The OSCP+ Active Directory Set: How to Approach the Assumed-Breach Chain

The short answer

The Active Directory set is three linked machines and the biggest single block of points on the OSCP+^™ (OSCP Plus) exam. You don't start from nothing. OffSec hands you a domain username and password at the start, simulating an attacker who has already breached a user account. That's what "assumed breach" means on the OSCP^®. The OSCP AD methodology in this guide starts from that login. It's an Active Directory methodology built as a loop: enumerate as the user you have, use whatever that access opens, and enumerate again with every new credential until you control the domain.

How the points work. The three machines are worth 10, 10 and 20 raw points, 40 of the exam's 100, and the domain controller at the end carries the most. If your exam starts before December 1, 2026 at 08:00 GMT, those points count toward the 70 you need to pass. From then on, OffSec converts your raw points into a scaled score from 100 to 500, and 400 passes. The raw values stay the same, but there's no fixed points target to aim for anymore. We cover that change in OSCP+ scaled scoring explained.

The machines depend on each other, so what you find on one is often the key to the next.

Most people who fail the AD set know the big attacks. Kerberoasting, pass-the-hash and BloodHound are in every course. They fail on the things they assumed wouldn't come up: a pivot they never practiced, a relay they skipped, or credentials sitting somewhere they didn't think to look.

We're Hacker Blueprint. Our instructor holds the OSCP, and our free AD practice chains have been shared widely on r/oscp. This guide is the methodology we teach the 600+ students in our academy.

Watch the methodology in action. We run the methodology below on a full chain in Hacking Active Directory Chains Methodology (Full Guide!), the walkthrough for our free AD Chain_03. For a second take, My Pentesting Methodology for Any Exam (How I Hack Active Directory) works through the free Chain_01. Our free 2-hour OSCP course also walks through a full domain compromise.

How the OSCP+ AD set works

The loop is the part people forget. Each machine usually gives you a new credential or a view of a new network, and the next step only appears once you go back and enumerate with it. OffSec's own AD prep guide makes the same point: when you gain access as a new domain user, enumerate the domain again as that user. It calls this step often overlooked.

Each machine is credited on its own, so the first client counts even if you never reach the domain controller. A few exam rules shape how you work the set:

• Proof. Every machine has at least one proof file. Show its contents with type or cat from an interactive shell, with the target's IP address (ipconfig, ifconfig or ip addr) in the same screenshot, and submit it in the control panel. Skip either step and that machine scores zero.
• Metasploit. You can use it on one target of your choice, and never for pivoting. msfvenom and multi/handler are fine everywhere.
• Responder. Allowed, but poisoning and spoofing are banned.
• Pivoting. OffSec says there may be pivoting on the AD set, and that anything in the PEN-200 course material can show up.

The OSCP AD methodology, step by step

This is the Active Directory methodology from our course, and the goal is a loop you can run half asleep at hour 18. Every new credential or new network you find sends you back to the top.

1. Validate the credentials you were given. Check which hosts and services they work on: SMB, WinRM, RDP, MSSQL, LDAP. Tools like NetExec make this a one-line check across the whole range.
2. Enumerate the domain before attacking anything. Pull users, groups, service accounts with SPNs, shares, password policy and ACLs. Run a BloodHound collector and actually read the graph. Write down every account that looks unusual.
3. Get a foothold on the first machine. Use whatever the credentials open up: a share with scripts or config files, a service you can log in to, a user with remote access. Grab the proof file your control panel lists for that machine and screenshot it straight away.
4. Escalate locally, then loot everything. Once you're admin, collect credentials from every place they can hide: SAM and LSASS, saved credentials, scripts, config files, PowerShell history, scheduled tasks. Most chains are won or lost here.
5. Spray what you found. Try every new password and hash against every host and service, including accounts you've already tested. A credential that failed in step 1 can work now that you have a different user.
6. Pivot when the network runs out. If a machine only answers from inside, set up a tunnel through the host you own, with a tool like Ligolo-ng or Chisel. Then go back to step 1 for the new subnet.
7. Take the domain controller. By now you're usually looking at an attack path BloodHound already showed you: a Kerberoastable account, ACL rights over a user or group, delegation, or certificate abuse. Finish with full admin control and proof.txt.

Document throughout. Screenshot each proof file with the target's IP in the same frame, from an interactive shell, as the exam guide requires. Under scaled scoring, every machine you prove counts toward your result, and you can't tell from your points alone if you've passed.

OffSec's prep advice also says to keep a cheat sheet of AD commands. If you'd rather not build one from scratch, our OSCP notes are copy-paste methodology in CherryTree and Markdown, in the order you work through a box.

The AD topics students skip, and fail on

When our students fail the AD set, they usually know Kerberoasting cold. What catches them is a topic they were sure wouldn't show up. PEN-200 covers far more than the headline techniques: OffSec's course page lists "attacking Active Directory authentication" and "lateral movement in Active Directory" in the syllabus, and any of it is fair game.

Pivoting. This is the one we see most. People practice AD on flat lab networks where every host is reachable from Kali. Then on exam day the next machine only answers from inside the one they just compromised, and they've never set up a tunnel under pressure. If you can't route traffic through a compromised host in under 10 minutes, practice until you can.

