---
title: "Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work"
description: "Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths."
date: 2026-11-02
author: Sevban Dönmez (@jankesec)
canonical: https://jankesec.com/posts/multi-forest-active-directory-architecture/
---

## Directory Topology and Forest Security Boundaries

In enterprise environments, Active Directory security assessments frequently fail when operators mistake domain administrative boundaries for security boundaries. A Domain Controller is not an isolated target; it is a node in a replicated directory topology governed by directory partitions, trust attributes, and service locator records. Misconfigurations in Active Directory are rarely software bugs: they are standard Windows architecture features operating across misconfigured trust boundaries:

- **AS-REP Roasting and Kerberoasting** are standard RFC 4120 ticket exchanges (`AS-REP` and `TGS-REP`) encrypted with the target account's long-term secret key, allowing stateless KDCs to avoid maintaining per-client session state in memory.
- **Constrained Delegation (`S4U2Self` / `S4U2Proxy`)** is a protocol extension allowing multi-tier enterprise applications (such as an IIS web frontend querying a backend MSSQL database) to impersonate authenticated users without handling or storing cleartext passwords.
- **Parent-Child `ExtraSids` Privilege Escalation** functions because a child domain is an administrative unit, not a security boundary. Every domain inside an Active Directory forest shares the same `Configuration` and `Schema` partitions.
- **Directory Graph Enumeration (BloodHound)** operates because Windows member servers and domain clients require read access to directory metadata and object security descriptors (`nTSecurityDescriptor`) under the `Authenticated Users` identity to apply Group Policies, resolve SIDs, and locate services.

The five-server [GOAD (Game of Active Directory)](https://orange-cyberdefense.github.io/GOAD/) lab provides a complete reference model for evaluating multi-tier architecture. Through read-only LDAP and DNS queries dispatched from a security auditing host (`192.168.56.0/24`), this analysis details how two distinct forests, three domains, three Domain Controllers, and two member servers interact under Microsoft Windows Server protocols.

