A city engagement asks how Active Directory enumeration differs when the tester has a valid domain user versus working from a non-domain foothold. What is the key visibility contrast?
Select an answer to reveal the explanation.
Short Explanation
Walking into City Hall with a badge opens doors that the sidewalk view never shows. A domain user session usually unlocks a lot more LDAP and AD detail than poking from outside without those credentials. Same directory, very different visibility.
Full Explanation
Domain-authenticated enumeration typically reveals far more directory information than anonymous or external views. With a valid domain user, a municipal tester can often read attributes, memberships, and objects that anonymous binds cannot—changing what AD attack-path mapping is possible. The key visibility contrast is authenticated domain context versus non-domain/anonymous footholds.
Non-domain footholds do not always see more LDAP data than authenticated users; usually the opposite. Domain authentication frequently changes readable attributes versus anonymous. Anonymous views do not equal Domain Admin visibility.
Exam caveat: scope and account provisioning matter—what you can enumerate depends on the identity you hold. CPTS AD methodology should state the authentication context when describing enumeration results for civic directories.
Operational check: compare anonymous versus domain-user LDAP visibility in the engagement notes, use the least privilege necessary for objectives, and report which civic findings required authenticated enumeration. State the authentication context beside every enumeration claim in the city report so readers know what a standard user could see versus anonymous views.