11Active Directory: Finding the Path to Domain Admin
Enumerate the domain, kerberoast a weak service account, and map the group membership that leads to DA.
0 / 0
root@techbiz-lab:~#
Simulated environment — no real systems are contacted. Only ever test systems you own or are authorised in writing to test.