Active Directory Security Assessment: Password Spraying, Privilege Escalation, and Kerberoasting Active Directory (AD) environments remain a primary target in enterprise security assessments due to their central role in authentication, authorization, and resource management. During a recent internal penetration test of the `hive.local` domain, several critical weaknesses were identified that demonstrate common attack paths from credential abuse to privilege escalation and service account exploitation. The assessment began with password spraying via SMB using a known weak password (`P@ssw0rd!`) across a list of domain users. Unlike brute-force attacks, password spraying targets many accounts with a single password to avoid triggering account lockouts. This approach successfully identified multiple valid credentials, with several users able to authenticate to the domain controller. Notably, three accounts including `alice.wonderland`, `bruce.wayne`, and `diana.prince` were found to possess administrative privileges on the Domain Controller. The presence of these privileges underscores the significant risk posed by shared or weak passwords and demonstrates how administrative access can be obtained without exploiting any software vulnerabilities. Following successful credential discovery, Kerberoasting attacks were conducted against service accounts with Service Principal Names (SPNs). Accounts such as `http_svc` and `mssql_svc` yielded Kerberos Ticket Granting Service (TGS) hashes retrievable via LDAP queries. These hashes, once obtained, can be cracked offline, potentially exposing high-privilege credentials for critical services like web servers or SQL databases. Kerberoasting highlights a systemic risk: even service accounts intended for automation can become a vector for privilege escalation if their passwords are weak or mismanaged. This assessment demonstrates a classic AD attack chain: starting from credential discovery, moving through password spraying and escalating privileges via administrative group membership, before targeting service accounts for Kerberoasting. The test illustrates that attackers often rely on weak credentials and improper privilege management rather than exploiting software vulnerabilities to gain significant domain control. Recommendations: arising from this assessment focus on mitigating the most common attack vectors identified. Organizations should enforce strong, unique passwords for all user and service accounts, implement privileged access management to restrict administrative rights, and apply the principle of least privilege to reduce the number of users with elevated access. Additionally, monitoring for abnormal Kerberos ticket requests and reviewing administrative group memberships regularly can help detect and prevent unauthorized privilege escalation attempts. This assessment reinforces that credential hygiene and privilege management remain the most critical elements of AD security. Even in well-patched environments, weak passwords and poorly controlled administrative access can provide attackers with a pathway to full domain compromise. Effective AD security requires not only technical controls but also rigorous operational policies governing account and privilege management.