The short answer
Not realistically, and under the 70-point rule, not at all. While that rule applies, you can't pass the OSCP+™ (OSCP Plus) without Active Directory points: the three standalone machines are worth 60 points between them, the pass mark is 70, and OffSec no longer gives bonus points. A perfect standalone run still leaves you 10 points short, so you need at least one machine from the Active Directory set.
Exams that start on or after December 1, 2026 at 08:00 GMT use scaled scoring, and OffSec doesn't publish how raw points convert. Nobody outside OffSec can tell you if 60 standalone points would ever be enough. So under both systems, treat the AD set as mandatory. It's 40 of the 100 raw points.
Older answers often say you can skip AD and cover the gap with bonus points. That stopped working in November 2024. Every rule below comes from OffSec's own pages, checked on October 29, 2026, with the scoring change rechecked on November 3, 2026.
We're Hacker Blueprint. Our instructor holds the OSCP®, and we teach the AD set to the 600+ students in our academy.
How the OSCP+ exam is scored
| Part | Machines | Raw points | How the points split |
|---|---|---|---|
| Standalones | 3 | 60 (20 each) | 10 for initial access (local.txt), 10 for privilege escalation (proof.txt) |
| AD set | 2 clients and a domain controller | 40 | 10 for machine 1, 10 for machine 2, 20 for machine 3 |
The AD set starts from an assumed breach: OffSec gives you a domain username and password, so you begin as an ordinary domain user.
AD credit is per machine. OffSec's own passing scenarios include totals of 10 and 20 AD points, so the first client counts even if you never reach the domain controller. OffSec doesn't publish a split inside each AD machine, like the 10 and 10 on a standalone. Your exam control panel lists every machine's objectives once the exam starts.
The math under the 70-point rule
If your exam starts before December 1, 2026 at 08:00 GMT, you need 70 of 100 raw points. The standalones top out at 60, and OffSec's exam FAQ says bonus points "are not available for the OSCP+ exam anymore." So the AD set has to supply at least 10 points, and that only works if you take every standalone flag too.
Here are the four passing scenarios OffSec lists, plus a no-AD row we added for comparison:
| AD set | Standalone flags | Standalone points | Total |
|---|---|---|---|
| Full AD set (40) | 3 local.txt | 30 | 70, pass |
| Full AD set (40) | 2 local.txt + 1 proof.txt | 30 | 70, pass |
| 2 AD machines (20) | 3 local.txt + 2 proof.txt | 50 | 70, pass |
| 1 AD machine (10) | 3 local.txt + 3 proof.txt | 60 | 70, pass |
| No AD (0) | 3 local.txt + 3 proof.txt | 60 | 60, fail |
Compare the last two rows. The 10-point AD route needs all six standalone flags, so one missed privilege escalation, or one proof screenshot without the target's IP address, sinks it. The full AD set works the other way: with 40 AD points, footholds on the three standalones are enough, and every extra flag is margin.
What scaled scoring changes, and what OffSec hasn't said
From December 1, 2026 at 08:00 GMT, OffSec converts your raw points into a scaled score from 100 to 500, and 400 passes. The raw values stay the same, and OffSec's scoring update says the exam content, objectives, grading requirements, format, duration and proctoring aren't changing either. The AD set is still 40 of the 100 raw points.
What OffSec has published:
- Each exam set gets its own conversion, set through statistical equating.
- A harder set needs fewer raw points to pass and an easier one needs more, so the number "may be more or less than 70."
- The raw total needed on your set isn't published, and OffSec's scoring update says you "should no longer use 70 points or any other specific raw-point total as a passing target."
What it hasn't published: any conversion table, any rule that weighs AD points differently from standalone points, or anything on whether a standalone-only score could reach 400. We won't guess at a mapping, and you should be wary of anyone who does.
What's certain is that skipping AD caps your raw score at 60 on an exam where you can't see the pass line. The full detail is in OSCP+ scaled scoring explained.
Why the old "skip AD" advice no longer works
The advice comes from an exam that no longer exists. When OffSec added the AD set in January 2022, its announcement said "it is technically possible to pass the exam without the compromise of the Active Directory set," by completing every other machine and submitting the course exercise and lab report for 10 bonus points. Back then the AD set only paid out for the full chain, so 60 standalone points plus 10 bonus points was a route some people planned around, even though OffSec warned it "leaves absolutely no room for failure."
