Several months ago I assessed a local nonprofit Active Directory environment using PingCastle. The results were sobering: a risk score of 100/100, with issues like an unchanged KRBTGT account (Golden Ticket risk), too many privileged accounts, hundreds of stale user/computer objects, and a long tail of unsupported Windows systems. In other words, a well-meaning organization doing important work, but with an AD environment that could be taken over and held persistently by an attacker with relatively little effort.
I'm sharing this anonymized report because this pattern is not unique to one nonprofit. Many small and mid-sized organizations have limited IT staff, rely on "it's been working for years," and don't realize how exposed their identity infrastructure has become.
Key Findings
The PingCastle assessment revealed critical vulnerabilities across multiple domains:
- KRBTGT Account — Never rotated, creating Golden Ticket attack risk
- Privileged Accounts — Too many accounts with administrative access
- Stale Objects — Hundreds of unused user and computer accounts
- Unsupported Systems — Legacy Windows systems past end-of-life
- Missing LAPS — No Local Administrator Password Solution deployed
- Logging Gaps — Insufficient monitoring and audit trail
The Good News
Most of the highest-impact fixes are straightforward:
- Rotate KRBTGT — Two-rotation process to invalidate potential Golden Tickets
- Reduce and harden admin accounts — Implement least-privilege access
- Deploy LAPS — Unique local admin passwords on every machine
- Clean up stale objects — Remove unused accounts and computer objects
- Get basic logging/monitoring in place — Enable security auditing
Why This Matters
If you're responsible for AD in a nonprofit (or any resource-constrained environment), this walkthrough can help you benchmark your own risk and prioritize practical steps to reduce the chance of a devastating compromise.
Active Directory is the identity backbone of most organizations. When it's compromised, attackers can move laterally, escalate privileges, and maintain persistence indefinitely. For nonprofits handling sensitive donor and client data, the stakes are especially high.
Originally published on LinkedIn by Ross Moravec. The original post is on LinkedIn.
Written by Ross Moravec, founder of Nonprofit Tech Support.