<figure class="diagram">
<svg viewBox="0 0 760 365" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Active Directory partition and trust architecture in GOAD: Forest 1 (sevenkingdoms.local) shares Schema and Configuration across DC01 and DC02, while Forest 2 (essos.local on DC03) maintains isolated partitions connected via cross-forest trust with SID filtering.">
<defs>
  <marker id="arch-m1" viewBox="0 0 8 8" refX="7" refY="4" markerWidth="6" markerHeight="6" orient="auto"><path d="M0,0 L8,4 L0,8 z" class="dg-arrow" /></marker>
  <marker id="arch-m1-crit-r" viewBox="0 0 8 8" refX="7" refY="4" markerWidth="6" markerHeight="6" orient="auto"><path d="M0,0 L8,4 L0,8 z" class="dg-arrow-crit" /></marker>
  <marker id="arch-m1-crit-l" viewBox="0 0 8 8" refX="1" refY="4" markerWidth="6" markerHeight="6" orient="auto"><path d="M8,0 L0,4 L8,8 z" class="dg-arrow-crit" /></marker>
</defs>
<text x="12" y="20" class="dg-muted">FOREST SECURITY BOUNDARIES · SHARED PARTITIONS VS. CROSS-FOREST TRUST</text>
<rect x="12" y="34" width="314" height="318" rx="8" class="dg-box-accent" />
<text x="24" y="55" class="dg-accent">FOREST 1 · sevenkingdoms.local</text>
<rect x="22" y="66" width="294" height="46" rx="6" class="dg-box" />
<text x="34" y="85" class="dg-label">Shared Forest Partitions</text>
<text x="34" y="101" class="dg-mono dg-compact">CN=Schema · CN=Configuration · DC=ForestDnsZones</text>
<line x1="169" y1="112" x2="169" y2="124" class="dg-line dg-dash" marker-end="url(#arch-m1)" />
<rect x="22" y="124" width="294" height="52" rx="6" class="dg-box" />
<text x="34" y="145" class="dg-label">DC01 · kingslanding (.10)</text>
<text x="228" y="145" class="dg-accent dg-compact">FOREST ROOT</text>
<text x="34" y="163" class="dg-mono dg-compact">DC=sevenkingdoms,DC=local · SEVENKINGDOMS-CA</text>
<line x1="169" y1="176" x2="169" y2="184" class="dg-line" />
<rect x="36" y="184" width="266" height="18" rx="4" class="dg-box" style="fill: #0c0e0e; stroke: rgba(255,255,255,0.2);" />
<text x="169" y="196" text-anchor="middle" class="dg-muted dg-compact">Parent/Child Trust (0x20) · SID Filter OFF</text>
<line x1="169" y1="202" x2="169" y2="212" class="dg-line" marker-end="url(#arch-m1)" />
<rect x="22" y="212" width="294" height="52" rx="6" class="dg-box" />
<text x="34" y="233" class="dg-label">DC02 · winterfell (.11)</text>
<text x="230" y="233" class="dg-muted dg-compact">CHILD DOMAIN</text>
<text x="34" y="251" class="dg-mono dg-compact">DC=north,DC=sevenkingdoms,DC=local</text>
<line x1="169" y1="264" x2="169" y2="280" class="dg-line" marker-end="url(#arch-m1)" />
<rect x="22" y="280" width="294" height="56" rx="6" class="dg-box" />
<text x="34" y="301" class="dg-label">SRV02 · castelblack (.22)</text>
<text x="228" y="301" class="dg-muted dg-compact">MEMBER SVR</text>
<text x="34" y="318" class="dg-muted dg-compact">IIS 80 · MSSQL 1433 · Constrained Delegation</text>
<rect x="337" y="112" width="86" height="76" rx="6" class="dg-box-danger" />
<text x="380" y="129" text-anchor="middle" class="dg-crit dg-compact" font-weight="700">FOREST TRUST</text>
<text x="380" y="143" text-anchor="middle" class="dg-label dg-compact">TDO (2-WAY)</text>
<text x="380" y="158" text-anchor="middle" class="dg-crit dg-compact">SID FILTER ON</text>
<text x="380" y="172" text-anchor="middle" class="dg-muted dg-compact">0x48 / 0x08</text>
<line x1="316" y1="150" x2="337" y2="150" class="dg-line-crit" marker-start="url(#arch-tr-m1-crit-l)" />
<line x1="423" y1="150" x2="444" y2="150" class="dg-line-crit" marker-end="url(#arch-m1-crit-r)" />
<rect x="337" y="222" width="86" height="42" rx="6" class="dg-box" />
<text x="380" y="238" text-anchor="middle" class="dg-label dg-compact">DNS FWD</text>
<text x="380" y="252" text-anchor="middle" class="dg-muted dg-compact">Conditional 53</text>
<line x1="316" y1="243" x2="337" y2="243" class="dg-line dg-dash" />
<line x1="423" y1="243" x2="444" y2="243" class="dg-line dg-dash" />
<rect x="434" y="34" width="314" height="318" rx="8" class="dg-box-accent" />
<text x="446" y="55" class="dg-accent">FOREST 2 · essos.local</text>
<rect x="444" y="66" width="294" height="46" rx="6" class="dg-box" />
<text x="456" y="85" class="dg-label">Isolated Forest Partitions</text>
<text x="456" y="101" class="dg-mono dg-compact">CN=Schema · CN=Configuration (Independent)</text>
<line x1="591" y1="112" x2="591" y2="124" class="dg-line dg-dash" marker-end="url(#arch-m1)" />
<rect x="444" y="124" width="294" height="52" rx="6" class="dg-box" />
<text x="456" y="145" class="dg-label">DC03 · meereen (.12)</text>
<text x="650" y="145" class="dg-accent dg-compact">FOREST ROOT</text>
<text x="456" y="163" class="dg-mono dg-compact">DC=essos,DC=local · ESSOS-CA</text>
<line x1="591" y1="176" x2="591" y2="184" class="dg-line" />
<rect x="461" y="184" width="260" height="18" rx="4" class="dg-box" style="fill: #0c0e0e; stroke: rgba(255,255,255,0.2);" />
<text x="591" y="196" text-anchor="middle" class="dg-muted dg-compact">Domain Member · Kerberos / RPC (SMB)</text>
<line x1="591" y1="202" x2="591" y2="212" class="dg-line" marker-end="url(#arch-m1)" />
<rect x="444" y="212" width="294" height="52" rx="6" class="dg-box" />
<text x="456" y="233" class="dg-label">SRV03 · braavos (.23)</text>
<text x="652" y="233" class="dg-muted dg-compact">MEMBER SVR</text>
<text x="456" y="251" class="dg-mono dg-compact">MSSQL 1433 · LAPS · gMSA</text>
<line x1="591" y1="264" x2="591" y2="280" class="dg-line" marker-end="url(#arch-m1)" />
<rect x="444" y="280" width="294" height="56" rx="6" class="dg-box-danger" />
<text x="456" y="301" class="dg-crit dg-compact" font-weight="700">FOREST SECURITY BOUNDARY ENFORCED</text>
<text x="456" y="318" class="dg-muted dg-compact">Foreign Admin SIDs stripped · Isolated partitions</text>
</svg>
<figcaption>Directory partition layout across GOAD: <code>sevenkingdoms.local</code> and <code>north.sevenkingdoms.local</code> share a single <code>CN=Configuration</code> and <code>CN=Schema</code> inside Forest 1, whereas <code>essos.local</code> is a separate forest connected via a cross-forest Trusted Domain Object (TDO) and conditional DNS forwarding.</figcaption>
</figure>

