I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year.
This quarter, we've received buy-in from all org members except the Active Directory teams. They don't want us executing any AD-related attacks past user/passwd stuff. How could we safeguard the Active Directory environment from our engagement?
I've considered blocking ports 445 and 139 for all scanning/exploitation activity, but I don't really know if that'll even help, plus doing that reduces so much of our attack surface.
Please don't try explaining that this is a bad idea. I know. It's ridiculous. An attacker will never act in a network without attempting to hack AD. I've tried explaining this. Boss disagrees because if we attack the AD, we could knock it over. But again, the same point applies. No attacker will do this when they hack us, but whatever. I just need solutions.