You are here: you have domain credentials or a domain shell and BloodHound data, but no obvious path to Domain Admin.

The path is almost always an object-control edge, a Kerberos primitive, or certificate services. Re-collect the graph after every new own and mark owned — stale data hides the path.

▶️ Next moves (in order)

  1. BloodHound from owned. Mark every owned principal, run “Shortest Paths to Domain Admins from Owned Principals” and review outbound object control. → NetExec_BloodHound
  2. ACL / object-control edges. GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, AddMember. → AD_ACL_Abuse · Master_AD_ACLs
  3. Kerberos primitives. Kerberoast SPN accounts; AS-REP roast; targeted Kerberoast via write access; double-hop when commands fail over WinRM. → AD_Kerberoasting · AD_Misc_Misconfigs · AD_Kerberos_Double_Hop
  4. AD CS. Run certipy find -vulnerable; ESC1–ESC8 are frequent shortcuts straight to DA. → Pass_the_Certificate
  5. Delegation / RBCD. Unconstrained, constrained, and resource-based delegation abuse. RBCD wants MachineAccountQuota > 0 to spawn a machine — but if MAQ is 0, you can still abuse delegation when you hold SeEnableDelegationPrivilege + write control over an existing computer object (reset its password, set TRUSTED_TO_AUTH_FOR_DELEGATION + msDS-AllowedToDelegateTo, S4U to a DC service → DCSync). → AD_Privileged_Access · AD_Kerberos_Double_Hop
  6. Credentials in the environment. Descriptions, GPP cpassword in SYSVOL, logon scripts, shares. → AD_Misc_Misconfigs · Credential_Hunting_Network_Shares
  7. Trusts. Child→parent SID history, cross-forest abuse. → AD_Domain_Trusts
  8. Bleeding-edge CVEs when configuration permits. noPac, PetitPotam, PrintNightmare. → AD_Bleeding_Edge

⚠️ Common stalls

  • BloodHound data collected once, never refreshed after new owns.
  • Forgot to mark owned, so the shortest-path query was blind.
  • Never ran certipy find — AD CS is the intended path on many domains.
  • Didn’t check MachineAccountQuota (gates RBCD and ESC1-via-computer).
  • Saw MachineAccountQuota: 0 and wrote off delegation — but SeEnableDelegationPrivilege + write over an existing computer object still gets there.
  • Checked whoami /priv for SeImpersonate/SeDebug but missed SeEnableDelegationPrivilege — it’s a direct route to domain compromise.
  • Fixated on one edge instead of enumerating all outbound control.

⏱️ Stop condition

You’ve re-collected BloodHound with all owned marked, walked ACL edges, Kerberos, AD CS (certipy find), environment creds, trusts, and MachineAccountQuota. If no path appears, the missing input is data, not technique — stop re-querying the same stale graph. Go compromise a new identity or host that re-opens the graph, then re-collect. If the graph is genuinely complete and pathless, the intended edge is usually a host-local secret that feeds back in — pivot to Have_Shell / Local_Admin_To_DA on an owned box rather than re-reading the same edges.

🔀 Route on