Document Version: 1.0.0
Project: OWASP Subtractive Hardening Top 10
Platform: Microsoft Active Directory
Specification Alignment: PER-1.0 (Path Erasure Rate Engineering Standard)
License: Apache License 2.0
The OWASP Active Directory Subtractive Hardening Top 10 provides deterministic engineering guidance for reducing identity-based cyber risk through the elimination of attack paths capable of enabling domain compromise.
Unlike traditional Active Directory hardening frameworks that focus primarily on auditing, monitoring, or compliance validation, Subtractive Hardening prioritizes the removal of architectural conditions that allow attackers to traverse from low privilege contexts to domain dominance.
Rather than relying on reactive detection, the objective is to physically remove exploitable trust, authentication, credential, and permission relationships from the Active Directory attack graph.
System Graph:
G = (V,E)
Where:
V = Identities, Systems, Directory Objects, Services
E = Authentication, Trust, Permission, or Reachability Relationships
Each recommendation within this standard is intentionally selected based on its ability to reduce adversary reachability and improve measurable attack-path reduction through the Path Erasure Rate (PER) Engineering Standard.
PER = P_erased / P_eligible
Where:
P_eligible = Eligible attack paths identified within scope
P_erased = Attack paths rendered non-traversable through architectural deletion
The objective of this standard is not to make attacks easier to detect.
The objective is to make domain compromise impossible by removing the pathways that enable it.
The Path Erasure Rate (PER) provides a quantitative measure of structural attack-path reduction.
The Active Directory Subtractive Hardening Top 10 provides practical engineering guidance for achieving measurable PER improvements within enterprise identity environments.
Together they establish a repeatable security engineering cycle:
- Identify attack paths.
- Measure attack-path exposure.
- Eliminate attack paths where possible.
- Constrain residual attack paths where necessary.
- Measure resulting reduction.
- Continuously improve architectural resilience.
All recommendations within this standard follow the Subtractive Security Hierarchy of Efficacy.
Remove the attack path completely.
Examples:
- Authentication protocol removal
- Trust relationship removal
- Permission removal
- Service removal
- Replication path removal
Where deletion is not feasible, constrain the path.
Examples:
- Administrative tiering
- Segmentation
- Conditional access
- Authentication assurance
- Access restrictions
Monitoring is reserved for residual attack paths that cannot be deleted or reasonably constrained.
Examples:
- Defender for Identity
- SIEM
- Event Logging
- EDR
- Alerting
Architectural Deletion > Architectural Constraint > Monitoring
Whenever an attack path can be eliminated, elimination is preferred.
Entries included within this Top 10 were selected according to their ability to:
- Eliminate executable attack-path edges.
- Reduce credential theft opportunities.
- Reduce privilege escalation opportunities.
- Reduce lateral movement pathways.
- Reduce domain dominance pathways.
- Reduce attack-path composability.
- Improve measurable Path Erasure Rate (PER).
Recommendations are not ranked based on:
- CVSS scores
- Vulnerability prevalence
- Compliance requirements
- Detection coverage
- Vendor capability claims
The primary selection criterion is architectural impact through attack-path reduction.
| ID | Title |
|---|---|
| AD01 | Legacy Authentication Extinction |
| AD02 | Kerberos Service Trust Reduction |
| AD03 | Directory Credential Exposure Elimination |
| AD04 | Authentication Relay Erasure |
| AD05 | Privileged Identity Mobility Restriction |
| AD06 | Directory Replication Path Elimination |
| AD07 | Certificate Trust Path Reduction |
| AD08 | Domain Controller Surface Area Pruning |
| AD09 | Directory Network Segmentation |
| AD10 | AD Data Exposure Reduction |
Legacy authentication protocols enable downgrade attacks, password cracking, relay opportunities, and credential abuse.
Eliminate obsolete authentication mechanisms.
Attacker
↓
DES / NTLMv1 / Legacy NTLM
↓
Credential Abuse
↓
Privilege Escalation
Remove legacy authentication pathways from the identity plane.
- Disable DES encryption support.
- Disable NTLMv1.
- Restrict NTLM usage.
- Prefer Kerberos wherever possible.
- Remove LM hash support.
Service Principal Names (SPNs) create opportunities for Kerberoasting and offline credential recovery.
Reduce Kerberos-based credential extraction paths.
Authenticated User
↓
SPN
↓
Service Ticket
↓
Offline Cracking
Reduce unnecessary service trust relationships.
- Remove stale SPNs.
- Eliminate unnecessary service accounts.
- Deploy gMSAs.
- Require long randomized service credentials.
- Review delegated service privileges.
Unprotected directory communications expose authentication material and directory operations to interception or abuse.
Eliminate credential exposure during directory operations.
Client
↓
LDAP
↓
Credential Disclosure
Remove cleartext or weak directory communication pathways.
