The blind spot of SME security
When people think of cybersecurity, they think of firewalls, antivirus and backups. Active Directory (AD) often stays in the shadows: it works, users log in, so there seems to be nothing to check. That is precisely the reasoning that makes it such an attractive target.
Industry figures leave no ambiguity: Active Directory is involved in around 9 out of 10 ransomware attacks, and 87% of those attacks cause significant disruption (data loss, business interruption). Yet only 27% of organisations have a recovery solution dedicated to their identity infrastructure, which reveals a real gap between actual exposure and preparedness.
AD centralises authentication for the whole business: accounts, passwords, access rights, delegations between servers. A single configuration risk that goes unnoticed can hand an attacker the keys to the entire information system, not just one isolated workstation.
Unlike a firewall or an antivirus, AD does not report its own weaknesses: an account with excessive rights, a delegation forgotten five years ago or a misconfigured Group Policy Object (GPO) keep working silently, without ever raising an alert. That is the whole point of a dedicated audit: it reveals what cannot be seen day to day.
How attackers actually get in
Understanding AD as a target means understanding how attackers reach it in the first place. In recent ransomware attacks, initial entry points break down as follows:
Exploitation of unpatched vulnerabilities: 32% of attacks
Compromised credentials (theft, reuse, weak passwords): 23%
Malicious email (attachment, link): 19%
Phishing: 18%
This breakdown explains why an AD audit never looks at the directory alone: the way in is often a poorly patched workstation or an account with a weak password, and the severity comes from what the attacker can then reach once inside, through AD.
The most frequent configuration risks
Poorly controlled privileged accounts
Over time, the number of administrator accounts tends to grow without ever shrinking: a one-off project, a contractor passing through, a test left in place. Every forgotten privileged account is a potential way in, all the more dangerous because it is rarely monitored.
Excessive delegations
AD makes it possible to delegate targeted administrative rights (for example, resetting the passwords of one specific group). Misconfigured, these delegations can unintentionally grant far more power than intended, sometimes up to full control of the domain, without anyone noticing.
Weak or old passwords
An overly permissive password policy, service accounts whose password has never changed since they were created, disabled accounts that were never cleaned up: these classics turn up in almost every audit, whatever the size of the company.
Misconfigured Group Policy Objects
GPOs drive much of the security of workstations and servers. A GPO inherited from an old configuration and never reviewed since can quietly disable a protection everyone thought was active.
Obsolete accounts
Former employees, former contractors, test accounts: these inactive but still valid accounts remain an easy target, because they are rarely monitored actively.
What an audit actually reveals
A structured AD audit does not simply list isolated sensitive points: it produces an overall risk score, a map of vulnerabilities and a prioritised action plan, from the most critical fixes to secondary adjustments. The aim is not to fix everything at once, but to know precisely where to focus effort first.
An important point: this analysis is read-only. It performs no action on your directory and therefore poses no risk to your production environment, unlike a penetration test, which actively tries to exploit the weaknesses it finds.
Tools that put numbers on the risk
A serious audit does not rely on a visual inspection. It uses specialised tools that go through the directory with a fine-tooth comb and assign an objective risk score, automatically spotting dangerous configurations: too many privileged accounts, risky delegations, passwords that never expire, questionable trust relationships. Recognised tools such as PingCastle have become a reference for this kind of assessment, including in audits carried out for small and medium-sized businesses.
These tools have a twofold merit. First, they make the diagnosis objective: instead of a subjective opinion, they deliver a numerical score and reproducible findings that can be compared from one audit to the next to measure progress. Second, they make it fast, which matters for an SME: where a fully manual review would take weeks, a tool-assisted audit delivers the bulk of its findings in a few days, report and action plan included.
A typical post-audit action plan
For a standard SME (one AD domain, a few dozen to a few hundred accounts), an action plan resulting from an audit usually follows this order of priority:
Urgent (within 7 days): orphaned or unused administrator accounts, service account passwords never changed, disabled accounts still present in privileged groups.
Short term (within 30 days): excessive delegations to correct, obsolete security GPOs to review, password policy to harden.
Medium term (within 90 days): introduce tiering for privileged accounts (see our guide to Active Directory tiering), review delegated administration groups.
Ongoing: periodic review of obsolete accounts, logging and monitoring of privileged actions.
Why SMEs are particularly exposed
Large companies generally have a security team monitoring AD continuously. SMEs often rely on a generalist provider or a multi-skilled system administrator for whom AD is just one task among many. It is not a question of skill but of available time: nobody rereads the history of delegations or the list of privileged accounts every month when they also have to manage workstations, backups and everyday requests.
That gap is what makes a one-off audit particularly relevant for an SME: at a given moment, it provides the structured view that an internal team does not have time to maintain continuously.
After the audit, remediation at your own pace
Once you have the report, correcting the points identified (remediation) happens at your own pace, according to their real criticality and your operational constraints. Some actions are trivial (disabling an obsolete account), others call for more care (reviewing a delegation used by a business application), which is why it makes sense to scope and price this stage separately, once the diagnosis has been made rather than blindly.
Seeing what goes unnoticed day to day
Active Directory has the dangerous quality of working just as well when it is healthy as when it is vulnerable. Nothing in its daily use betrays a forgotten delegation or one privileged account too many: users log in, applications run, and the risk stays invisible until the day someone tries to exploit it. That is exactly what a dedicated audit reveals: not visible failures, but silent weaknesses that nobody has time to track down internally, and that make all the difference on the day of an attack.
We offer a read-only Active Directory audit, carried out remotely, with a report written in plain language and a prioritised action plan, without any action on your production environment. See also our SME security audit checklist and our guide to Active Directory tiering. Contact us to discuss it.
Sources: Petri IT Knowledgebase, Active Directory Ransomware Report · SOCRadar, Top Ransomware Statistics 2025