6.5.4 Expected behavior and useful security boundaries
Use these as contextual expectations, not a claim that every organization uses one default configuration. Check the exact object, policy, version and effective permissions.
| Investigation | Often expected / intended | Interesting clue requiring validation | Do not conclude |
|---|---|---|---|
| Directory reads | Authenticated users can read many users/groups/SPNs | Secret-bearing readable attributes or excessive useful object rights | LDAP read access means directory administration |
| SYSVOL / NETLOGON | Domain users read policy and logon material | Readable secrets, or controlled content with a useful privileged consumer | SYSVOL readability itself is a vulnerability |
| Service SPNs | Services register Kerberos identities | Useful account plus feasible offline password recovery | An SPN is a weak password |
| Preauthentication | Normally required for Kerberos accounts | Explicitly disabled on an account with compatible request conditions | A timeout proves no-preauth or password validity |
| Groups / ACLs | Narrow intended administrative delegation | A controlled trustee has effective unintended useful control | A group name or one ACE proves effective access |
| Remote access | Service-specific rights restrict host logon/execution | A useful reachable endpoint authorizes the controlled identity | Valid domain credentials mean remote execution |
| Sessions | Users log on and network sessions appear/disappear | A fresh valuable session on a host you can suitably control | A session guarantees accessible plaintext credentials |
| LAPS / gMSA | Managed random credentials and restricted reads | Excessive usable read/decryption rights on useful accounts | Merely seeing the object is a weakness |
| Credential protection | Protection varies with OS, policy and runtime state | A source is actually accessible with suitable privileges | An absent registry value proves protection is disabled |
| Replication | DCs and deliberately delegated services replicate | Controlled principal has effective secret-replication rights | Member-server local admin implies DCSync |
| AD CS / GPO / delegation | Legitimate enterprise functionality | The complete selected misuse conditions align | A scanner label or isolated flag proves exploitation |
For each clue, record: object/host -> current identity -> exact observed permission/configuration -> missing condition -> decisive check -> resulting capability. Use the AD cheatsheet for commands and next decisions; the §6 — investigation index links annotated examples.