Active Directory Domain Services offer a wide attack surface featuring protocols, services, permissions, policies, and many more components. This talk will focus on one of my favorite attack scenarios based on exploiting ACEs and Kerberos delegations. A 5 minutes scenario leading to full takeover, requiring no user-interaction.