Sources, review date and section shortcuts
Key claims reviewed: October 19, 2026. A directory relationship, a permission on a GPO and an applied policy are different evidence types.
Primary documentation · RCE, Shell Access and Privilege Escalation: Evidence Guide
Go straight to: Decision check · Main workflow · Further detail
Separate permission from policy application
Get-GPPermission reports permissions on a GPO for specified principals. Keep that result separate from GPO links, filtering, inheritance and evidence about the settings actually applied to a particular computer or user. For each map edge, record the query source, collection identity, time and missing dependency. A manual map should show uncertainty rather than silently promote a possible relationship into validated control. Source and scope.
To profile Active Directory without BloodHound, collect a bounded set of directory and policy observations, label every relationship with its source, and separate a possible privilege path from validated access. Start with one question and one authorized part of the environment. A manual map is not a complete attack-path analysis.
This guide explains nine evidence checks. It does not describe personal assessments, promise time savings or compare measured performance with a graph tool. The command examples are illustrative read operations; no directory was queried for this revision.
What a Manual AD Profile Can Establish
A useful first profile records the domain context, relevant containers and objects, group relationships, policy questions and unresolved assumptions. Its value comes from explainable claims, not the number of objects collected.
Keep “observed,” “inferred” and “not checked” visibly separate. A directory group relationship is one observation. Effective access on a host, the application of a particular policy and an exploitable path are additional claims with their own requirements.
Use manual review when it fits the authorized question and available tooling. A graph can help examine relationships if collection and tool use are permitted. Neither approach automatically makes the other complete or correct; there is no mandatory manual-first sequence or universal time budget.
1. Record Permission, Identity and Collection Limits
Record the domain or forest slice, approved directory servers, accounts, hosts, query types, time window, output handling and stop conditions. Read access does not itself grant permission to collect every object or to test a suspected privilege path.
This checklist does not send data or start collection. If a boundary is unclear, resolve it with the environment owner before expanding the work. Use a disposable, authorized lab for learning and synthetic accounts where possible.
2. Preserve the Source of Each Claim
For every observation, keep the collector identity, server, time zone, query or console location, selected properties and any errors. A stale export, a limited account and a different directory server can produce different views; do not silently merge them into one current state.
Agreement between two sources can support an interpretation, but it does not establish completeness. A disagreement is a follow-up question, not an automatic misconfiguration. Record which assumption each source supports and what it cannot show.
3. Ask a Narrow Directory Question
Use a specific question such as “What naming context does this approved server advertise?” before collecting a broader inventory. Microsoft’s Get-ADRootDSE reference describes the directory-server information tree and its configuration properties.
Illustrative PowerShell example for a preapproved lab server, using the ActiveDirectory module in a permitted environment. Replace the fictional server only with the actual approved endpoint. Check local help, module availability and access first; installing tools or switching to a privileged account is not part of this example.
$Server = "dc1.lab.example"
Get-ADRootDSE -Server $Server |
Select-Object dnsHostName, defaultNamingContext, configurationNamingContextThis answers a server-context question. It does not list all users, prove the collection covered a forest or test a host privilege. For a broader approved query, record the chosen search base, scope, filters and properties. An OU boundary chosen for collection is not a security boundary for every relationship.
4. Verify Host Roles Instead of Guessing
Keep hostnames and share names as clues until the role is confirmed. Microsoft’s domain-controller cmdlet reference distinguishes querying an identified controller from discovering an available one. A name resembling “DC” is not equivalent to either result.
DNS resolution does not prove service availability, and seeing an SMB share name does not prove permission to read its contents or administer the host. The SMB enumeration guide explains the separate claims involved in names, authentication and access. Use a host check only when that activity and endpoint are explicitly in scope.
5. Separate GPO Rights, Links and Applied Settings
Record the GPO identity, links, relevant delegated rights and the settings you are investigating. Permission to edit a GPO and permission to link it to an OU are different questions. Get-GPPermission reports permission levels for principals on a specified GPO; interpret those results in the actual domain context.
A GPO link does not prove that all its settings affect every descendant object. Microsoft’s Group Policy processing guide describes processing order, inheritance, enforcement, security/WMI filters and loopback behavior. Review the factors relevant to the particular user, computer and setting.
Distinguish a predicted result from an observed result. Group Policy Modeling and Results explains simulation and results reporting, including local gpresult behavior. A report from one computer or identity does not establish application across the environment. Collecting a result requires the appropriate permissions.
For a possible GPO-related path, list the missing evidence: who has the relevant effective right, which policy content can be changed, where it could apply and what consequence follows. Do not change a production GPO just to turn a hypothesis into proof.
6. Inventory AD CS Without Assuming a Vulnerability
Record whether certificate services are in the approved inventory and which CA/templates are relevant. Keep CA discovery, template publication, enrollment permission and authentication implications as separate observations. AD CS presence alone is not a vulnerability.
