The decade-old password behind Domain Admin

The challenge

A financial institution wanted to test its resilience to phishing, and to an attacker who has obtained a standard domain user on a virtual-desktop host.

How it unfolded

1. Ran two phishing campaigns — one blocked at the gateway, one delivered but ignored by well-trained staff.
2. Switched to assumed breach: a standard domain user on a virtual-desktop host.
3. Enumerated the domain with living-off-the-land native tooling only.
4. Identified a Domain Admin service account with a password unchanged for over a decade, carrying Kerberos SPNs.
5. Kerberoasted it for offline cracking; found dozens of AS-REP-roastable accounts and a stale never-expiring admin.
6. Segmentation between the virtual desktops and on-prem directory meaningfully limited further reach.

Impact

A single ordinary account could put a path to full-domain compromise within reach — while the bank's email controls, staff awareness and network segmentation all held as defence-in-depth.

Outcome

A clear privileged-account-hygiene and Kerberos-hardening roadmap, plus independent validation that the bank's phishing, awareness and segmentation controls were genuinely working.