OSCP+ Adsets |

OSCP+ AD Sets are one of the most important parts of OSCP exam preparation, testing whether you can turn initial domain access into a complete Active Directory attack path through enumeration, credential discovery, lateral movement, and privilege escalation.

The current OSCP+ exam contains one three-machine Active Directory set worth 40 points. Candidates receive an initial username and password, creating an assumed-breach scenario rather than requiring an external foothold before beginning the AD portion.

That changes how you should prepare.

Instead of treating each Windows machine as an independent target, approach the environment as one connected system:

Initial Credentials → Domain Enumeration → Client #1 → Client #2 → Domain Controller

The exact path varies, but the core skill remains the same: identify the relationship that makes the next stage possible.

How OSCP+ AD Sets Work

The current OSCP+ Active Directory set consists of:

Target	Points	Main Objective
Client #1	10	Establish and expand domain access
Client #2	10	Continue the AD attack path
Domain Controller	20	Achieve high-privileged domain access
Total	40	Complete Active Directory set

OffSec currently lists Active Directory as 26% of the OSCP+ objectives, covering domain enumeration, account enumeration, attacks against AD authentication, lateral movement, and achieving high-privileged domain access.

The practical workflow is therefore more important than memorizing individual commands.

Start with:

Domain → Users → Groups → Computers → Services → Credentials → Permissions → Next Host

Every discovery should answer one question:

What does this give me that I could not access before?

OSCP AD Enumeration: Start With the Credentials You Have

Because the AD portion begins with a username and password, your first task is understanding what that identity can see.

Identify:

domain name and Domain Controllers;
domain users and groups;
computers;
SMB shares;
accessible files;
service accounts;
SPNs;
remote-access permissions;
internal services;
authentication relationships.

Do not immediately attack everything you discover.

Build an asset and identity map first.

A useful structure is:

User → Group → Host → Service → Permission

Then maintain a credential matrix:

Identity	SMB	WinRM	MSSQL	Other	Privilege
Initial User	Test	Test	Test	Record	Domain User
Service Account	Test	Test	Test	Record	Verify
New User	Test	Test	Test	Record	Verify

This prevents repeated testing and makes credential reuse much easier to identify.

Credential Discovery

Credentials are often what connect individual machines in an OSCP+ AD Set.

Useful sources may include:

SMB shares;
configuration files;
PowerShell scripts;
application files;
scheduled tasks;
Windows Credential Manager;
DPAPI artifacts;
browser profiles;
database connection strings;
service configuration;
backup files.

Do not record only the password.

Record the complete relationship:

Credential → Account → Discovery Source → Valid Service → Access → Next Target

A credential with no obvious local value may be exactly what unlocks another system.

Preparing for the OSCP+ Active Directory Set?

Practice multiple AD scenarios instead of memorizing one walkthrough. Our OSCP preparation collection includes AD Sets, standalone scenarios, walkthrough resources, and exam-focused material in one place.

✓ Instant digital delivery · ✓ Free updates · ✓ Multiple OSCP AD Sets

→ Get OSCP+ AD Set Exam Material

Lateral Movement and Attack-Path Analysis

After obtaining additional access, the most common mistake is continuing to focus on the original machine.

Instead, re-enumerate.

A typical conceptual progression could be:

Provided Domain User

→ Authenticated Enumeration

→ Accessible Share / Application

→ Credential Discovery

→ Second Identity

→ Remote Access

→ Client #1

→ Additional Credential / Privilege

→ Client #2

→ Domain Relationship

→ Domain Controller

This is not a fixed OSCP solution. It represents the reasoning process you should practice.

OffSec’s current objectives explicitly include lateral movement techniques, and its OSCP+ FAQ notes that pivoting may be required because techniques covered in PEN-200 can appear on the exam.

Service Accounts, Kerberos and Authentication

Service accounts deserve particular attention.

If you discover an account such as:

svc_mssql

svc_backup

svc_web

or another service-oriented identity, investigate its actual configuration rather than assuming it is privileged.

Check:

SPNs;
group membership;
service ownership;
accessible hosts;
remote authentication;
application configuration;
delegated permissions.

Kerberos and Windows authentication relationships can expose useful attack paths, but enumeration should determine which technique makes sense.

The same principle applies to MSSQL, SMB, WinRM, LDAP, and other services.

Finding a service is not the goal.

Understanding who can access it and what that access provides is.

Windows Privilege Escalation Inside AD Sets

Compromising a domain-connected client is usually another enumeration point, not the end of the machine.

Immediately determine:

current user;
group memberships;
privileges;
services;
scheduled tasks;
filesystem permissions;
installed software;
stored credentials;
network interfaces;
routes.

Then ask whether local privilege escalation actually advances the domain attack path.

A SYSTEM shell may expose credentials or secrets unavailable to the original user.

Those credentials may then unlock the next domain host.

The relationship becomes:

Domain Access → Host Access → Local Privilege Escalation → Credential Discovery → Lateral Movement

This is why Windows privilege escalation and Active Directory enumeration should not be practiced as completely separate subjects.

Pivoting and Internal Networks

An OSCP+ AD Set may require pivoting.

After compromising each client, inspect its network configuration and routes.

Look for:

additional interfaces;
internal subnets;
DNS servers;
reachable hosts;
active connections;
services inaccessible directly from Kali.