Relaying and coercion. Students often treat NTLM relay as an advanced, red-team-only topic and skip it. PEN-200 teaches it, so know what it means when SMB signing is disabled, how to capture or relay authentication, and when that's the intended path rather than a rabbit hole. Keep the exam rule in mind: with poisoning and spoofing banned, the authentication you capture has to come from something you trigger.

Credentials in unusual places. The chain often moves forward because of one password left somewhere careless. That might be a description field on a user account, a script or backup on a share, a database connection string, an old config file, a password manager file, or a user who reused their password. If you only ever dump LSASS, you'll miss these.

Re-checking old ground. A share you couldn't read as user one might be wide open to user two. Students who enumerate once at the start and never go back lose hours, and points.

Overconfidence. Being strong at standalones doesn't mean you're ready for AD. The chain rewards patience and thorough notes more than speed. If you've only done AD labs with a walkthrough open, you haven't practiced the exam yet.

If any of these made you think "I haven't practiced that," that's the gap to close before exam day. Each of our free AD chains is built to make you use at least one of them. Our free OSCP labs guide shows how to run them like the exam.

How to practice for the OSCP AD set

Methodology only sticks once you've run it end to end, more than once. Plenty of Active Directory pentesting labs start you outside the domain with no credentials. The exam hands you a login, so practice full chains from a single set of domain credentials, the same way the exam begins, and keep the walkthrough closed until you're truly stuck.

We built our free OSCP-style Active Directory chains for exactly this. Each one starts from an assumed breach and makes you work through the domain to full compromise. A chain is three VMs you run on your own machine, two Windows clients and a domain controller, the same shape as the exam set. Check our lab requirements guide to see if your PC can run all three next to Kali, then get them on the labs page.

A good routine: try a chain cold, give yourself a time limit, and only watch the walkthrough after you've stopped. OffSec's own guide suggests budgeting about 4 hours for the AD set on exam day, which makes a fair first target. Then do the same chain again a week later without help. The second attempt is where the methodology becomes automatic. The walkthrough embedded above is Chain_03's, so if you've watched it, start with Chain_01 cold and run Chain_03, BleedWide afterwards as a speed drill against the clock.

FAQ

How many points is the OSCP+ AD set worth?

40 of 100 raw points: 10 for the first machine, 10 for the second and 20 for the domain controller. For exams starting on or after December 1, 2026 at 08:00 GMT, raw points are converted to a scaled score (pass at 400), so there's no fixed target. The AD set is still the largest part of the exam.

What does "assumed breach" mean on the OSCP?

You start the AD set with a valid domain username and password from OffSec, as if an attacker had already compromised a user. You don't need to break in from outside the domain first.

Can you get partial credit on the OSCP AD set?

Yes. Each machine in the set is credited separately, so compromising the first one counts even if you never reach the domain controller. OffSec's own list of passing scenarios includes one with just 10 AD points.

Can you pass the OSCP without the AD set?

Very unlikely. Under the 70-point rule, three full standalones add up to 60, and the OSCP+ no longer has bonus points, so every passing scenario OffSec lists includes AD points. With scaled scoring there's no number to aim for, so treat the AD set as essential and take as much of it as you can. We run the full point math in can you pass the OSCP+ without Active Directory.

Is Metasploit allowed on the OSCP AD set?

Only on one exam target of your choice, and it can't be used for pivoting because that would touch more than one machine. msfvenom and multi/handler are allowed on every target. Plan to do AD manually.

Is pivoting required on the OSCP AD set?

It can be. OffSec's answer is that there may be pivoting required, and that anything in the course material can be on the exam. Practice tunneling until it takes minutes.

Which Active Directory tools are allowed on the OSCP+?

OffSec's exam FAQ lists BloodHound, SharpHound, PowerView, Rubeus, Mimikatz, Impacket, evil-winrm and CrackMapExec among the allowed tools. Responder is allowed too, without poisoning or spoofing. AI chatbots are banned. Every tool rule is in our OSCP+ allowed tools guide.

Start practicing the chain

You get good at the AD set by running full chains many times. Start with our free AD chains, then move to the full course when you're ready.

Students tell us this is where we help most. Palak wrote: "The AD Chains were incredibly helpful. Having a clear, repeatable methodology gave me a framework I could rely on instead of feeling completely lost whenever I got stuck." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Stuck on a chain? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: OSCP+ Exam Guide (exam structure, AD scoring, proof and Metasploit rules)
• OffSec: OSCP+ Exam FAQ (pivoting, bonus points, passing scenarios, allowed tools)
• OffSec: OSCP+ Exam with AD Preparation (cyclical enumeration, time for the AD set)
• OffSec: OSCP+ Scoring Update (Oct 21, 2026; checked November 3, 2026)
• OffSec: PEN-200 course page (Active Directory topics in the PEN-200 syllabus; checked November 3, 2026)
• OffSec: OSCP+ Equated Scaled Scoring FAQ
• Hacker Blueprint: Hacking Active Directory Chains Methodology (Full Guide!) (YouTube, Nov 14, 2025)