Introduction

Active Directory (AD) is the crown jewel of the enterprise environment. Because it manages identities, credentials, and access permissions across the entire network, it is the primary target for threat actors looking to escalate privileges. Standard, out-of-the-box vulnerability scans often miss the subtle misconfigurations that allow tools like BloodHound or Mimikatz to map out attack paths.

To proactively defend the perimeter, security teams must move past default scanning profiles. This playbook details how to safely fine-tune Tenable Nessus scans against domain controllers, configure policy compliance checks, and prioritize vulnerabilities before they are chained into a full domain compromise.

The Risks of Default Scanning

Running an aggressive, unconfigured vulnerability scan against a live Domain Controller can cause high CPU utilization, potentially disrupting authentication services for the entire enterprise. Conversely, running a basic network scan without proper credentials only scratches the surface—it won't reveal critical architectural flaws like unpatched Zerologon vulnerabilities, weak Kerberos pre-authentication, or dangerous Access Control Lists (ACLs).

To balance safety with deep visibility, you need a dedicated, authenticated scanning policy built specifically for identity infrastructure.

Step 1: Configuring Safe, Credentials-Based Access

To get an accurate view of your AD security posture, Nessus requires authenticated access. However, you should never run scans using a highly privileged Domain Admin account. Instead, follow the principle of least privilege:

1. Create a dedicated service account assigned to the Domain Users group.
2. Delegate specific read permissions to this account across the Active Directory tree.
3. In Nessus, navigate to Credentials > Windows and input the service account details, enabling SMB Password Authentication.

Step 2: Fine-Tuning the Scanning Policy

When configuring your policy template inside Nessus, make the following manual adjustments to optimize for Active Directory:

• Disable Safe Checks (Caution): Keep "Safe Checks" enabled to prevent the scanner from attempting disruptive Denial of Service (DoS) exploits against your authentication endpoints.
• Enable Audit Policies: Under the Compliance tab, select the CIS Microsoft Windows Server Benchmark. This instructs Nessus to check your Group Policy Objects (GPOs) for misconfigurations, such as disabled SMB signing or exposed plaintext passwords in SYSVOL shares.
• Target Specific Plugins: Filter your scan policy to prioritize critical remote code execution and privilege escalation plugins, specifically targeting older but heavily exploited flaws like MS17-010 (EternalBlue) and newer AD Certificate Services (ADCS) vulnerabilities.

Analyzing the High-Priority Findings

Once your scan finishes, filter the results by Critical and High severity. Look for the following high-fidelity indicators:

Plaintext

[Plugin ID: 140651] Microsoft Windows Zerologon Elevation of Privilege (CVE-2020-1472)
[Plugin ID: 156119] Microsoft Windows Active Directory Kerberos Privilege Escalation (CVE-2021-42287)
[Plugin ID: 59196]  Microsoft Windows SMB Signing Not Required

If Nessus flags a domain controller with missing patches for Kerberos exploits or reports that SMB signing is optional, an attacker inside the network can easily launch a Man-in-the-Middle (MitM) attack to relay credentials and take over the domain structure in minutes.