Two changes closed it. Bonus points went away with the exam updates that introduced the OSCP+ on November 1, 2024. And the AD set now starts from domain credentials and pays per machine, so even part of the chain earns points. If a guide still tells you to skip AD and lean on bonus points, check its date.
How to prepare for the AD set
OffSec's AD preparation guide suggests about 4 hours for the AD set and 2 to 3 hours per standalone, which leaves plenty of the 23 hours and 45 minutes for breaks, sleep and documentation. Skipping AD doesn't buy you much time. Our sample 24-hour exam timeline lays those blocks out hour by hour, AD set first.
At the methodology level, practice like this:
- Run full sets from a single domain login, on a 4-hour timer. Keep the walkthrough closed and note where you stopped.
- Enumerate again after every new access. OffSec says to enumerate the domain again as each new user, and calls this step often overlooked.
- Be ready to pivot. OffSec says pivoting may be required on the AD set.
- Redo sets without notes. That's OffSec's advice too, and the second run shows whether the methodology stuck.
Our OSCP+ Active Directory guide lays out the full enumeration loop, and our free OSCP labs guide shows how to run a practice chain under exam conditions. Our free AD chains, Chain_01 First Contact and Chain_03 BleedWide, are two Windows clients and a domain controller that start from a domain login, like the exam. Get them on the labs page. OffSec also recommends keeping an AD cheat sheet, and our OSCP notes are a ready-made one.
For the techniques themselves, our Hacking Active Directory playlist starts from the basics, and the Pivoting and Network Tunneling playlist covers Ligolo-ng and Chisel.
FAQ
Can you pass the OSCP without Active Directory?
Not under the 70-point rule. The standalones are worth 60 points and bonus points are gone, so you need at least 10 AD points. Under scaled scoring, OffSec hasn't published how raw points convert, so there's no way to know if a standalone-only score could pass.
How many AD points do you need to pass the OSCP?
For exams starting before December 1, 2026 at 08:00 GMT, at least 10, and only if you also take all six standalone flags. After that date there's no fixed target, because scaled scoring converts raw points differently on each exam set.
Do you get partial points on the OSCP AD set?
Yes, per machine: 10 for the first, 10 for the second and 20 for the third. OffSec doesn't publish a split within a single AD machine, so check your control panel for each machine's objectives.
Are there still bonus points on the OSCP?
No. OffSec's exam FAQ says bonus points "are not available for the OSCP+ exam anymore." They went away with the exam updates that introduced the OSCP+ on November 1, 2024.
Does scaled scoring make the AD set optional?
No. It's still 40 raw points, and OffSec says not to aim for any raw total because your set's pass line isn't published. Skipping AD caps your raw score at 60.
Start with one AD chain
If AD is the part you've been putting off, start small: one free chain, one 4-hour timer, walkthrough closed.
One of our students, matthew53, wrote: "Solid prep for the OSCP, especially the AD side. The AD Chains were the standout for me. They got me comfortable with the part I was most worried about going in." (More reviews)
Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains and see how far four hours gets you.
Nervous about the AD set? Ask in the Hacker Blueprint Discord.
Sources
- OffSec: OSCP+ Exam Guide (standalones at 20 points split 10 and 10, AD set at 10, 10 and 20, credentials at the start, proof rules, scaled scoring cutoff; checked October 29, 2026)
- OffSec: OSCP+ Exam FAQ (no bonus points, the four passing scenarios, pivoting; checked October 29, 2026)
- OffSec: OSCP+ Equated Scaled Scoring FAQ (400 on a 100 to 500 scale, a conversion per exam set, raw points needed not published; checked October 29, 2026)
- OffSec: OSCP+ Scoring Update (October 21, 2026; 70 points before the cutoff, scaled scoring after, no raw-point passing target, exam content, format and grading requirements unchanged; checked November 3, 2026)
- OffSec: OSCP+ Exam with AD Preparation (time per machine, enumerating again as each new user, redoing AD sets without notes, AD cheat sheet; checked October 29, 2026)
- OffSec: Everything you need to know about the OSCP+ (September 4, 2024; the exam updates that introduced the OSCP+ took effect November 1, 2024)
- OffSec: OSCP Exam Change (December 1, 2021; the AD set from January 2022, its original full-chain-only scoring, and passing without AD with bonus points)
