Introducing Active Directory Security Testing in Maester 🏰

April 25, 2026 · 7 min read

Maester Contributors

We're thrilled to announce a major expansion of Maester's security testing capabilities—comprehensive Active Directory (AD) security testing is now available! This release adds 300+ new tests across 20 categories, giving you unprecedented visibility into your on-premises and hybrid AD infrastructure.

🎯 Highlights at a Glance

300+ New AD Security Tests covering every aspect of your directory infrastructure
20 Test Categories from users and groups to DNS, GPOs, and DACL analysis
Intelligent Caching with Get-MtADDomainState for efficient data collection
Hybrid Ready - Perfect for organizations with on-premises AD and Entra ID
Validated Against Live DCs - All tests validated on Windows Server 2025 Domain Controllers

Why Active Directory Testing Matters

Active Directory remains the backbone of identity and access management for millions of organizations worldwide. Despite the shift to cloud, over 90% of Fortune 1000 companies still rely on AD for authentication and authorization. A compromised AD can lead to:

Complete domain takeover
Lateral movement across your network
Ransomware deployment at scale
Data exfiltration and theft

Maester's new AD testing capabilities help you identify misconfigurations, security gaps, and compliance issues before attackers do.

📊 Test Coverage Overview

Identity & Access Management

Category	Tests	Description
Users	29	Account status, password policies, delegation, service accounts
Groups	22	Membership, SID history, privileged access, empty groups
Computers	10	Disabled accounts, dormant systems, delegation, SID history
Service Principal Names	13	SPN analysis for Kerberoasting detection

Domain Infrastructure

Category	Tests	Description
Domain & Forest	12	Functional levels, naming, tombstone lifetime, recycle bin
Domain Controllers	12	OS versions, SMB settings, FSMO roles, RODCs, ports
Sites & Subnets	16	Topology, coverage, catch-all subnets, IPv6
Organizational Units	5	Structure, empty OUs, stale containers

Security Configuration

Category	Tests	Description
Password Policies	11	Default and fine-grained password policies
Group Policy (GPO)	11	GPO inventory, links, enforcement, inheritance
GPO State	27	Detailed GPO analysis, permissions, WMI filters
DACL Analysis	18	Discretionary Access Control List security
Security Accounts	13	KRBTGT, delegation, managed service accounts

Network & Integration

Category	Tests	Description
DNS Infrastructure	19	Zones, records, delegations, DNSSEC, reverse lookup
Trusts	7	Inter-forest trusts, quarantine status, stale trusts
Replication	8	Connection status, optional features, DFS-R
Schema	6	Schema versions, LAPS, modifications
Configuration	24	PKI, LDAP policies, DHCP, CA certificates

🔍 Key Test Categories Explained

User Security Tests

Identify risky user configurations that could lead to compromise:

# Run all user security tests
Connect-Maester -Service ActiveDirectory
Invoke-Maester -Path "./ad/user" -SkipGraphConnect

Sample Tests:

Test-MtAdUserPasswordNeverExpiresCount - Find accounts with non-expiring passwords
Test-MtAdUserDelegationAllowedCount - Detect accounts trusted for delegation
Test-MtAdUserNoPreAuthCount - Identify AS-REP Roasting vulnerabilities
Test-MtAdUserKerberosDesOnlyCount - Find legacy DES-only accounts
Test-MtAdUserBuiltInAdminEnabledDetails - Monitor built-in Administrator accounts

Group Policy Security

Analyze GPO configurations for security issues:

# Run GPO security tests
Connect-Maester -Service ActiveDirectory
Invoke-Maester -Path "./ad/gpostate" -SkipGraphConnect

Sample Tests:

Test-MtAdGpoCpasswordFoundCount - Detect encrypted passwords in GPOs
Test-MtAdGpoNoAuthenticatedUsersCount - Find GPOs missing critical permissions
Test-MtAdGpoVersionMismatchCount - Identify AD/Sysvol version mismatches
Test-MtAdGpoWmiFilterCount - Audit WMI filter usage

DACL Analysis

Deep-dive into Access Control Lists:

# Run DACL analysis tests
Connect-Maester -Service ActiveDirectory
Invoke-Maester -Path "./ad/dacl" -SkipGraphConnect

Sample Tests:

Test-MtAdDaclPrivilegedAllowAceCount - Find privileged ACE entries
Test-MtAdDaclDenyAceCount - Audit deny authorization entries
Test-MtAdDaclUnresolvedSidCount - Detect orphaned SIDs in ACLs
Test-MtAdDaclConflictObjectCount - Find conflict objects (CNF)

🚀 Getting Started

Prerequisites

Windows Server with Active Directory role, or domain-joined machine
PowerShell 5.1 or later
ActiveDirectory and GroupPolicy PowerShell modules
Domain Admin or equivalent permissions (for full coverage)

Active Directory testing is always opt-in. Connect-Maester -Service All does not connect to AD, and Invoke-Maester excludes every AD-tagged test until Connect-Maester -Service ActiveDirectory succeeds in the current PowerShell session.