---

## 1. Directory Partitions: Why the Forest Is the Sole Security Boundary

When the first Domain Controller is promoted in an Active Directory forest (`Install-ADDSForest`), Windows creates an Extensible Storage Engine (`ESE`) database file at `C:\Windows\NTDS\ntds.dit`. Within this database, objects are segregated into distinct logical **Naming Contexts (Partitions)** to govern directory replication scope across Domain Controllers.

Querying `CN=Partitions,CN=Configuration,DC=sevenkingdoms,DC=local` on `DC01` (`192.168.56.10`) displays the complete partition registration set for Forest 1:

```bash
$ ldapsearch -x -H ldap://192.168.56.10 -D "samwell.tarly@north.sevenkingdoms.local" -w "Heartsbane" \
    -b "CN=Partitions,CN=Configuration,DC=sevenkingdoms,DC=local" "(objectClass=crossRef)" \
    cn nCName dnsRoot | grep -E "^(cn|nCName|dnsRoot)"
cn: Enterprise Configuration
nCName: CN=Configuration,DC=sevenkingdoms,DC=local
dnsRoot: sevenkingdoms.local
cn: Enterprise Schema
nCName: CN=Schema,CN=Configuration,DC=sevenkingdoms,DC=local
dnsRoot: sevenkingdoms.local
cn: SEVENKINGDOMS
nCName: DC=sevenkingdoms,DC=local
dnsRoot: sevenkingdoms.local
cn: NORTH
nCName: DC=north,DC=sevenkingdoms,DC=local
dnsRoot: north.sevenkingdoms.local
cn: 3d4b07e3-c44f-4f9e-ab6c-19dbc611d4e3
nCName: DC=DomainDnsZones,DC=sevenkingdoms,DC=local
dnsRoot: DomainDnsZones.sevenkingdoms.local
cn: 7a98ffc5-6322-406d-89c3-4f33b87dd679
nCName: DC=ForestDnsZones,DC=sevenkingdoms,DC=local
dnsRoot: ForestDnsZones.sevenkingdoms.local
cn: a7e87a5b-d212-4656-9be1-dc9505595501
nCName: DC=DomainDnsZones,DC=north,DC=sevenkingdoms,DC=local
dnsRoot: DomainDnsZones.north.sevenkingdoms.local
```

### Partition Classes and Replication Scopes

| Partition Type | LDAP Distinguished Name | Replication Scope | Security Impact |
| :--- | :--- | :--- | :--- |
| **Schema NC** | `CN=Schema,CN=Configuration,DC=...` | Entire Forest (All DCs) | Defines object classes and attributes. Writable only on the Schema Master FSMO role. |
| **Configuration NC** | `CN=Configuration,DC=...` | Entire Forest (All DCs) | Stores enterprise topology, sites, subnets, and AD CS PKI containers. All DCs hold writable replicas. |
| **Domain NC** | `DC=domain,DC=local` | Intra-Domain DCs | Contains domain user accounts, groups, computers, and GPOs. Writable only within that domain. |
| **Global Catalog (GC)** | Port `3268/tcp` / `3269/tcp` | Entire Forest (Designated DCs) | Read-only partial attribute set (PAS) of all domain partitions across the forest. |
| **Application NC** | `DC=ForestDnsZones`, `DC=DomainDnsZones` | Forest DCs or Domain DNS servers | Houses Active Directory-Integrated DNS (ADIDNS) zones. |

In corporate architectures, organizations frequently provision child domains (such as `north.sevenkingdoms.local`) to delegate administrative control to subsidiary teams without standing up separate forests. However, because `DC01` (`kingslanding`) and `DC02` (`winterfell`) share the same forest-wide `CN=Configuration` and `CN=Schema` partitions, Microsoft defines the **forest, not the domain, as the true security boundary**. 