If the compromised machine can reach something you cannot, update your attack map.

Do not immediately assume the newly discovered subnet is the correct path. Enumerate it and determine how it relates to the identities and credentials you already possess.

OffSec specifically states that pivoting may appear in the Active Directory portion because material covered in PEN-200 is in scope.

Re-Enumeration: The Most Important OSCP AD Habit

The strongest OSCP+ AD Sets workflow is iterative:

Enumerate → Authenticate → Gain Access → Re-enumerate → Correlate → Repeat

Obtained a new user?

Recheck SMB, WinRM, MSSQL, and domain information.

Compromised a Windows client?

Inspect credentials, routes, services, DPAPI, and user artifacts.

Reached SYSTEM?

Enumerate again from the higher privilege context.

Found another subnet?

Map the new attack surface.

Obtained another domain identity?

Repeat authenticated domain enumeration.

Many AD attack paths become difficult because candidates keep searching for new vulnerabilities instead of revisiting old findings with new access.

OSCP AD Set Tools & Methodology

OffSec’s current OSCP+ FAQ explicitly lists several tools as permitted provided they are not used for restricted actions, including BloodHound Legacy/Community Edition, SharpHound, PowerView, Rubeus, Evil-WinRM, CrackMapExec, Mimikatz, Impacket, and PrintSpoofer. Always verify the current exam restrictions before exam day.

The important point, however, is not the tool.

Use each tool to answer a question.

BloodHound / SharpHound: What relationships exist?

PowerView: What can I learn about the domain?

Rubeus: What Kerberos relationships are relevant?

Impacket: Which Windows/domain services can I interact with?

Evil-WinRM: Can this identity obtain permitted remote access?

Tools accelerate methodology. They do not replace it.

Need More OSCP AD Set Practice?

OffSec itself recommends practicing the Active Directory sets contained in the PEN-200 Challenges. Comparing multiple AD environments helps you recognize recurring patterns without depending on one memorized solution.

Use our OSCP collection for additional exam-focused ADSet material and walkthrough resources:

→ Explore OSCP+ AD Sets & Exam Resources

Documentation Matters More Than Most Candidates Expect

OSCP preparation should not end when you obtain a shell.

OffSec’s current authoritative objectives assign 33% to documenting findings, the largest individual domain weighting. Active Directory accounts for another 26%.

During every ADSet practice session, record:

Host → User → Discovery → Exploitation → Privilege → Credential → Next Host

Capture commands and evidence while the environment is still available.

For every important step, you should be able to explain:

what you discovered;
how you discovered it;
why it mattered;
what you did next;
what access resulted.

This makes the final attack chain reproducible and dramatically simplifies reporting.

Common OSCP+ AD Set Mistakes

Treating the three machines independently. They form a connected Active Directory environment.

Ignoring the initial credentials. The assumed-breach account is your starting point for authenticated domain enumeration.

Testing every technique immediately. Enumerate first and let evidence determine the attack.

Ignoring service accounts. They can connect applications, Kerberos, MSSQL, and domain infrastructure.

Not maintaining a credential matrix. This causes repeated testing and missed credential reuse.

Stopping after local privilege escalation. Higher local privileges may expose the credential required for the next machine.

Ignoring network routes. Pivoting may be part of the AD environment.

Failing to re-enumerate. New identities and privileges change what you can access.

Leaving documentation until the end. Capture evidence as you progress.

OSCP+ AD Sets FAQ

How many machines are in the OSCP+ Active Directory set?

The current OSCP+ exam contains three AD machines: two clients and one Domain Controller, worth a total of 40 points.

Do you receive credentials for the OSCP AD set?

Yes. OffSec currently provides a username and password for the Active Directory set to simulate an assumed-breach scenario.

How many points is the OSCP AD set worth?

The complete Active Directory set is worth 40 points: 10 points for each client and 20 points for the Domain Controller.

Can pivoting appear in the OSCP Active Directory set?

Yes. OffSec states that pivoting may be required because techniques included in the PEN-200 material are potentially in scope.

How should I practice OSCP AD Sets?

OffSec recommends reviewing its AD modules, studying Assembling the Pieces, and attacking the Active Directory sets contained in the PEN-200 Challenges.

For current exam rules and requirements, use the official OffSec OSCP+ Exam Guide.

Final Thoughts

The central lesson of OSCP+ AD Sets is that Active Directory is about relationships.

The first credential gives you visibility.

Visibility reveals users, services, and systems.

One host may expose another credential.

That identity may unlock another client.

Local privilege escalation may expose information required for lateral movement.

And those relationships eventually build the path toward high-privileged domain access.

Think:

Identity → Access → Host → Credential → Relationship → Next Host

rather than:

Machine → Exploit → Machine → Exploit

That shift in methodology is what makes ADSet practice transferable to unfamiliar OSCP+ environments.

Ready to Practice OSCP+ AD Sets?

Get our OSCP+ preparation collection with multiple Active Directory sets, standalone scenarios, walkthrough resources, and exam-focused material designed to reduce the time spent searching across fragmented resources.

✓ Instant digital delivery
✓ Free updates included
✓ Multiple OSCP+ ADSet resources
✓ Practical exam-focused preparation