Lion Cipher Lab

Audit your Active Directory for excessive privilege (least-privilege hardening)

• Identity & Access Management
• Advanced
• ~2-3 hours (most of it is the one-time lab build)
• Free · no account required

Why it matters

In almost every real intrusion that ends in ransomware or mass data theft, the attacker's win condition is the same: reach Tier 0 -- control of the identity system itself -- because whoever controls Active Directory controls every server, workstation and account it manages. The dangerous part is that privilege in AD is transitive: nested groups, delegated rights and object ACLs quietly stack up until a low-tier helpdesk account effectively inherits domain-admin control that nobody ever intended to grant. A plain look at 'who's in Domain Admins' misses it completely. This lab teaches you to…

What you'll learn

• reasoning about Active Directory privilege as a transitive graph (principals + the rights between them)
• measuring a directory against Microsoft's Enterprise Access Model / tier model (Tier 0 = control plane)
• expanding nested group membership with Get-ADGroupMember -Recursive to reveal hidden privilege chains
• finding protected/privileged accounts via AdminCount=1 and the adminSDHolder mechanism
• reviewing delegated ACLs (GenericAll / WriteDacl / WriteOwner) on sensitive AD objects with Get-Acl
• spotting privileged accounts with SPNs and stale/never-expiring passwords, and why that is risky
• remediating the CLASS of over-privilege (JIT/PAM, ACL cleanup, logon restrictions) and re-auditing to prove it
• judgment: when a graph/audit tool beats a manual review, and why Tier 0 is where the effort belongs

Steps in this lab

1. The problem: privilege in AD is a graph, and it's transitive
2. The yardstick you audit against: the Enterprise Access Model (Tier 0)
3. Judgment first: manual review vs a graph view, and where the effort belongs
4. Build (or reuse) an isolated AD lab you own
5. Seed a realistic over-privilege (so there's something honest to find)
6. Audit 1 - expand Tier 0 membership recursively (the chain a list hides)
7. Audit 2 - find protected accounts by AdminCount, and catch the orphans
8. Audit 3 - read the delegated ACLs on sensitive objects
9. Audit 4 - privileged accounts that are also service or stale accounts
10. Remediate the CLASS of problem, not one account
11. Re-audit to PROVE the risk is gone (your before/after)
12. The judgment to keep

Open the full interactive lab →