Within a forest, parent-child trusts do not enforce SID filtering. Consequently, compromising a child Domain Controller (`DC02`) yields the domain's `krbtgt` hash, allowing the generation of a Kerberos ticket containing the parent forest root's `Enterprise Admins` SID (`S-1-5-21-3291916993-3717649449-3745629854-519`) in the `ExtraSids` (`sIDHistory`) attribute, compromising the entire forest.

---

## 2. Multi-Forest DNS and `_msdcs` Service Resolution

Windows Active Directory depends entirely on DNS for service discovery. Prior to initiating LDAP binds, Kerberos ticket requests, or Group Policy updates, Windows clients issue **RFC 2782 `SRV` queries** to resolve the IP addresses and port numbers of directory services.

Each Domain Controller in GOAD hosts the Windows DNS Server role for its authoritative zone (`.10` for `sevenkingdoms.local`, `.11` for `north.sevenkingdoms.local`, and `.12` for `essos.local`). Querying the core `_msdcs` records demonstrates this locator process:

```bash
$ dig @192.168.56.10 _ldap._tcp.dc._msdcs.sevenkingdoms.local SRV +short
0 100 389 kingslanding.sevenkingdoms.local.

$ dig @192.168.56.10 _kerberos._tcp.dc._msdcs.sevenkingdoms.local SRV +short
0 100 88 kingslanding.sevenkingdoms.local.

$ dig @192.168.56.10 _ldap._tcp.pdc._msdcs.sevenkingdoms.local SRV +short
0 100 389 kingslanding.sevenkingdoms.local.

$ dig @192.168.56.10 _ldap._tcp.gc._msdcs.sevenkingdoms.local SRV +short
0 100 3268 kingslanding.sevenkingdoms.local.
0 100 3268 winterfell.north.sevenkingdoms.local.
```

The Global Catalog query (`_ldap._tcp.gc._msdcs.sevenkingdoms.local`) returns both `kingslanding` (`.10`) and `winterfell` (`.11`) on port `3268`. Because the Global Catalog indexes all objects forest-wide, any client in `sevenkingdoms.local` can query `winterfell` over port 3268 to resolve universal group memberships or cross-domain UPNs.

### Cross-Forest Resolution via Conditional Forwarders

Because `sevenkingdoms.local` and `essos.local` occupy separate forests without a shared Global Catalog, cross-forest resolution requires **DNS Conditional Forwarders** configured on `DC01` and `DC03`:

```powershell
Add-DnsServerConditionalForwarderZone -Name "essos.local" -MasterServers 192.168.56.12
```

When a host in `north.sevenkingdoms.local` queries `braavos.essos.local`, the local DNS server forwards the query directly to `192.168.56.12` (`meereen.essos.local`).

From an auditing perspective, conditional forwarders expose cross-forest trust relationships to unauthenticated DNS recon. Furthermore, because Active Directory-Integrated DNS (`DC=DomainDnsZones` and `DC=ForestDnsZones`) permits `Authenticated Users` to create new records by default, compromised accounts can inject wildcard or target records to poison name resolution when SMB signing is not enforced.

---

## 3. Trust Architecture: Trusted Domain Objects and Kerberos Referrals

While DNS enables cross-forest hostname resolution, cross-domain authentication requires a **Trusted Domain Object (`trustedDomain`)** residing in `CN=System,DC=<domain>,DC=<tld>`.

Querying the `trustedDomain` entries on `DC01` (`sevenkingdoms.local`) and `DC03` (`essos.local`) reveals the routing flags:

```bash
$ ldapsearch -x -H ldap://192.168.56.10 -D "samwell.tarly@north.sevenkingdoms.local" -w "Heartsbane" \
    -b "CN=System,DC=sevenkingdoms,DC=local" "(objectClass=trustedDomain)" \
    cn flatName trustDirection trustType trustAttributes | grep -E "^(cn|flatName|trust)"
cn: north.sevenkingdoms.local
trustDirection: 3
trustType: 2
trustAttributes: 32
flatName: NORTH
cn: essos.local
trustDirection: 3
trustType: 2
trustAttributes: 72
flatName: ESSOS

$ ldapsearch -x -H ldap://192.168.56.12 -D "missandei@essos.local" -w "fr3edom" \
    -b "CN=System,DC=essos,DC=local" "(objectClass=trustedDomain)" \
    cn flatName trustDirection trustType trustAttributes | grep -E "^(cn|flatName|trust)"
cn: sevenkingdoms.local
trustDirection: 3
trustType: 2
trustAttributes: 8
flatName: SEVENKINGDOMS
```

