Active Directory Penetration Testing in Australia: Scope, Cost and When You Need It

Active Directory penetration testing is a focused security assessment of your Windows identity layer — on-premises Active Directory, Microsoft Entra ID (Azure AD), or a hybrid of both — to find whether an attacker with a foothold could escalate privileges, move laterally and take over the domain. For most Australian SMBs, that identity layer is still where ransomware and insider-path attacks become business-ending. At Aussie Pentest, Active Directory and internal identity testing sit inside our Standard and Advanced penetration testing engagements, which start from $12,000 + GST and $20,000 + GST respectively (Basic external-only starts from $5,000 + GST).

This guide explains what AD/Entra testing covers, how it differs from a generic network scan, what it costs in Australia, how it maps to Essential Eight and insurer expectations, and when an SMB actually needs it. If you're still comparing network scopes, start with network penetration testing in Australia or external vs internal penetration testing.

What is Active Directory penetration testing?

Active Directory penetration testing is authorised exploitation of identity misconfigurations and attack paths in your directory services, not just a list of missing patches on domain controllers. Testers start from an agreed foothold (typically a standard user account, a VPN user, or a "assumed breach" workstation) and try to reach Domain Admin, Entra Global Admin, backup systems, or other high-value targets using the same techniques real attackers use.

In Australian SMB environments that usually means:

• ▸On-premises Active Directory — domain controllers, trusts, GPOs, Kerberos, NTLM, legacy protocols
• ▸Microsoft Entra ID — cloud identities, conditional access, app registrations, privileged roles
• ▸Hybrid identity — Entra Connect / sync paths, password hash sync, federation, hybrid join devices
• ▸Supporting controls — MFA coverage, privileged access workstations (or the lack of them), local admin reuse, backup and remote-management consoles tied to the same identity system

What it is not

It isn't a vulnerability scan of every Windows host. Scanning finds missing patches and weak services; AD testing answers a different question: if someone already has a low-privilege foothold, how far can they go? Both matter. Confusing them is how organisations buy a scan report and still get domain-owned after a single phished laptop.

Why does Active Directory matter for Australian businesses?

Because identity compromise is how opportunistic cybercrime turns into ransomware and large data theft — and Australian reporting shows those outcomes are still rising. You don't need a nation-state actor; you need one weak service account, reused local admin password, or over-privileged help-desk role.

Verified context from official sources:

• ▸ASD's Australian Cyber Security Centre (ACSC) Annual Cyber Threat Report 2024–25 recorded over 84,700 cybercrime reports (about one every six minutes), responded to over 1,200 cyber security incidents (up 11% on the prior year), and responded to 138 ransomware incidents. Average self-reported cybercrime cost per report was $56,600 for small businesses and $97,200 for medium businesses.
• ▸The same reporting period put ransomware in 11% of incidents ASD's ACSC responded to. Ransomware operators routinely abuse directory privileges once they're inside a Windows estate.
• ▸ASD publishes dedicated guidance on detecting and mitigating Active Directory compromises, emphasising that attackers escalate toward Domain Admins and Enterprise Admins, and that privileged access hardening (including tiered models for hybrid Entra environments) is essential.
• ▸Restricting administrative privileges is one of ASD's Essential Eight strategies. ASD's guidance on restricting administrative privileges expects dedicated privileged accounts, least privilege, and regular revalidation — exactly the controls AD testing validates in practice.

In engagements, the pattern we see is consistent: external hardening has improved, but internal identity is still flat. Local admin passwords are reused across workstations, service accounts have SPNs that invite Kerberoasting, and "break glass" Global Admin accounts sit without phishing-resistant MFA.

What does an Active Directory penetration test cover?

A useful AD test maps attack paths from a realistic starting point to the controls that would stop domain takeover. Exact techniques depend on your environment and rules of engagement, but a typical Australian SMB scope includes the areas below.

1. Foothold and authentication surface

• ▸Password spraying and credential reuse (within agreed rate limits)
• ▸Legacy authentication (NTLM, outdated protocols, unconstrained delegation exposure)
• ▸MFA gaps for VPN, RDP, Outlook, admin portals and Entra roles
• ▸Whether a captured credential actually opens more doors (over-permissioned groups, shared mailboxes, remote tools)

2. Privilege escalation in Active Directory

• ▸Kerberoasting and AS-REP roasting against service and user accounts
• ▸ACL and GPO abuse (who can modify what, and can that path reach Domain Admin?)
• ▸Insecure delegation (unconstrained, constrained, resource-based constrained)
• ▸Misconfigured certificate services (AD CS) where present
• ▸Local privilege escalation on jump hosts or admin workstations that sit on the path

3. Lateral movement and domain dominance

• ▸SMB, WinRM, RDP and other remote admin paths between hosts
• ▸Credential dumping and pass-the-hash / pass-the-ticket where authorised
• ▸Abuse of backup, monitoring, RMM or hypervisors that effectively equal domain control
• ▸Domain trust misuse between forests or resource domains

4. Hybrid and Entra ID paths

• ▸Privileged Entra roles and app consent / OAuth abuse
• ▸Conditional Access bypasses and legacy auth exclusions
• ▸Sync account and Entra Connect attack paths in hybrid setups
• ▸Device join and Intune admin paths that lead back into on-prem privilege

5. Detection and recovery readiness (light touch)

A pentest is not a SOC assessment, but good AD testing notes whether obviously noisy techniques would have been invisible — and whether backups, tiering and privileged workstations would have limited blast radius. That pairs naturally with remediation validation after you fix findings.

