6.5.1 Diagnose the failed boundary
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
The exact command/context, observed output or error, current source host and the last boundary known to work.
Where to look: Walk inward: invocation/runtime -> route -> listener/protocol/TLS -> identity syntax -> authentication -> authorization -> operation -> output channel. Record whether the command reached each layer.
Expected behavior / secure boundary: Read restrictions and incomplete collection are common. Empty data can mean a filter, scope, pagination, permission or freshness issue. A tool crash before network traffic says nothing about the target's vulnerability state.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.5.1.1 Baseline selection
Select the prerequisite check indicated by the interpreted result below. This chooser requires no additional tool or state change.
What this checks: Use the error to choose one discriminating check. Repeating the same command or switching tool names without changing a hypothesis usually adds little evidence.
6.5.1.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
A: connection timed out
B: STATUS_LOGON_FAILURE
C: authentication succeeded; ACCESS_DENIED on file read
D: collection complete; zero Session edges
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| A timeout | No successful protocol exchange was established. | Check source route, listener and relevant transport. | §6.1.2.1 — Validate routes, naming and pivot connectivity |
| B logon failure | The selected authentication attempt failed. | Check local/domain syntax, material type, account state and protocol support. | §6.3.2.1 — Classify recovered credentials and their scope |
| C denied file read | Authentication and object authorization had different outcomes. | Retain valid identity; inspect other permitted objects or rights. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
| D zero Session edges | The collection has no session evidence. | Check whether Session was collected, collection rights and freshness; do not assert no users are logged on. | §6.2.8.1 — Enumerate using BloodHound and validate relationships |
Stop when: The last successful layer and one discriminating next check are recorded.
Revisit only when: New evidence changes the failed layer; do not repeat a disproven path unchanged.
6.5.1.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | The failed condition is domain naming, DC selection or time context: repair that dependency before retrying the relevant protocol. | §6.1.1.1 — Establish the current identity and domain |
| Ruled out in this context | The condition is disproven in this context: close that hypothesis and choose another lead. | §6.2.1.1 — Baseline enumeration — users and groups |
| Inconclusive / failed check | Evidence is unavailable: label inconclusive and record what would resolve it. | §6.5.1.1 — Diagnose the failed boundary |
6.5.1.4 Tooling and complete procedure
Use the smallest relevant native or protocol-specific check already linked by the chosen investigation. No additional failure-scanner or universal automation tool is required. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.