- Require LDAPS.
- Require channel binding.
- Disable simple binds.
- Enforce secure LDAP communications.
Unsigned authentication mechanisms enable relay attacks capable of providing unauthorized access.
Remove relay opportunities.
Attacker
↓
Unsigned Authentication
↓
Relay
↓
Privilege
Eliminate replayable and relayable authentication paths.
- Enable LDAP signing.
- Enable SMB signing.
- Enable Extended Protection for Authentication (EPA).
- Reduce NTLM dependencies.
Many domain compromises occur when privileged identities traverse lower-trust systems and environments.
Reduce privileged identity movement and credential exposure.
Compromised User
↓
Privileged Credential Exposure
↓
Administrative Access
Prevent privileged account mobility across trust zones.
- Separate user and administrative accounts.
- Implement administrative tiering.
- Deploy Privileged Access Workstations (PAWs).
- Implement LAPS.
- Restrict administrative logon locations.
Replication permissions enable DCSync and DCShadow attacks capable of creating complete domain compromise.
Remove unnecessary replication rights.
Compromised Account
↓
Replication Rights
↓
DCSync
↓
KRBTGT Access
Remove unauthorized replication capability.
- Audit replication permissions.
- Remove unnecessary Replicating Directory Changes rights.
- Reduce synchronization accounts.
- Eliminate unauthorized replication principals.
- Restrict DCShadow opportunities.
Misconfigured Active Directory Certificate Services (ADCS) creates direct pathways to domain privilege escalation.
Reduce certificate abuse pathways.
Authenticated User
↓
Certificate Enrollment
↓
Certificate Impersonation
↓
Privilege Escalation
Remove dangerous certificate trust relationships.
- Eliminate ADCS escalation (ESC1-16) attack paths (https://docs.specterops.io/ghostpack-docs/Certify.wik-mdx/4-escalation-techniques).
- Remove vulnerable certificate templates.
- Restrict enrollment permissions.
- Restrict Enrollment Agent rights.
- Reduce certificate issuance attack surface.
Unnecessary services increase the attack surface of domain controllers.
Reduce domain controller attack surface.
Unnecessary Service
↓
Vulnerability
↓
Domain Compromise
Eliminate unnecessary functionality.
- Disable Print Spooler.
- Remove unnecessary software.
- Remove unnecessary agents.
- Remove unnecessary roles.
- Minimize domain controller functionality.
Unrestricted network reachability to domain controllers increases attacker optionality.
Reduce domain controller accessibility.
Compromised Endpoint
↓
Domain Controller
↓
Credential Theft
Reduce unnecessary directory reachability.
- Segment management networks.
- Restrict domain controller access.
- Limit administrative protocol exposure.
- Restrict east-west movement pathways.
Improper SYSVOL and NETLOGON permissions frequently expose credentials, scripts, and privileged configuration artifacts.
Reduce identity intelligence gathering opportunities.
User
↓
SYSVOL / NETLOGON
↓
Credential Discovery
↓
Privilege Escalation
Remove unnecessary exposure of directory-resident data.
- Audit SYSVOL permissions.
- Audit NETLOGON permissions.
- Remove credential artifacts.
- Remove legacy scripts containing secrets.
- Restrict unnecessary access.
Identify all eligible attack paths.
P_eligible(t0)
Apply AD01 through AD10.
Identify attack paths rendered non-traversable.
P_erased(t1)
PER(t1) = P_erased(t1) / P_eligible(t1)
The objective is not improved visibility.
The objective is measurable reduction in reachable attack-path availability.
The goal of these subtractions is to establish deterministic trust boundaries within Active Directory.
By collapsing attack paths, the identity environment becomes architecturally non-conductive.
In this model:
Credential = Fuel
Trust Path = Oxygen
Identity Architecture = Conductivity
Remove the path, and compromise propagation becomes increasingly difficult.
Attackers can only traverse paths that exist.
The objective of Subtractive Hardening is to systematically eliminate or constrain those paths until adversary activity can no longer compose into material business impact.
Security effectiveness is maximized when attack paths are removed, not merely observed.
- OWASP Subtractive Hardening Top 10 Project (https://github.com/OWASP/OWASP-Subtractive-Hardening-Top-10/tree/main)
- Path Erasure Rate (PER-1.0) Engineering Standard (https://github.com/cfrenz/Path-Erasure-Engine/blob/main/PER-1.0_Engineering_Specification.md)
- Evidence-Based Security (https://subtractivesecurity.substack.com/p/the-cyber-falsifiability-crisis-and)
- The Law of Subtractive Risk (https://subtractivesecurity.substack.com/p/the-law-of-subtractive-risk-moving)
- The Science of Silence
OWASP Active Directory Subtractive Hardening Top 10 v1.0