OSCP+ Active Directory Guide: Complete Enumeration & Attack Methodology
OSCP+ Active Directory Guide: Complete Enumeration & Attack Methodology (2026)
Published under OffSec PEN-200 Preparation • Read Time: 8 min
In the OffSec OSCP+ (PEN-200) certification, securing the 40-point Active Directory (AD) set is the most critical hurdle for candidates. Unlike standalone targets where partial points can be accumulated, Active Directory is an all-or-nothing engagement requiring complete domain dominance. This guide covers a structured, repeatable methodology to enumerate domain objects, map high-value trust paths, and avoid costly exam rabbit holes.
1. Low-Noise Foothold & Privilege Triage
Once initial access is established on the client machine, immediate internal reconnaissance must be executed without triggering unnecessary alerts or process crashes. Execute baseline identity verification:
whoami /user
whoami /priv
whoami /groups
# Domain Controller and Net Discovery
net user /domain
net group "Domain Admins" /domain
nltest /dclist:domain.local
Need Complete Step-by-Step Exam Reports?
Compare attack trees, exact flags, and terminal executions across all active exam sets directly in our store archive:
Explore All OSCP+ AD Sets Writeups →2. PowerView & SharpHound Enumeration Strategy
Mapping Access Control Lists (ACLs) and Service Principal Names (SPNs) provides direct pathways to high-privilege service accounts without brute-forcing passwords.
| Attack Objective | Command Syntax | Exploitation Goal |
|---|---|---|
| Kerberoasting | Get-DomainUser -SPN | Request TGS tickets for offline cracking |
| AS-REP Roasting | Get-DomainUser -PreauthNotRequired | Dump hashes without Kerberos pre-authentication |
| ACL Object Rights | Find-InterestingDomainAcl | Identify GenericAll, WriteDacl, or ForceChangePassword |
Accelerate your certification prep with verified exam methodologies.
Access verified documentation, full command logs, and complete walkthroughs for your specific set.
Browse All AD Sets Writeups