Individual skill
ad-environment-constraints
Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.
skills/ad-environment-constraints/SKILL.md
Source commit 73efec51207f6f740cb398e1c490e5edd60c1113
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 216
- Repository last updated
- Aug 24, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- active-directory Repository topic
- active-directory-security Repository topic
- adcs Repository topic
- bloodhound Repository topic
- claude Repository topic
- claude-code Repository topic
- claude-code-plugin Repository topic
- claude-skills Repository topic
- dcsync Repository topic
- kerberoasting Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# AD Environment Constraints
Code and commands that work in a lab break in a hardened domain, and the failure almost
never says what it is. A Kerberos SPN mismatch surfaces as `invalidCredentials`. NTLM
being disabled surfaces as a logon failure. AES-only KDCs reject your RC4 request with an
etype error you have to know to read. This skill is the checklist of those constraints and
how to survive each one with standard tooling.
**Detect the posture before you authenticate.** Every constraint below is detectable up
front: probe whether NTLM answers, whether the KDC accepts RC4, whether LDAP signing is
required, whether LDAPS is listening. Fingerprint first, then choose your auth path to
match. Fixing an auth path reactively after each failure is slower and noisier than
reading the environment once and picking the right transport from the start.
