Microsoft Active Directory (AD) is the identity backbone of enterprises and a prime target for adversaries. The ZeroTrust “assume breach” paradigm prescribes automated containment (disabling accounts upon alert), yet the literature focuses overwhelmingly on detection efficacy, leaving the operational risks of automated response largely unexplored. We deployed a Zero-Trust monitoring architecture for on-premises AD in an isolated laboratory: least-privilege provisioning, continuous verification (MFA with workstation restrictions), and assumebreach detection via a Wazuh SIEM with 13 custom MITREaligned rules and an Active-Response containment script. We evaluated the deployment against six end-to-end attack chains, including Shadow Credentials, AS-REP Roasting, and DCSync. The three Zero-Trust pillars intercepted exploits at distinct kill-chain stages. The deployment, however, surfaced a structural containment-risk trade-off: the automated response that halted a severe AD Certificate Services exploit also disabled the Administrator account, revealing a “privileged-account selfdenial-of-service” (self-DoS) failure mode that would paralyse the domain under a false positive. We characterise this failure mode as a structurally implied consequence of unconstrained assumebreach logic, argue its false-positive blast radius qualitatively, and leave its empirical measurement to future work. To bound this risk without sacrificing containment speed, we propose a tiered containment architecture that mandates isolation (forced re-authentication and session revocation) rather than outright disabling for privileged accounts.

Active Directory,Zero Trust,SIEM,Wazuh,automated containment,MITRE ATT&CK,incident response,AD Certificate Services