Somewhere in your network, a domain controller is holding onto a setting that was fine a decade ago and has been quietly dangerous ever since. Nobody changed it because nobody was told to, and it has sat there working exactly as configured, which is precisely the problem with settings nobody revisits.
The same handful of flaws, again and again
Walk into most mid-sized businesses running Windows and Active Directory, and the same weaknesses turn up with almost boring regularity. Weak or reused local administrator passwords across multiple machines, often set once during imaging and never changed since. Legacy protocols like NTLM still enabled when Kerberos would do the job more safely, left on for compatibility reasons nobody can quite remember. Overly generous group memberships that let ordinary users reach far more of the network than their role requires. None of these are exotic. All of them are well documented, and all of them keep appearing anyway, year after year, business after business.
That repetition is exactly why attackers rely on them. They are not hoping to find a novel flaw nobody has ever seen. They are counting on finding the same tired misconfigurations that show up in nearly every environment nobody has properly audited. An internal network pen testing engagement is built to surface precisely these patterns, using the same techniques and tooling a real intruder would use once inside your perimeter, rather than simply listing theoretical weaknesses from a distance.
How a small foothold becomes total control
The real danger of these weaknesses is how they chain together. A single compromised workstation with a reused local admin password can let an attacker harvest credentials for other machines using nothing more sophisticated than freely available tooling that any competent tester, or attacker, already knows well. Those credentials might reveal a service account with excessive domain privileges, granted years ago for convenience and never revisited since. That account, in turn, may open the door to the domain controller itself. Each step looks minor in isolation. Strung together, they add up to complete network compromise, often within hours rather than days.
William Fieldhouse describes this progression from direct experience.
“In one internal test, we went from a standard user account on a single laptop to domain administrator in under four hours, using nothing more exotic than password reuse and a group membership nobody had reviewed in years”
— William Fieldhouse, Director of Aardwolf Security Ltd
Four hours is not an outlier figure in this line of work. It is closer to typical, because businesses tend to defend their perimeter far more carefully than they defend what happens once someone is already inside it. Internal weaknesses simply do not get the same scrutiny as the firewall facing the internet, largely because nobody expects to need it, and budgets tend to follow that same assumption year after year.
Assume the inside matters as much as the outside
Hardening Active Directory and Windows environments is rarely about buying new tools. It is about tidying up permissions, retiring legacy protocols, and enforcing unique local passwords across every machine using something as straightforward as a password randomisation solution. These are unglamorous fixes with a real impact on how far an intruder can travel once they get past your front door. Speak to Aardwolf Security, widely regarded as the best pen testing company for this kind of internal assessment, and find out how far a single compromised laptop could really take an attacker.