Privileged Access Review
How easily can an attacker go from one compromised account to controlling your entire network? The Privileged Access Review is the focused variant of the AD assessment — sharply focused on privileged access and the shortest paths to Domain Admin. Read-only, as an independent third party with no vendor interests.
What the assessment covers
- Domain/Enterprise Admins, Tier-0 accounts and protected users
- Privileged group memberships — incl. nested and stale accounts
- Unconstrained/constrained delegation, RBCD, AdminSDHolder and dangerous ACLs
- Service accounts with SPNs (Kerberoasting) and accounts without Kerberos pre-auth (AS-REP roasting)
- Password, lockout and Kerberos policies
- Overall assessment of the shortest paths to Domain Admin
What you get
- Written report with prioritised findings
- Recommendations targeting reduced privilege-escalation risk
Out of scope
- Not a full AD assessment — GPOs, infrastructure and replication are not covered
- No active exploitation — the review is read-only
- The offline password penetration test is part of the full AD assessment — not this variant, unless separately agreed
How it works
Free pre-analysis
We assess the scope and give you a fixed price. No obligation, no surprises.
Read-only data collection
Automated extracts via PowerShell and Graph — zero operational disruption.
Analysis & assessment
Manual specialist review with risk prioritisation and business context.
Report & plan
An executive summary for leadership, technical depth for your team — ready to act on.
Frequently asked questions
What is Tier 0 — and why focus there?
Tier 0 is the set of accounts and systems that effectively own your Active Directory: Domain Admins, domain controllers and anything that can control them. If a single Tier 0 element is compromised, the entire environment is effectively lost — so that is where prioritisation starts.
How does it differ from the full AD assessment?
The Privileged Access Review goes deep on privileged access and attack paths only — faster and more focused. The full AD assessment covers the entire environment, including GPOs, infrastructure and the offline password test.
Ready to have your security verified?
A free, no-obligation pre-analysis. A fixed price. A concrete plan you can act on right away.
Book a free pre-analysis