This playbook grew out of my own need for a practical Active Directory field guide that I could use during real penetration tests instead of relying on scattered notes, command collections and memory. Over time, I kept refining it around the way I actually work: establish what access and evidence I have, understand what each result proves,