<figure class="diagram">
<svg viewBox="0 0 760 250" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Cross-forest Kerberos referral chain in GOAD: a user in north.sevenkingdoms.local requests access to braavos.essos.local; DC02 winterfell issues an inter-realm TGT to DC01 kingslanding, which issues a cross-forest referral TGT to DC03 meereen, where SID filtering strips foreign privileged SIDs before issuing the service ticket for SRV03 braavos.">
<defs><marker id="arch-m2" viewBox="0 0 8 8" refX="7" refY="4" markerWidth="7" markerHeight="7" orient="auto"><path d="M0,0 L8,4 L0,8 z" class="dg-arrow" /></marker></defs>
<text x="0" y="16" class="dg-muted">CROSS-FOREST KERBEROS REFERRAL CHAIN · NORTH → SEVENKINGDOMS → ESSOS</text>
<rect x="0" y="38" width="165" height="78" rx="8" class="dg-box" />
<text x="14" y="62" class="dg-label">1. DC02 · winterfell</text>
<text x="14" y="82" class="dg-mono dg-compact">NORTH KDC (.11)</text>
<text x="14" y="100" class="dg-muted">Issues TGT → ROOT</text>
<line x1="165" y1="77" x2="195" y2="77" class="dg-line" marker-end="url(#arch-m2)" />
<rect x="198" y="38" width="175" height="78" rx="8" class="dg-box-accent" />
<text x="212" y="62" class="dg-label">2. DC01 · kingslanding</text>
<text x="212" y="82" class="dg-mono dg-compact">ROOT KDC (.10)</text>
<text x="212" y="100" class="dg-accent">No SID Filter (0x20)</text>
<line x1="373" y1="77" x2="403" y2="77" class="dg-line-crit" marker-end="url(#arch-m2)" />
<rect x="406" y="38" width="175" height="78" rx="8" class="dg-box-danger" />
<text x="420" y="62" class="dg-label">3. DC03 · meereen</text>
<text x="420" y="82" class="dg-mono dg-compact">ESSOS KDC (.12)</text>
<text x="420" y="100" class="dg-crit">SID Filter ON (0x08)</text>
<line x1="581" y1="77" x2="611" y2="77" class="dg-line" marker-end="url(#arch-m2)" />
<rect x="614" y="38" width="146" height="78" rx="8" class="dg-box" />
<text x="628" y="62" class="dg-label">4. SRV03 · braavos</text>
<text x="628" y="82" class="dg-mono dg-compact">CIFS/braavos (.23)</text>
<text x="628" y="100" class="dg-muted">Accepts Service TGS</text>
<rect x="0" y="144" width="373" height="84" rx="8" class="dg-box-accent" />
<text x="14" y="168" class="dg-label">Intra-Forest Hop (NORTH ↔ SEVENKINGDOMS)</text>
<text x="14" y="188" class="dg-muted">trustAttributes = 32 (WITHIN_FOREST)</text>
<text x="14" y="208" class="dg-accent">ExtraSids (S-1-5-21-root-519) preserved across hop</text>
<rect x="406" y="144" width="354" height="84" rx="8" class="dg-box-danger" />
<text x="420" y="168" class="dg-label">Cross-Forest Hop (SEVENKINGDOMS ↔ ESSOS)</text>
<text x="420" y="188" class="dg-muted">trustAttributes = 8 / 72 (FOREST_TRANSITIVE)</text>
<text x="420" y="208" class="dg-crit">Foreign Enterprise Admin SIDs stripped by SID Filtering</text>
</svg>
<figcaption>How Kerberos referrals cross GOAD's two trusts: intra-forest referrals (<code>WITHIN_FOREST = 32</code>) keep <code>ExtraSids</code> intact between <code>NORTH</code> and <code>SEVENKINGDOMS</code>, while the cross-forest hop into <code>ESSOS</code> (<code>FOREST_TRANSITIVE = 8</code>) enforces SID filtering.</figcaption>
</figure>

