Identity Paths Are Graphs
Active Directory security is easiest to understand as a graph of identities, rights, sessions, services, and policy relationships. A user is not only a username. It may have group memberships, delegated rights, service principal names, certificate mappings, local administrator access, database access, or control over objects that eventually affect a privileged system.
The path matters more than any single finding. A low-privilege account with a write right over another object, a service account with an SPN, or a principal that can link a GPO may be more important than a noisy local vulnerability. Identity paths often produce cleaner and more reliable movement because they use configured trust relationships.
Start With Principals And Rights
The first question is always: what identity do I have and what can it affect? That includes group membership, direct ACL rights, inherited rights, local administrator access, remote management rights, database roles, certificate enrollment rights, delegation settings, and reachable hosts.
Rights should be interpreted with context. GenericAll over a low-value object is different from WriteDACL over a user, WriteOwner over a group, WriteProperty over an SPN-bearing account, or GPO link rights over a site. The same permission name can have very different impact depending on the target object and the environment.
Kerberos And Delegation
Kerberos adds another layer to identity paths. Tickets represent authentication to services, while delegation controls when one service can obtain tickets on behalf of another user. Constrained delegation, protocol transition, resource-based constrained delegation, and alternate service ticket behavior can all become meaningful when the right account and service relationship exists.
A useful delegation review records the account, delegation type, target service, protocol transition setting, reachable host, and final service needed for access. It also distinguishes ticket acquisition from successful service authorization. A ticket can be valid but still fail if the service or host denies the action.
Certificates And Shadow Material
Certificate-based identity paths are important because they can change how authentication is performed. Enrollment templates, mapping attributes, key credential material, and certificate trust can create routes that are separate from passwords and hashes. These paths need careful validation because they may persist beyond a single shell session.
In an assessment, certificate and key-credential changes should be tracked with rollback information. The operator should know what object changed, what attribute was touched, what certificate or key material was created, and how to remove it afterward.
GPO And Host Reachability
GPO paths are powerful because policy can affect many machines. Create rights, edit rights, link rights, SYSVOL access, and target scope all matter. A GPO that applies to a high-value host is very different from a GPO that applies nowhere useful.
Host reachability closes the loop. An identity path is not complete until the operator can reach the target management protocol or service. That is why enumeration, DNS, routing, firewall state, and pivoting remain part of Active Directory operations. Identity control without network reachability is an incomplete path.