CRTE Study Plan

Go from a domain user to enterprise admin across forests by abusing features, not exploits. A free, day-by-day CRTE schedule built from the official Windows Red Team Lab (Nikhil Mittal) syllabus, scaled to your exam date and weekly hours.

Syllabus last verified Sep 30, 2026 · changelog

Approx. cost
$299–$699
Difficulty
♥♥♥♥♥
Study time
about 186h
Start level
Advanced

▶ Build my CRTE plan

> How long does CRTE take?

The plan assumes about 186 study hours. Here is how that stretches across different weekly schedules.

Hours per weekTime to finish
5 hoursabout 38 weeks (8.8 months)
10 hoursabout 19 weeks (4.4 months)
15 hoursabout 13 weeks (3.0 months)
20 hoursabout 10 weeks (2.3 months)
30 hoursabout 7 weeks (1.6 months)

> CRTE exam format

Altered Security · Windows Red Team Lab (Nikhil Mittal)

  • 48-hour hands-on exam in an individual, fully patched Active Directory environment
  • Multiple domains and forests on the latest Windows versions
  • Enumerate, build attack paths and submit detailed solutions including mitigations
  • One attempt included; up to 3 attempts in total, with cooldowns between them
  • CRTE valid 3 years with a free renewal exam. CRTP first is advised for beginners

Official CRTE page ↗

> CRTE syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Warm-up

The course starts above CRTP level, so refresh the basics first.

  • CRTP-level Active Directory refresher12h · learn

Tradecraft & Enumeration

Tooling and recon that survive modern defences.

  • Offensive .NET Tradecraft8h · learn
  • PowerShell & AD Enumeration8h · learn

Escalation & Movement

From a low-privilege user to domain admin.

  • Local Privilege Escalation4h · learn
  • Domain Privilege Escalation10h · learn
  • Lateral Movement8h · learn

Dominance & Trusts

Persist, then cross domain and forest boundaries.

  • Domain Dominance & Persistence6h · learn
  • Cross-Domain Attacks8h · learn
  • Cross-Forest Attacks (Standard)6h · learn
  • Cross-Forest Attacks (Advanced)8h · learn

Defenses & Detection

Evade Microsoft defences, then understand how defenders fight back.

  • Microsoft Defender for Endpoint (MDE) Bypass6h · learn
  • Microsoft Defender for Identity (MDI) Bypass5h · learn
  • Defense Mechanisms5h · learn
  • Detection & Evasion4h · learn
  • Deception Techniques3h · learn

Range Time

The lab is the course. Repeat it until it is automatic.

  • Redo the lab from memory30h · lab
  • Extra multi-forest practice (GOAD, HTB Pro Labs)25h · lab

Final Boss Prep

You have 48 hours and must document the mitigations too.

  • Build an advanced AD attack-path cheat sheet8h · review
  • Rehearse MDE- and MDI-aware OPSEC6h · review
  • Timed 48-hour mock exam16h · review

> Where to practise for CRTE

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

> CRTE exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

  • Schedule your exam and add the start time, time zone and deadline to your calendar
  • Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
  • Practise cross-domain and cross-forest attack paths in a fully patched environment
  • Write a mitigation for each attack path: the report must include them
  • Complete a full-length timed practice run (48 hours if you can) on your exam setup
  • Finalize your note-taking setup and templates (see the notes starter below)
  • Build and review your cheat sheets and command references
  • Arrange time off, tell people you will be unavailable, and plan your meals ahead
  • Confirm whether the exam is proctored and what ID, camera or screen sharing you need

Machine and network

  • Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
  • Plug in your laptop and turn off sleep, updates and notifications for the exam
  • Test the VPN or lab connection early and know how to reconnect after a drop
  • Update your attack VM, take a clean snapshot and keep a spare
  • Install and test every tool you plan to use, and check none of them are banned
  • Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room (if required)

  • Test your webcam, microphone and screen sharing on the proctoring platform
  • Clear your desk and room as the rules require, and tell housemates not to interrupt
  • Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
  • Learn the rules for breaks and for leaving the camera view
  • Have your ID ready and know the check-in steps

During the exam

  • Sleep well the night before, and skip last-minute cramming
  • Prepare food and water, and set timers for break reminders
  • Read the brief and scope carefully before you touch anything
  • Write notes and capture proof as you go, not at the end
  • Time-box each target and move on when stuck. You can come back later
  • Stop new attacks with enough time left to verify your evidence

Report and submission

  • Copy your report template and fill in the easy parts (scope, methodology) while you work
  • Check every finding has reproducible steps and screenshots
  • Proofread: could someone else follow each step?
  • Export in the exact format and naming the exam guide requires
  • Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

  • Hour 0 to 1. Connect, confirm the VPN, read the brief, set up your notes and plan the first day.
  • Day 1. Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks.
  • 1 sleep window. Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep.
  • Meals and movement. Eat proper meals away from the desk and walk outside at least once a day.
  • Last 5 hours. Stop new attacks, verify evidence and outline the report while everything is fresh.
  • After the hands-on part. Write the report in focused blocks, proofread, and submit with a buffer before the deadline.

▶ Open the interactive CRTE exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed CRTE with PWN PATH

No CRTE debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Recent CRTE changes

  1. Site OSIR, eCPPT, eMAPT, CRTE, BTL1: Added five new certs: OSIR, eCPPT, eMAPT, CRTE and BTL1, with a new Mobile app security track on the roadmap.
  2. Verified OSIR, CRTE: Checked against the official syllabus

Full changelog

> Frequently asked questions

How long does it take to prepare for CRTE?

PWN PATH builds the CRTE plan on about 186 study hours. At 10 hours a week that is roughly 19 weeks, and at 20 hours a week roughly 10 weeks. Your own timeline depends on how much of the material you already know.

What is the CRTE exam like?

48-hour hands-on exam in an individual, fully patched Active Directory environment. Multiple domains and forests on the latest Windows versions. Enumerate, build attack paths and submit detailed solutions including mitigations. One attempt included; up to 3 attempts in total, with cooldowns between them. CRTE valid 3 years with a free renewal exam. CRTP first is advised for beginners.

How hard is CRTE?

We rate CRTE 4 out of 5. It suits anyone who finished CRTP and wants multi-forest Active Directory attack paths built on feature abuse. CRTP-level Active Directory knowledge. CRTP first is advised.

How much does CRTE cost?

Altered Security prices the lab by length: $299 for 30 days, $499 for 60 and $699 for 90. One exam attempt is included. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for CRTE?

Start with the "Warm-up" phase: CRTP-level Active Directory refresher. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for CRTE?

CRTP-level Active Directory knowledge. CRTP first is advised.

What should I do the week before the CRTE exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the CRTE exam?

Hour 0 to 1: Connect, confirm the VPN, read the brief, set up your notes and plan the first day. Day 1: Enumerate everything, then go after the most promising targets in 90-minute blocks with short breaks. 1 sleep window: Plan 6 or more hours each night. Write down where you stopped and your next three ideas before you sleep. Meals and movement: Eat proper meals away from the desk and walk outside at least once a day.

What should I take after CRTE?

Common next steps are CRTO, OSEP. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before CRTE:

CRTP

Where it leads:

CRTOOSEP

More in active directory & red team:

CRTPCAPECRTOOSEP

Not sure CRTE is right for you? Take the one-minute cert quiz.