### `trustAttributes` Bitmask Reference `[MS-ADTS §6.1.6.7.9]`

| Bit Value | Hex | Flag Name | Description |
| :--- | :--- | :--- | :--- |
| `1` | `0x0001` | `TRUST_ATTRIBUTE_NON_TRANSITIVE` | Trust does not extend transitively to child or partner domains. |
| `2` | `0x0002` | `TRUST_ATTRIBUTE_UPLEVEL_ONLY` | Restricts trust exclusively to Windows 2000 and higher operating systems. |
| `4` | `0x0004` | `TRUST_ATTRIBUTE_FILTER_SIDS` | Quarantined domain: SID filtering is explicitly enforced on external trusts. |
| `8` | `0x0008` | `TRUST_ATTRIBUTE_FOREST_TRANSITIVE` | Enables transitive cross-forest authentication between two forest roots. |
| `16` | `0x0010` | `TRUST_ATTRIBUTE_CROSS_ORGANIZATION` | Selective authentication enabled: caller requires `Allowed to Authenticate` permissions on target hosts. |
| `32` | `0x0020` | `TRUST_ATTRIBUTE_WITHIN_FOREST` | Trust exists between parent and child within the same forest. **SID filtering disabled.** |
| `64` | `0x0040` | `TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL` | Treats forest trust with external boundary enforcement semantics. |
| `512` | `0x0200` | `TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION` | Prevents TGT delegation across cross-organization boundaries. |

### SID Filtering Protocol Mechanics

When a referral TGT traverses an inter-forest trust (`0x08` or `0x04`), the receiving KDC evaluates the Privilege Attribute Certificate (`PAC`) according to `[MS-PAC] §4.1.2.2`:

1. The KDC inspects the `ExtraSids` field within the user's PAC.
2. If `TRUST_ATTRIBUTE_WITHIN_FOREST` (`32`) is set, no filtering occurs. Foreign administrative SIDs (such as `Enterprise Admins`) are retained in the PAC, allowing direct domain-to-forest escalation.
3. If `TRUST_ATTRIBUTE_FOREST_TRANSITIVE` (`8`) is set, the receiving KDC invokes `FilterSids()`. All SIDs with well-known administrative RIDs (`RID < 1000`, including `500` Administrator, `512` Domain Admins, `519` Enterprise Admins) and any SIDs not matching the trusted domain's base SID are permanently stripped from the authorization context.

---

## 4. Member Server Architecture and Service Identities

Workloads in GOAD execute on two member servers: `SRV02` (`castelblack` at `.22` in `north.sevenkingdoms.local`) and `SRV03` (`braavos` at `.23` in `essos.local`). Auditing service accounts via LDAP reveals their operational parameters:

```bash
$ ldapsearch -x -H ldap://192.168.56.11 -D "samwell.tarly@north.sevenkingdoms.local" -w "Heartsbane" \
    -b "DC=north,DC=sevenkingdoms,DC=local" "(|(sAMAccountName=jon.snow)(sAMAccountName=sql_svc)(sAMAccountName=CASTELBLACK$))" \
    sAMAccountName servicePrincipalName msDS-AllowedToDelegateTo userAccountControl | grep -E "^(sAMAccountName|servicePrincipalName|msDS-Allowed|userAccountControl)"
sAMAccountName: CASTELBLACK$
userAccountControl: 4096
servicePrincipalName: HOST/castelblack.north.sevenkingdoms.local
msDS-AllowedToDelegateTo: HTTP/winterfell.north.sevenkingdoms.local
msDS-AllowedToDelegateTo: HTTP/winterfell
sAMAccountName: jon.snow
userAccountControl: 16842752
servicePrincipalName: HTTP/thewall.north.sevenkingdoms.local
servicePrincipalName: CIFS/thewall.north.sevenkingdoms.local
msDS-AllowedToDelegateTo: CIFS/winterfell.north.sevenkingdoms.local
msDS-AllowedToDelegateTo: CIFS/winterfell
sAMAccountName: sql_svc
userAccountControl: 66048
servicePrincipalName: MSSQLSvc/castelblack.north.sevenkingdoms.local:1433
servicePrincipalName: MSSQLSvc/castelblack.north.sevenkingdoms.local
```

### Identity Models on Member Servers

1. **Service Principal Names (SPNs):** When a client accesses `castelblack.north.sevenkingdoms.local:1433`, it requests a Kerberos service ticket (`TGS-REQ`) for `MSSQLSvc/castelblack.north.sevenkingdoms.local:1433`. The KDC locates the account holding that SPN (`sql_svc`) and encrypts the ticket using that account's NTLM/AES secret key. Standard domain users assigned SPNs (`jon.snow`, `sql_svc`) are exposed to offline Kerberoasting attacks.
2. **Constrained Delegation (`msDS-AllowedToDelegateTo`):** Account `jon.snow` carries `userAccountControl` value `16842752` (`0x1010000 = DONT_EXPIRE_PASSWORD | TRUSTED_TO_AUTH_FOR_DELEGATION`). This grants protocol transition (`S4U2Self` and `S4U2Proxy`), permitting `jon.snow` to request tickets for `CIFS/winterfell.north.sevenkingdoms.local` impersonating arbitrary users, including `Administrator`.
3. **Managed Service Accounts (gMSA) and LAPS:** In `essos.local`, modern controls mitigate credential theft: a **group Managed Service Account (`gmsaDragon$`)** features a 240-byte password automatically rotated by the KDC, accessible only by authorized hosts via `msDS-GroupMSAMembership`. Concurrently, **LAPS** stores `SRV03`'s local administrator password in `ms-Mcs-AdmPwd`. These controls eliminate offline hash cracking but transfer attack surfaces to LDAP ACLs: any principal granted `ReadLAPSPassword` (`jorah.mormont`) or `ReadGMSAPassword` can retrieve these credentials in cleartext over LDAP.