How is AD testing different from internal network testing?

Internal network testing looks at hosts, services and segmentation. Active Directory testing focuses on identity as the control plane that makes those hosts matter. In practice they overlap heavily for Windows estates, which is why Aussie Pentest includes AD attack-path work inside internal/Standard and Advanced scopes rather than selling a gimmicky "BloodHound-only" add-on.

If you only test the perimeter, you miss the path ransomware operators actually use after phishing or a VPN compromise. Our black box vs grey box vs white box guide explains why grey-box AD testing (with a normal user account) usually gives SMBs the best signal for the money.

How much does Active Directory penetration testing cost in Australia?

At Aussie Pentest, Active Directory and internal identity testing are included in our Standard penetration test from $12,000 + GST and our Advanced engagement from $20,000 + GST. Standard covers external and internal network testing (up to 50 IPs and 2–3 web applications). Advanced adds broader coverage including APIs and social engineering. Basic (from $5,000 + GST) is external-only and does not include internal AD work.

All human-led tiers are fixed-fee, scoped in writing before testing starts, and include a severity-ranked report with proof-of-concept evidence on every critical finding. Prices are AUD + GST; international clients are GST-free. See the live breakdown on our pricing page.

What changes the price of the AD/internal component:

• ▸Number of users, computers and domain controllers (and whether you have multiple sites or trusts)
• ▸Hybrid complexity — on-prem only vs Entra + Entra Connect + multiple tenants
• ▸Access model — assumed-breach user account vs full white-box directory export
• ▸Related apps — how many web apps, APIs or cloud admin portals sit in the same identity boundary
• ▸Rules of engagement — whether credential dumping, AD CS abuse or production DCs are in or out of scope
• ▸Reporting needs — board pack, insurer questionnaire mapping, or Essential Eight privileged-access evidence

Not ready for a full Standard engagement? An automated security assessment from $80 checks internet-facing exposure quickly, but it will not map AD attack paths. For broader cost drivers, read penetration testing costs for SMBs in Australia.

When does an Australian SMB need Active Directory testing?

You need it when Windows or Entra identity protects your money, customer data or operations — and you lack recent evidence that a foothold couldn't become domain/tenant takeover. Common triggers:

• ▸You run on-prem Active Directory, hybrid Entra ID, or Microsoft 365 with privileged admin roles
• ▸Staff use VPN, RDP or cloud apps that authenticate against the same directory
• ▸Local admin rights are common on workstations, or passwords may be reused
• ▸You're preparing for cyber insurance renewal and underwriters ask about privileged access, MFA and internal testing
• ▸A client, tender or board wants evidence beyond an external vulnerability scan
• ▸You're working toward Essential Eight Maturity Level 1 or 2, especially restrict administrative privileges and MFA
• ▸You've had a phishing near-miss, stolen laptop, or MSP credential exposure
• ▸You're about to migrate, consolidate domains, or turn on new Entra Connect / federation paths

If you only have a handful of SaaS apps with no shared Windows domain, prioritise web application and API penetration testing first — then revisit identity when you grow into Microsoft 365 / Entra.

How does AD testing support Essential Eight, Privacy Act and insurance?

AD testing doesn't certify compliance on its own, but it produces the kind of evidence Australian buyers, insurers and assessors actually ask for: can privileged access be abused, and what would you fix first?

• ▸Essential Eight — restrict administrative privileges and MFA. ASD's Essential Eight expects validated privileged access, dedicated admin accounts, least privilege and (at higher maturity) stronger MFA. An Essential Eight assessment ($4,950 + GST for environments up to 50 seats) measures control maturity. AD penetration testing pressure-tests whether those controls hold against live attack paths. See Essential Eight Maturity Level 1 vs Level 2.
• ▸Privacy Act APP 11 and the NDB scheme. If you hold personal information, APP 11 requires reasonable steps to protect it. Directory compromise often leads to mailbox, file-share and SaaS access that exposes personal information at scale. Testing identity pathways supports a reasonable-steps narrative alongside technical hardening. See Privacy Act cyber security requirements.
• ▸APRA CPS 234. APRA-regulated entities (and many of their suppliers) must systematically test information security control effectiveness. Identity and privileged-access controls are squarely in that scope. See CPS 234 penetration testing.
• ▸Cyber insurance. Underwriters commonly ask about MFA coverage, privileged accounts, backup isolation and whether you've had an independent test. An AD-inclusive internal report gives factual answers. See cyber insurance and penetration testing.