Microsoft’s certificate posture assessments describe different configurations and prerequisites. For example, an ESC1-style review considers requester-controlled subject information, authentication-capable certificates, enrollment rights, publication and approval/signature protections together. A single template flag or a familiar risk label is not a substitute for checking those conditions.
This guide does not request certificates, change CA settings or demonstrate impersonation. If certificate-path analysis is needed, record the specific unanswered conditions and agree on a separate authorized validation task with the relevant administrators.
7. Keep Membership, Access and Control Distinct
For a group question, Get-ADGroupMember can retrieve members of a specified group. Keep an explicit group identity and server in the record. Names can be ambiguous or localized; preserve the returned distinguished name and SID when available.
$Server = "dc1.lab.example"
$ApprovedGroup = "CN=Lab App Operators,OU=Lab Groups,DC=lab,DC=example"
Get-ADGroupMember -Identity $ApprovedGroup -Server $Server |
Select-Object name, objectClass, distinguishedName, SIDThe fictional distinguished name must be replaced with a verified, approved group. This example omits -Recursive so you can retain direct relationships. Microsoft documents -Recursive as returning members down the hierarchy that do not contain child objects; do not treat that flattened result as a complete record of every intermediate edge.
Membership does not by itself establish effective administration on a host. The resource’s access rules and the relevant session/context still matter. Label a relationship as a membership observation until the additional claim has appropriate supporting evidence.
8. Make the Map Traceable
Use a short record for each relationship: source object, relationship type, destination object, identity, server, timestamp, collection method, evidence location, confidence label and unresolved question. Keep directory exports protected; they may reveal internal names and relationships even without passwords.
- Hypothetical observation
- Lab user Alice is a direct member of Lab App Operators according to one approved group query.
- Separate hypothesis
- The group may have a policy-related right. That has not been checked.
- Unproven consequence
- No host-control or privilege-escalation result is established.
- Next permitted step
- Review the relevant policy permissions and applicability, if those reads are in scope.
The example is fictional. It illustrates how to avoid drawing an administrative-control arrow from a group name. Preserve contradictory evidence and distinguish “not present in this result” from “does not exist.”
9. Automate Collection with Explicit Boundaries
A small collection script can standardize names and selected properties. Keep targets, search boundaries, output paths and error handling explicit. Review any script before use, run it only in the approved environment and verify a sample against the underlying query or console.
Do not silently retry using broader scope or stronger credentials when an operation fails. An error is a limitation to report. Read-oriented collection can still create load and logs; “manual,” “lightweight” and “read-only” are not guarantees of zero operational impact.
No estimator is provided for minutes per OU, domain size or a fixed manual-versus-graph split. Plan from the questions, allowed access, data freshness and required validation. There is no measured percentage improvement behind this workflow.
A Repeatable Evidence-First Workflow
- Define one question and record the authorized slice.
- Confirm collector identity and directory-server context.
- Collect only the objects and properties needed for that question.
- Record direct relationships before summarizing indirect ones.
- Review relevant policy/certificate conditions without assuming effective control.
- Corroborate only through approved checks, then record limits and next steps.
A useful deliverable can be a small table and a list of unresolved questions. A visually complete graph made from uncertain relationships is less informative than a short record whose sources and limits are clear.
Common Manual Profiling Questions
Can manual profiling replace a complete graph analysis?
No. It can answer bounded questions. State collection limits instead of claiming full coverage of permissions, trusts or attack paths.
What belongs in a first profile?
Include the question, approved scope, identity/server context, source records, relationship labels and unanswered conditions. The required objects depend on the question.
Does a narrow query guarantee quiet collection?
No. Collection may create load and audit events. Follow the agreed query types, operational constraints and stop conditions.
When is a graph tool useful?
When its collection and use are permitted and it helps answer the question. Compare sources, timestamps and relationship meanings rather than assuming either output is authoritative.
Does an editable GPO or AD CS presence prove a path?
No. Check the exact rights, affected objects and relevant preconditions. A suspected consequence remains a hypothesis until adequately supported.
Can I use these examples for certification practice?
Use an authorized practice environment and follow the current rules for the specific examination. These examples are learning aids, not an exam compatibility or pass guarantee.
Your Next Bounded Practice Task
Choose one approved group and one question about its direct membership. Keep the query context and result with your notes, then write what that result does not establish. Expand to policy or host questions only when the evidence and authorization support the next step.
Reviewed October 16, 2026. Selected cmdlet meanings, Group Policy distinctions and certificate review conditions were checked against the linked Microsoft documentation. No AD environment was independently queried, scanned or modified for this review. Commands, fictional names and the map record are teaching examples; retained illustrations do not document a personal assessment.