CRTP Preparation 2026 — AD Red Team Cert | FsKnockouT

The Certified Red Team Professional (CRTP) is Altered Security's entry-level Active Directory red-teaming certification. Of all the practical AD certs on the market, CRTP has the cleanest introduction to multi-forest attack chains, trust abuse, Kerberos delegation, and SQL-server pivoting. This guide covers the exam format, the lab that trains you, a 60-day preparation plan, and the retired-lab walkthroughs that help you practice exam-pool scenarios.

What CRTP is

CRTP is a 24-hour hands-on practical exam against a small on-premises Active Directory forest. You are given low-privileged domain-user access and must fully compromise all target machines across the forest, including domain controllers in both parent and child domains. The exam is graded on whether you achieve full domain admin or enterprise admin across the required machines, and whether your 48-hour post-exam report documents your attack chain.

The underlying course is "Attacking and Defending Active Directory" by Altered Security (founded by the author of the Nishang and PowerView-adjacent tooling community). Course and exam materials are updated roughly annually as Microsoft rotates AD hardening defaults.

Who CRTP is for

  • Penetration testers specialising in enterprise environments.
  • Red-team operators building a baseline before CRTE or Altered Security's advanced certs.
  • Candidates stacking CRTP alongside OSCP+ for AD depth beyond the OSCP+ AD set.
  • SOC analysts and defenders wanting to understand attacker tradecraft from the attacker's perspective.
  • Hiring-manager candidates for red-team and threat-emulation roles.

Exam format

You get 24 hours of hands-on exam time followed by a 48-hour report window. The environment contains 5 target machines across a forest with parent and child domains plus a trust relationship. You are expected to:

  • Compromise a domain-joined workstation starting from provided credentials.
  • Enumerate the forest using PowerView, BloodHound, or equivalent.
  • Abuse Kerberos (kerberoasting, AS-REP roasting, unconstrained delegation, constrained delegation, resource-based delegation).
  • Abuse ACLs (GenericAll, WriteDACL, DCSync rights, GPO abuse).
  • Cross domain and forest trusts to reach the parent domain and other forests.
  • Compromise SQL servers via link abuse.

Passing means achieving the required level of access and submitting a report that documents each attack chain with screenshots, commands, and brief technical explanation.

Common failure points

  1. Over-reliance on BloodHound. BloodHound is a map, not a solution. Candidates who can't manually enumerate ACLs and trusts fail when BloodHound misses an edge or the environment blocks collection.
  2. Mimikatz muscle memory. Mimikatz works, but the exam environment often blocks the obvious invocations. Rubeus, Certify, SharpHound, and PowerShell equivalents matter.
  3. Tunnel vision on one technique. Four hours kerberoasting when the chain was ACL abuse is a common failure.
  4. Trust-abuse unfamiliarity. Child-to-parent and inter-forest trusts are specifically tested. Candidates who only practised single-domain attacks miss the core exam objective.
  5. Report fatigue. The 48-hour report window feels generous until you realise you have 5 machines to document with screenshots and command transcripts.

Study timeline (8 weeks)

  • Weeks 1-3: Course material. Watch every video. Repeat every lab until you can perform each attack from memory.
  • Week 4: Lab extension — practice on Hack The Box's Dante prolab and Zephyr for AD depth.
  • Week 5: Dedicated kerberoasting, AS-REP, and delegation practice. Build your own Rubeus / PowerView cheat sheet.
  • Week 6: Trust abuse week — practice child-to-parent, parent-to-child, and inter-forest attacks.
  • Week 7: Mock exam against the retired CRTP lab environment. See our CRTP Retired Lab Walkthrough.
  • Week 8: Report-template polishing and exam booking.

Recommended practice

FsKnockouT maintains two relevant resources: the CRTP Latest Exam Walkthrough covering current exam-pool attack chains, and the CRTP Retired Lab Walkthrough for practising the earlier lab environment. Together they give you both current-exam exposure and solid foundational practice.

After CRTP, the usual next step is CRTE (Certified Red Team Expert) which expands into multi-forest attacks, defence evasion, and enterprise-scale red-teaming.

Frequently asked questions

How much does CRTP cost?

The course-plus-exam bundle is typically around $249 USD with 30-day lab access. 60-day and 90-day lab-access options cost more. Retakes cost around $99 USD.

Is the course required?

You can attempt the exam without the course, but it is not recommended. The lab is specifically designed around the attack chains the course teaches. Most candidates take the course.

How does CRTP compare to CRTO?

CRTO (Certified Red Team Operator by Zero-Point Security) focuses on Cobalt Strike and operator tradecraft. CRTP focuses on AD attack fundamentals without a specific C2. Both are valuable, different focus.

How hard is CRTP compared to OSCP?

Narrower in scope (AD-only) but deeper. Candidates with OSCP+ experience generally find CRTP tractable. Candidates without any AD background find it steep.

Can I use Metasploit?

Metasploit is allowed but not required. The exam is designed to be solved with PowerShell-based tooling (PowerView, Rubeus, Certify) which is more realistic for real-world red-team engagements.

What's the pass rate?

Altered Security does not publish a public pass rate. Anecdotally first-attempt pass rates are higher than OSCP because the scope is tighter and the course mirrors the exam closely.

Can I retake if I fail?

Yes, retakes are available at a reduced fee. Most retake candidates pass on second attempt.

Ready to prepare?

Pick up the CRTP walkthrough for current scenarios plus the retired lab walkthrough for foundational practice. Message @FsKnockouT on Telegram if you want live support. Related reading: OSCP study guide and OSEP PEN-300 prep.