srl
Active Directory Checklist
Working document — tick as you go. Commands are abbreviated; full detail is in the matching AD section of the notes. Stop at the first domain compromise. Configuration-based and credential-based paths (ACLs, delegation, ADCS) are faster and more reliable than CVE exploits. Known exploits (NoPac, PrintNightmare, PetitPotam) last. CVE numbers are hints, not gospel — verify the patch level against the current NVD before committing to a CVE-specific path.
Target context — fill before starting: