ad-environment-constraints
Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object…
- installs 8w
- 0
- 30-day movement
- starts with the next reading
- Related entries
- 1
- Connections
- 0
This is an agent skill (SKILL.md) documenting real-world Active Directory hardening constraints that make attacks fail in ways that look like bad credentials: disabled NTLM, AES-only KDCs, LDAP signing, clock skew, SPN/FQDN mismatches, Protected Users/LAPS/gMSA, LDAP paging limits, and VPN latency. It is a checklist of nine constraint areas with matching guidance, written as bash code and standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute) with no vendor-specific engine.
Reach for it when a bind, TGT request, LDAP query, or SMB negotiation fails inexplicably, or before running AD tooling against an unfingerprinted domain.
Use it to
- Diagnose auth failures that mimic bad credentials
- Fingerprint a domain before running AD tooling
- Check LDAP signing and LDAPS requirements
- Fix Kerberos clock skew and SPN mismatches
- Handle LDAP 1000-object paging truncation
For Pentesters and red teamers working Active Directory engagements
- Host repository
- ADScanPro/Claude-AD
- Host stars
- 201