The steps
-
GuideBeginner20 minPAM Foundations
PAM basics explained: what counts as privileged, the attack path, vaulting, rotation, session brokering, just-in-time access and the enterprise access model.
-
LabIntermediate75 minAudit Privileged Groups and AdminSDHolder in Active Directory
Use PowerShell to list every member of Domain Admins and other privileged AD groups, find stale admins and orphaned adminCount accounts, and clean them up.
-
LabIntermediate100 minFind Kerberoastable Service Accounts and Move Them to gMSA
Find Kerberoastable service accounts in Active Directory with PowerShell, rank them by risk, then replace one with a group Managed Service Account (gMSA).
-
LabIntermediate90 minDeploy Windows LAPS for Local Administrator Passwords
Deploy Windows LAPS in Active Directory: extend the schema, set permissions, configure Group Policy, retrieve a password and prove that it rotates.
-
LabAdvanced120 minBuild a Tiered Admin Model in Active Directory
Build a three tier admin model in Active Directory with separate admin accounts, an OU structure and Group Policy logon restrictions, then test that it holds.
-
LabAdvanced120 minHybrid Identity Hardening
Protect the bridge between on-premises Active Directory and Entra ID, the most abused identity path.
Finish by protecting the path to the cloud.
Other learning paths
Beginner pathIdentity Security StarterNew to identity security? Learn the ideas, set up a tenant and complete your first five labs.7 steps5 labsAbout 8 hoursStart this path →
Intermediate pathEntra ID Security EngineerThe full twelve lab track: authenticate, govern privilege, then detect and report.15 steps12 labsAbout 22 hoursStart this path →
Intermediate pathPrivileged Access DefenderProtect the accounts attackers want most, across Linux, Active Directory and Entra ID.8 steps6 labsAbout 9 hoursStart this path →