ad-environment-constraints

# AD Environment Constraints Code and commands that work in a lab break in a hardened domain, and the failure almost never says what it is. A Kerberos SPN mismatch surfaces as `invalidCredentials`. NTLM being disabled surfaces as a logon failure. AES-only KDCs reject your RC4 request with an etype error you have to know to read. This skill is the checklist of those constraints and how to survive each one with standard tooling. **Detect the posture before you authenticate.** Every constraint below is detectable up front: probe whether NTLM answers, whether the KDC accepts RC4, whether LDAP signing is required, whether LDAPS is listening. Fingerprint first, then choose your auth path to match. Fixing an auth path reactively after each failure is slower and noisier than reading the environment once and picking the right transport from the start. --- ## 1. Authentication protocol: NTLM may be disabled NTLM can be turned off org-wide or on specific DCs by GPO. Any auth path that assumes NTLM must fall back to Kerberos. - impacket: add `-k` (use Kerberos) and `-no-pass` when you have a ccache/TGT. - netexec: `-k` / `--kerberos`. - certipy: `-k` / add `--dc-host <fqdn>` so it targets the KDC by name. ```bash # NTLM path nxc smb dc01.corp.local -u user -p pass # Kerberos path (NTLM disabled): request a TGT, export ccache, reuse it getTGT.py corp.local/user:pass -dc-ip <dc_ip> export KRB5CCNAME=user.ccache nxc smb dc01.corp.local -u user -k --use-kcache ``` **Reading the signa...