Into a biometric datacenter after being stopped three times

The question

Test whether a determined intruder could reach the secure datacenter, combining physical access with network compromise.

How we approached it

Tailgating and pretexts at the front door, a staging point on an upper floor, an NTLM relay to an IT administrator's workstation, and escalation to domain admin to alter the biometric enrollment database.

What we found

• A receptionist, a guard and an employee each questioned the team and accepted a pretext.
• An NTLM relay and offline crack gave access to an administrator's workstation, then domain admin.
• Domain admin rights allowed the biometric enrollment data to be modified, and the datacenter reader admitted a tester.
• A patrol officer escorted the team out of the datacenter without raising an alarm.

What it meant

The team was caught red-handed three times and nobody escalated. The recommendations centred on giving staff a clear, expected way to act on doubt, alongside stronger access controls.