--- title: Active Directory Security Improvement · avantguard cyber security description: Active Directory Security Improvement --- [Skip to content](https://avantguard.io/en/ad_improvement#main) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=128&height=61&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) - [Services](https://avantguard.io/en/services?hsLang=en) - [About Us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [Career](https://avantguard.io/de/karriere?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) [DE](https://avantguard.io/ad_improvement) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [DE](https://avantguard.io/ad_improvement) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) Services # Active Directory Security Improvement Virtually all attacks are carried out via the Active Directory. Accordingly, it makes sense to assign special priority to the AD and to examine and harden it from an attacker's perspective. The Active Directory has often grown historically and can sometimes be very confusing. However, excellent tools exist for attackers to find attack paths in this complex interplay and to exploit misconfigurations. So the obvious thing to do is to use the same tools to uncover and stop these attack paths. And that is exactly what is done in this module. This often reveals numerous paths and possibilities, and here we can use our experience and attacker knowledge to create a clear prioritization of measures. This can also be done in several iterations, so that the most critical paths can be mitigated first and no bottleneck occurs during remediation. [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) ## An Active Directory security improvement is recommended if you cannot answer one of these questions with confidence - Can compromised users elevate their privileges to the point of critical damage? - Which of our groups are particularly critical and need to be protected? - Are there user accounts which are not actively used and should be deactivated? - Do our service accounts have too many permissions? - Which accounts and systems do we need to keep a close eye on to respond to cyberattacks? ## Process 1. Kick-Off ### Active Directory Overview In a meeting, an overview of the existing Active Directory is developed together with the responsible persons. Questions about the number of domains, users, service accounts, etc. are clarified here. 2. Accounts ### Required Accounts For the practical test, normal Active Directory users are required, as they are used by regular users in the company. No elevated rights are required and existing accounts can be used. 3. Access ### Test device For the practical tests, access to the Active Directory with the provided AD user is required. This can be done from a work notebook or via remote access, such as Citrix. Here, too, it is recommended to keep the setting as close as possible to the regular setup of employees. 4. Test ### collecting test data In a relatively short time, a lot of data can be queried via the Active Directory. This large amount of data must then be evaluated correctly. The procedure is identical to that of real attackers and any detection mechanisms can be checked at the same time. 5. Analyze ### gaining insights The collected data is then evaluated and possible attack paths are searched for. The attack paths are then prioritized and broken down into individual measures that are as effective as possible. 6. Report ### report writing All results are summarized and evaluated. Measures are proposed for all risks and their priority is recorded. For benchmark environments, a score can be determined for comparison with other AD environments. 7. Repeat ### Sustained improvement The measures can be checked for their effectiveness using the tools shown. Especially for larger AD environments, it is recommended to use an iterative top-down approach. All results are submitted in a final report (PDF, Excel and JSON). This is where the real work begins. Cybersecurity can only be increased if measures are also implemented. Thanks to the Active Directory Security Improvement, measures can now be addressed according to their priority and cost-benefit ratio. Via Mesher, your current security level is recorded and you can view the return on investment for the various measures. All results are also visualized here and can be linked to existing tools thanks to integrations. With the platform, technical measures can be directly assigned with tasks to the appropriate people and agile working without media breaks is made possible. This lays the foundation for efficient and sustainable cyber security in the company. ## How secure are your systems really? Tell us about your project. We will get back to you with a non-binding offer. [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [+41 55 253 30 30](tel:+41552533030) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=140&height=66&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) avantguard cyber security AG Neue Jonastrasse 52 8640 Rapperswil-Jona, Switzerland [+41 55 253 30 30](tel:+41552533030) [info@avantguard.io](mailto:info@avantguard.io) ## Company - [Services](https://avantguard.io/en/services?hsLang=en) - [About us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [AI at avantguard](https://avantguard.io/en/how-we-use-ai?hsLang=en) - [Careers](https://avantguard.io/en/careers?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) ## Services - [Penetration Testing](https://avantguard.io/en/penetration-test?hsLang=en) - [Red Teaming](https://avantguard.io/en/red-teaming?hsLang=en) - [Attack Simulation](https://avantguard.io/en/attack-simulation?hsLang=en) - [FINMA-regulated pentesting](https://avantguard.io/en/finma-regulated-pentesting?hsLang=en) - [AD Security Improvement](https://avantguard.io/en/ad_improvement?hsLang=en) - [mesher](https://avantguard.io/en/mesher?hsLang=en) - [All services](https://avantguard.io/en/services?hsLang=en) ## Research - [All posts](https://avantguard.io/en/blog?hsLang=en) © 2026 avantguard cyber security AG - [Privacy policy](https://avantguard.io/en/privacy-policy) - [Deutsch](https://avantguard.io/)