hard way. An attacker used a weak service account password to dump every credential in their domain, then moved laterally through CAD workstations, the ERP system, and finally encrypted the file server. Total downtime: six days. The vulnerability was not exotic. It was a misconfigured admin account and missing patches, both covered in the CISA guidance.
The report documents attacks like Kerberoasting (cracking service account passwords), pass-the-hash (reusing stolen password hashes without knowing the plaintext), and Golden Ticket attacks (forging authentication tokens). These are not theoretical. Ransomware groups use them in nearly every SMB breach because they work.
What are the 17 Active Directory attack techniques I need to know?
The CISA guidance breaks down each technique with plain-language descriptions, indicators of compromise, and mitigation steps. Here are the ones that hit SMBs hardest:
Credential dumping: Attackers extract password hashes from memory or the Security Account Manager (SAM) database. If your admin logs into a compromised workstation, their credentials are sitting in RAM waiting to be grabbed.
Pass-the-hash and pass-the-ticket: Instead of cracking passwords, attackers reuse the hashes or Kerberos tickets directly. This works even when passwords are strong, because the authentication system accepts the hash itself.
Kerberoasting: Attackers request service tickets for accounts with Service Principal Names (SPNs), then crack those tickets offline. Weak service account passwords fall quickly.
Golden and Silver Ticket attacks: If attackers compromise the domain controller or steal the KRBTGT account hash, they can forge authentication tickets that grant access to anything, anywhere, forever (until you reset the KRBTGT password twice).
DCSync: This technique lets attackers impersonate a domain controller and request password data for every account in the domain. It requires raised privileges, but those are often easier to get than you think.
The full list includes lateral movement techniques, privilege escalation paths, and persistence mechanisms. Each one has detection logic (what to look for in logs) and hardening steps (how to close the door).
How much does it cost to secure Active Directory properly?
The good news: most mitigations cost time, not money. Enabling audit logging is free. Enforcing least-privilege access is policy, not purchase. Rotating the KRBTGT password takes fifteen minutes twice a year.
The cost comes from the labor to implement and monitor. A 30-person law firm without IT staff will need outside help to configure logging, review admin group membership, and set up alerts for suspicious authentication patterns. Budget roughly 20 to 40 hours for an initial hardening project, then ongoing monitoring (either internal or through a managed service).
If you already have an MSP or internal IT, ask them to walk through the CISA checklist and map current controls to each technique. Gaps usually show up in logging (events aren’t captured), monitoring (logs exist but nobody reads them), and privileged account hygiene (too many domain admins, service accounts with passwords set to never expire).
The alternative cost is a breach. The law firm mentioned earlier spent $40,000 on forensics, notification, and recovery after attackers exploited an unmonitored admin account. The vulnerability would have cost $3,000 to fix proactively.
Do I need enterprise tools, or can I use what Windows already has?
Windows includes the logging and policy controls needed to defend against most of the 17 techniques. The challenge is knowing which knobs to turn.
Start with these built-in protections:
Enable Advanced Audit Policy: Turn on logging for credential validation, Kerberos service ticket operations, and sensitive privilege use. These events surface attack activity before damage spreads.
Use Group Policy to restrict local admin rights: Most users do not need admin access on their workstations. Limiting this reduces the number of machines where credentials can be dumped.
Enforce strong passwords and multi-factor authentication (MFA): Long, complex passwords slow down offline cracking. MFA stops pass-the-hash attacks because the second factor isn’t in the hash.
Apply patches promptly: Many AD exploits rely on known vulnerabilities in Windows Server or domain controller components. Monthly patching closes these before attackers arrive.
Segregate admin accounts: Use separate accounts for daily work and administrative tasks. This way, even if your email gets phished, the attacker does not get domain admin credentials.
For businesses with compliance obligations (CMMC, HIPAA Security Rule, FTC Safeguards Rule), several of these controls map directly to required safeguards. CMMC Level 2 requires MFA and least-privilege access. The FTC Safeguards Rule mandates logging and access controls for customer data.
Enterprise tools like privileged access management (PAM) platforms and security information and event management (SIEM) systems add automation and correlation, but they are not the starting point. Get the fundamentals right first.
What happens if I do nothing?
Attackers are already scanning for weak AD configurations. Ransomware operators, business email compromise (BEC) groups, and state-sponsored actors all use the techniques in the CISA report because they deliver reliable access with minimal effort.
An unprotected Active Directory environment lets an attacker who compromises one user account (via phishing, a weak password, or an unpatched laptop) escalate to domain admin in hours. From there, they can disable backups, exfiltrate financial records, deploy ransomware, or sit quietly and steal data for months.
The median dwell time (how long attackers stay hidden before you detect them) is still measured in weeks for SMBs without active monitoring. That is weeks of payroll files, customer lists, and proprietary designs walking out the door.
Beyond the breach itself, you face notification costs, regulatory fines (if you are subject to data protection rules), lost customer trust, and operational downtime. A professional services firm that loses client data may lose those clients permanently.
How do I get started today?
Download the CISA guidance (search for “CISA Active Directory guidance” or ask your IT provider for it). Walk through the 17 techniques with whoever manages your network. For each one, ask three questions:
Can an attacker do this in our environment right now? (Probably yes for at least half of them.)
Would we detect it if they tried? (Check your logging and alert rules.)
What is the fastest mitigation we can implement this week? (Start with the ones that require only configuration changes.)
Priority fixes for most SMBs: enforce MFA on all admin accounts, audit and trim the Domain Admins group, enable credential guard on Windows 10/11 endpoints, and start collecting and reviewing security logs from domain controllers.
If your team does not have the bandwidth or expertise to implement these controls, that is exactly the gap a cybersecurity-focused MSP fills. The work is not about buying expensive tools. It is about applying the right configurations, monitoring the right signals, and responding before a compromise becomes a catastrophe.
Frequently Asked Questions
What is Active Directory and why do attackers target it?
Active Directory is Microsoft’s directory service that manages user authentication, permissions, and network resources for Windows environments. Attackers target it because compromising AD gives them control over every user account, computer, and file share in the network, often with a single set of stolen credentials.
How much does it cost to implement CISA’s Active Directory security recommendations?
Most CISA mitigations are configuration changes that cost staff time rather than new software. Expect 20 to 40 hours for initial hardening (enabling logging, removing excess admins, enforcing MFA, patching servers) plus ongoing monitoring effort, either through internal IT or a managed security provider.
Do small businesses really face the same Active Directory attacks as large enterprises?
Yes. Ransomware groups and credential theft campaigns use automated tools that scan for vulnerable AD configurations regardless of company size. SMBs often face higher risk because they have fewer monitoring resources and longer detection times.
Can I secure Active Directory without buying enterprise security tools?
Absolutely. Windows Server and Group Policy include the logging, access controls, and authentication protections needed to block most of the 17 documented attack techniques. The gap is usually expertise and monitoring, not missing features.
What is the fastest Active Directory security improvement I can make this week?
Enable multi-factor authentication (MFA) for all accounts with administrative privileges. This single step blocks pass-the-hash, pass-the-ticket, and credential-stuffing attacks even if passwords are compromised.
Keep reading
- cybersecurity and data breach risk
- professional services firms
- manufacturing and industrial companies