Active Directory Security & Defense

About this course

This advanced course explains how enterprise Active Directory environments are attacked and, just as importantly, how to detect and defend them. You first build your own isolated test domain or deploy a vulnerable lab such as GOAD. From a low-privileged foothold you enumerate users, groups and computers and graph the attack paths, then study Kerberoasting and AS-REP roasting, credential access and pass-the-hash, lateral movement with tickets, delegation and ACL privilege escalation, and domain dominance through DCSync and forged tickets. Dedicated lessons cover persistence, what the blue team can detect, structural hardening, and writing a professional report. You also learn the core open-source tools. Every exercise runs in a lab you build and own, for authorized, legal testing only.