---

## 5. Enterprise PKI: Active Directory Certificate Services (AD CS)

AD CS configuration data is stored within `CN=Public Key Services,CN=Services,CN=Configuration,DC=<forest>,DC=<tld>`. GOAD features two Enterprise Certificate Authorities located on different architectural tiers:

```bash
$ ldapsearch -x -H ldap://192.168.56.10 -D "samwell.tarly@north.sevenkingdoms.local" -w "Heartsbane" \
    -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=sevenkingdoms,DC=local" \
    "(objectClass=pKIEnrollmentService)" cn dNSHostName | grep -E "^(cn|dNSHostName)"
cn: SEVENKINGDOMS-CA
dNSHostName: kingslanding.sevenkingdoms.local

$ ldapsearch -x -H ldap://192.168.56.12 -D "missandei@essos.local" -w "fr3edom" \
    -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=essos,DC=local" \
    "(objectClass=pKIEnrollmentService)" cn dNSHostName certificateTemplates | grep -E "^(cn|dNSHostName|certificateTemplates: ESC)"
cn: ESSOS-CA
dNSHostName: braavos.essos.local
certificateTemplates: ESC13
certificateTemplates: ESC9
certificateTemplates: ESC4
certificateTemplates: ESC3-CRA
certificateTemplates: ESC3
certificateTemplates: ESC2
certificateTemplates: ESC1
```

### Enterprise CA Tiering Implications

When a client enrolls in a certificate template (`pKICertificateTemplate`), the CA verifies the caller's SID against the template's DACL (`Enroll` / `Autoenroll`). If authorized, the CA issues a signed X.509 certificate containing client authentication EKUs (`1.3.6.1.5.5.7.3.2`) and an identity mapping field (`Subject Alternative Name` or `szOID_NTDS_CA_SECURITY_EXT`). The client can present this certificate over PKINIT (`AS-REQ` pre-auth type `16`) to obtain a Kerberos TGT.

- In `sevenkingdoms.local`, `SEVENKINGDOMS-CA` resides directly on Forest Root DC `DC01` (`kingslanding`, `.10`), exposing HTTP Web Enrollment (`/certsrv/`) on port 80.
- In `essos.local`, `ESSOS-CA` is hosted on member server `braavos.essos.local` (`.23`), while `DC03` (`meereen`, `.12`) serves as the Domain Controller.

Because an Enterprise CA is published to the forest's `NTAuthCertificates` container, it is trusted to issue identity certificates for **any domain account across the entire forest**. Consequently, an Enterprise CA is inherently a **Tier-0 asset**, even when hosted on a Tier-1 member server like `BRAAVOS`. Compromising `BRAAVOS` grants complete forest root takeover.

---

## 6. Security Descriptors and Directed Graph Attack Paths

Active Directory stores security descriptors in the `nTSecurityDescriptor` binary attribute on every LDAP object. It contains an Owner SID, Group SID, Discretionary Access Control List (DACL), and System Access Control List (SACL).

By default, the schema (`defaultSecurityDescriptor`) grants `Authenticated Users` (`S-1-5-11`) the `READ_CONTROL` (`0x00020000`) right across Domain and Configuration partitions. This read access is mandatory for Windows operating system functionality: clients must inspect DACLs to evaluate Group Policy application, verify certificate template enrollment rights, and resolve nested group memberships.

As a consequence of open `READ_CONTROL`, any authenticated domain identity can ingest and map the complete authorization graph of the entire forest. Custom ACE additions (such as `GenericAll`, `WriteDacl`, or extended rights like `User-Force-Change-Password`) form unbroken directed attack paths leading directly to Tier-0 dominance.

