Default Security Settings Inappropriate Administrative Users and Privileged Access Inappropriate or Broad Access for Roles and Employees Uncomplex Passwords for Administrative Accounts Unpatched Vulnerabilities on AD Servers Lack of Visibility and Reporting of Unauthorized Access Attempts