Lesson 6 of 9 · 7 min read
Windows and Active Directory Security for Interviews
Windows decides access by comparing a process's access token (user and group SIDs, privileges, integrity level) with an object's security descriptor. Privileges such as SeImpersonate and SeDebug bypass object permissions and are often the real escalation. Active Directory authenticates with Kerberos: tickets protected by the krbtgt key and by service account keys, which is why weak service passwords can be cracked offline and a stolen krbtgt key forges anything. Most domain compromises use credentials cached where admins logged on, so tiering, LAPS, Credential Guard and gMSAs are the core defences.
free sign-in, no card required
Practise it as an interviewer asks it
A standard user account suddenly appears in the Domain Admins group. How do you investigate how it happened and what else changed?Explain the Windows security model: SIDs, access tokens, privileges, integrity levels and UAC. How does an access check work?What are the common classes of Windows local privilege escalation, and how do you harden an estate against them?How do SAML single sign-on and Kerberos work at a high level, and where is trust anchored?How does Kerberos work in Active Directory, and how do Kerberoasting, Golden Tickets and delegation abuse exploit it?How do attackers steal and reuse credentials in a Windows enterprise, and how do you reduce the damage when an endpoint is compromised?