What should you prepare before an AD engagement?

Give testers a clear foothold, a written scope and a trusted contact — and decide what "domain compromise" means for your business before day one. A short prep checklist:

1. Nominate a trusted agent who can approve emergency stops, confirm production sensitivity and receive high-severity findings mid-test.
2. Agree the starting identity — standard user, VPN-only, or assumed-breach workstation image.
3. List out-of-scope systems (payment switches, medical devices, fragile OT) and peak business hours to avoid.
4. Confirm hybrid topology — domains, trusts, Entra tenants, Entra Connect servers, break-glass accounts.
5. Decide evidence depth — screenshots and PoC only, or limited data access to prove impact (never exfiltrate real customer data).
6. Plan remediation owners — AD/GPO changes often need your MSP and your internal IT both in the loop.
7. Book a debrief slot before the report lands so findings don't sit unread.

For a fuller SMB prep list, use how to prepare for a penetration testing engagement.

What should you fix after Active Directory findings?

Prioritise paths that turn one compromised user into Domain Admin or Global Admin, then remove the standing privileges that made those paths possible. Typical remediation themes:

Privileged access

• ▸Shrink Domain Admins / Global Admins to a tiny, named set with phishing-resistant MFA
• ▸Separate admin accounts from daily-driver email accounts
• ▸Introduce tiering (or Microsoft's Enterprise Access Model concepts) so Tier 0 credentials never land on user workstations
• ▸Disable stale privileged accounts; revalidate access on a schedule

Authentication hardening

• ▸Eliminate password reuse and local admin sameness (LAPS or equivalent)
• ▸Reduce Kerberoastable service accounts; use group Managed Service Accounts where appropriate
• ▸Block legacy authentication; tighten Conditional Access
• ▸Protect break-glass accounts properly and monitor their use

Detection and recovery

• ▸Alert on unusual Kerberos activity, new privileged group membership and Entra role assignments
• ▸Isolate backups from the same identity blast radius
• ▸Validate restores — a backup you can't restore under AD compromise isn't a control

If you need ongoing governance after the test (risk register, board reporting, roadmap cadence), a vCISO retainer from $2,500/month keeps the remediation program moving without hiring a full-time CISO.

Frequently asked questions

Do we need Active Directory testing if we are "all in" on Microsoft 365?

Yes, if you still have privileged Entra roles, synced identities, device management, or any on-prem remnants. Cloud-only tenants still fail through over-privileged Global Admins, weak Conditional Access and risky app consents. Hybrid estates add Entra Connect paths on top.

Is BloodHound or a directory audit the same as a pentest?

No. Attack-path mapping tools are valuable, and good testers use them, but a penetration test attempts exploitation under rules of engagement and proves impact with evidence. An export of "paths exist" without proving which ones work in your controls is only half the story.

Will AD testing break production?

Serious providers scope carefully, rate-limit password attacks, avoid reckless changes on domain controllers, and keep a trusted agent on call. Residual risk is never zero — that's why written rules of engagement and change windows matter. Ask vendors how they handle DC and Entra Connect testing specifically.

How often should we retest Active Directory?

After material identity changes (migrations, new trusts, major Entra Conditional Access overhauls, MSP changes) and at least on the same cadence as your broader pentest program. Many SMBs retest annually for insurance/tenders, with a lighter validation after critical remediations. See how often you should get a penetration test.

Can our MSP just harden AD instead of testing?

Hardening is essential — and MSPs often implement LAPS, tiering and MFA well. Independence still matters: the team that built the directory should not be the only team judging whether it can be taken over. White-label options exist if your MSP wants to stay client-facing; see MSP white-label penetration testing.

The bottom line

Active Directory and Entra ID are the control plane for most Australian SMBs. If an attacker who phishes one user — or steals one VPN session — can become Domain Admin or Global Admin, your external firewalls won't save you. Active Directory penetration testing proves whether those attack paths exist, with evidence you can remediate and show to insurers, boards and customers. At Aussie Pentest, AD and internal identity work is included in Standard engagements from $12,000 + GST and Advanced engagements from $20,000 + GST, with fixed fees and written scope before testing starts.

Want to know whether AD belongs in your next test? Book a 1-on-1 call and we'll help you scope a fixed-fee engagement. You can also review penetration testing services, Essential Eight assessments, or ongoing vCISO advisory.

Sources

• ▸Aussie Pentest: Penetration Testing
• ▸Aussie Pentest: Pricing
• ▸ASD: Annual Cyber Threat Report 2024–25
• ▸ASD: Detecting and mitigating Active Directory compromises
• ▸ASD: Essential Eight maturity model
• ▸ASD: Restricting administrative privileges
• ▸OAIC: APP Guidelines Chapter 11, Security of personal information

This article is general information only, not legal or compliance advice. Prices are current as of October 2026 and statistics and regulatory references were checked in October 2026. Check your own situation with a qualified adviser, and only test Active Directory, Entra ID and related systems you have written authority to assess.