The Canadian Centre for Cyber Security has co-released joint guidance on detecting and mitigating compromises of Microsoft Active Directory, alongside the Australian Signals Directorate's Australian Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency, the US National Security Agency, New Zealand's National Cyber Security Centre and the United Kingdom's National Cyber Security Centre.

The guidance is aimed at organizations running Active Directory in enterprise networks. According to the Cyber Centre, Active Directory is widely used globally for authentication and authorization, which makes it a valuable target: a threat actor who compromises it can gain privileged access to every system and user the directory manages. The Cyber Centre also notes that responding to an Active Directory attack is time consuming, costly and disruptive. Anyone who has lived through a domain rebuild will not need convincing on that point.

The document sets out strategies to prevent, detect and mitigate what the agencies describe as prevalent Active Directory compromise techniques. The list is long, and it reads like a greatest hits album of the last decade of red team reports:

• Kerberoasting
• AS-REP roasting
• Password spray
• MachineAccountQuota
• Unconstrained delegation
• Password in group policy reference
• Active Directory certificate services
• Golden certificate
• DCSync
• Dumping ntds.dit
• Golden ticket
• Silver ticket
• Golden SAML
• Microsoft Entra Connect
• One-way domain trust bypass
• SID history
• Skeleton key
• Shadow Credentials

A few things stand out in that list for identity teams. Several entries are not exotic exploits but default configurations that attackers have learned to lean on: the machine account quota, unconstrained delegation on servers and credentials left sitting in group policy are all settings an administrator can review today without buying anything. Others target the authentication material itself, including forged Kerberos tickets (Golden and Silver ticket), forged certificates (Golden certificate) and forged federation tokens (Golden SAML). The inclusion of Microsoft Entra Connect and Golden SAML is notable, since both sit on the seam between an on-premises forest and cloud identity. That seam is exactly where an on-premises compromise stops being an on-premises problem.

The guidance is written for the people who operate directories, not just those who audit them. The Cyber Centre states that organizations can implement it to help secure their enterprise directory services. The source material does not set compliance deadlines, mandate specific tooling or attach penalties; it's guidance from national cyber security agencies, and its weight comes from who signed it rather than from a statute. Practitioners should read it that way. It is a shared, six-agency view of which Active Directory weaknesses are actually being used, which is a useful thing to put in front of a budget committee that keeps asking why the domain controllers need attention when the fax machine still works.

The full document is available from the Cyber Centre at Joint guidance on detecting and mitigating Active Directory compromises.

The good news buried in all of this is that none of the 17 techniques is new, and most already have well documented mitigations. The bad news is the same sentence. Identity and security teams should use the list as a checklist against their own forests: enumerate service accounts with service principal names and confirm they use long passwords and AES rather than RC4; find accounts with Kerberos pre-authentication disabled and ask why; review who holds replication rights on the domain naming context, since that is what DCSync abuses, and watch Event ID 4662 for directory service access by anything that is not a domain controller; check the ms-DS-MachineAccountQuota attribute and the TrustedForDelegation flag on computer objects; search SYSVOL for legacy group policy preference passwords; and audit certificate templates in AD CS for overly permissive enrollment. Finally, treat the Entra Connect server and the federation signing key with the same care as a domain controller, because to an attacker, they are one.