---

## Telemetry and Detection Engineering

### Cross-Forest Authentication Telemetry

| Event ID | Log Provider | Event Description | Detection Criteria |
| :--- | :--- | :--- | :--- |
| `4768` | Security | Kerberos TGT Request | Pre-Authentication Type `16` (PKINIT) issued to non-standard user accounts or abnormal ticket options. |
| `4769` | Security | Kerberos Service Ticket Request | Inter-realm referral requests (`Service Name: krbtgt/<TRUSTED_REALM>`) with `Ticket Options: 0x40810010`. |
| `4624` | Security | Successful Logon | Logon Type `3` (Network) originating from non-domain member IP ranges or unexpected cross-forest accounts. |
| `5136` | Security | Directory Service Object Modified | Modifications to `trustedDomain` objects (`trustAttributes`) or creation of rogue `dnsNode` records in ADIDNS zones. |

```kql
// KQL: Detect Anomalous Cross-Realm Kerberos Ticket Requests
SecurityEvent
| where EventID == 4769
| where ServiceName startswith "krbtgt/" and ServiceName !endswith TargetDomainName
| project TimeGenerated, Computer, TargetUserName, ServiceName, TicketOptions, TicketEncryptionType, IpAddress
```

---

## Architectural Summary

| Architectural Layer | Host / LDAP Location | Operational Function | Security Boundary Rule |
| :--- | :--- | :--- | :--- |
| **Shared Forest Partitions** | `CN=Partitions,CN=Configuration` on `DC01` & `DC02` | Forest-wide Schema, Sites, PKI, and Global Catalog (`3268/tcp`). | **The Forest is the sole security boundary.** Child domain compromise escalates to forest root via `ExtraSids`. |
| **DNS SRV & Conditional Forwarders** | Port 53 on `.10`, `.11`, `.12` + ADIDNS | Service discovery (LDAP, KDC, GC) and cross-forest name resolution. | Conditional forwarders expose trust topology; audit ADIDNS write ACLs for unauthenticated DNS poisoning. |
| **Trusted Domain Objects (TDO)** | `CN=System,DC=...` on `.10` and `.12` | Manages referral tickets (`WITHIN_FOREST: 32` vs `FOREST_TRANSITIVE: 8/72`). | Cross-forest trusts enforce SID Filtering against foreign `ExtraSids`, but expose all `Authenticated Users` resources. |
| **Service Identities & Delegation** | `CASTELBLACK` (`.22`), `BRAAVOS` (`.23`), `jon.snow` | Kerberos service authentication, S4U impersonation, and gMSA password rotation. | Never configure delegation to Domain Controllers; replace user SPNs with gMSAs to prevent Kerberoasting. |
| **Enterprise PKI (AD CS)** | `SEVENKINGDOMS-CA` (`.10`) & `ESSOS-CA` (`.23`) | Forest-wide certificate issuance and PKINIT Kerberos authentication. | **Every Enterprise CA is a Tier-0 asset.** Member servers hosting CAs must be hardened as Domain Controllers. |
| **Security Descriptors (`nTSecurityDescriptor`)** | All LDAP directory objects | Fine-grained discretionary access control (DACLs/ACEs). | Read access is open to `Authenticated Users` by design; defense requires auditing non-default delegation paths. |

---

## Evidence and limits

The topology, naming contexts, trust objects, service placement, and ACL examples are tied to the GOAD instance used throughout this series. LDAP and Kerberos outputs in the article were checked against that running lab; protocol behavior and field meanings are cross-referenced to Microsoft Open Specifications. This is why the post separates what the lab exposed from what the protocols guarantee.

GOAD is intentionally compact and vulnerable. Its two forests and three domains are useful for observing boundaries, but they are not a reference enterprise design. The diagrams omit replication sites, hybrid identity, endpoint management, and many production PKI controls. Treat the addresses, trust flags, and service identities as this lab's inventory, not defaults for every Active Directory deployment.

## References

- **Orange Cyberdefense, GOAD Architecture & Inventory:** [orange-cyberdefense.github.io/GOAD](https://orange-cyberdefense.github.io/GOAD/)
- **Microsoft Open Specifications, `[MS-ADTS]` Active Directory Technical Specification:** [learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a)
- **Microsoft Open Specifications, `[MS-PAC]` Privilege Attribute Certificate Data Structure:** [learn.microsoft.com](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac)
- **Microsoft, Best Practices for Securing Active Directory:** [learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory)
- **RFC 4120, The Kerberos Network Authentication Service (V5):** [datatracker.ietf.org/doc/html/rfc4120](https://datatracker.ietf.org/doc/html/rfc4120)
- **RFC 2782, A DNS RR for Specifying the Location of Services (DNS SRV):** [datatracker.ietf.org/doc/html/rfc2782](https://datatracker.ietf.org/doc/html/rfc2782)