Installation

# Install or update Maester
Install-Module Maester -Scope CurrentUser -Force

# Install Maester tests
md ~/maester-tests
cd ~/maester-tests
Install-MaesterTests

Running AD Tests

# Import the Maester module
Import-Module Maester -Force

# Explicitly validate the Active Directory connection
Connect-Maester -Service ActiveDirectory

# Run all AD tests
Invoke-Maester -Path "./ad" -OutputFolder "./ad-results" -SkipGraphConnect -NonInteractive

# Run specific categories
Invoke-Maester -Path "./ad/user" -OutputFolder "./ad-results" -SkipGraphConnect -NonInteractive
Invoke-Maester -Path "./ad/gpostate" -OutputFolder "./ad-results" -SkipGraphConnect -NonInteractive

# Run with specific tags
Invoke-Maester -Tag "AD.User" -OutputFolder "./ad-results" -SkipGraphConnect -NonInteractive

Using the AD Test Runner

For convenience, use the included test runner script:

# From the repository root on a domain controller
.\build\activeDirectory\Run-ADTests-And-CopyReports.ps1 -ConnectActiveDirectory

# With verbose output
.\build\activeDirectory\Run-ADTests-And-CopyReports.ps1 -ConnectActiveDirectory -Verbose

📈 Understanding Test Results

Test Output Format

Tests return standardized results:

Result	Meaning
`$true`	Test executed successfully / Configuration compliant
`$false`	Configuration non-compliant
`$null`	AD not available (test skipped)

Sample Output

# Example: Password Policy Test
Connect-Maester -Service ActiveDirectory

Test-MtAdPasswordComplexityRequired
# Returns: $true (complexity enabled - good)

Test-MtAdPasswordMinLength
# Returns: 7 (below recommended 14+)

Test-MtAdAccountLockoutThreshold
# Returns: 0 (disabled - security risk!)

HTML Reports

Generate professional HTML reports for stakeholders:

Connect-Maester -Service ActiveDirectory
Invoke-Maester -Path "./ad" -OutputFolder "./reports" -SkipGraphConnect -NonInteractive
# Open ./reports/TestResults-*.html

🔐 Security Recommendations

Based on AD test results, consider these best practices:

Password Policies

✅ Set minimum password length to 14+ characters
✅ Enable account lockout (threshold ≤ 5 attempts)
✅ Configure lockout duration to 30+ minutes
✅ Implement fine-grained password policies for privileged accounts

User Accounts

✅ Disable accounts with passwords that never expire
✅ Remove delegation from non-DC accounts
✅ Eliminate DES-only Kerberos accounts
✅ Monitor dormant enabled accounts (>90 days)

Group Policy

✅ Remove cpassword entries from GPOs
✅ Ensure all GPOs have Authenticated Users permission
✅ Resolve AD/Sysvol version mismatches
✅ Audit and remove unlinked GPOs

Domain Controllers

✅ Disable SMBv1 on all DCs
✅ Enable SMB signing
✅ Use standard LDAP/LDAPS ports (389/636)
✅ Keep DC OS versions current

🔄 Integration with CI/CD

Run AD tests in your automation pipelines from a self-hosted Windows agent that can reach a domain controller and has the required RSAT modules installed. Cloud-hosted runners do not have access to your AD environment.

GitHub Actions

name: AD Security Tests
on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  test:
    runs-on: [self-hosted, windows, ad-connected]
    steps:
      - name: Run Maester AD Tests
        shell: pwsh
        run: |
          Install-Module Maester -Force
          Import-Module Maester
          $testPath = Join-Path $env:RUNNER_TEMP 'maester-tests'
          Install-MaesterTests -Path $testPath -SkipPesterCheck
          Connect-Maester -Service ActiveDirectory
          Invoke-Maester -Path (Join-Path $testPath 'ad') -Tag 'AD' -SkipGraphConnect -NonInteractive

Azure DevOps

trigger:
- main

pool:
  name: 'AD-connected Windows agents'

steps:
- task: PowerShell@2
  inputs:
    targetType: 'inline'
    script: |
      Install-Module Maester -Force
      Import-Module Maester
      $testPath = Join-Path $env:AGENT_TEMPDIRECTORY 'maester-tests'
      Install-MaesterTests -Path $testPath -SkipPesterCheck
      Connect-Maester -Service ActiveDirectory
      Invoke-Maester -Path (Join-Path $testPath 'ad') -Tag 'AD' -OutputFolder "$(Build.ArtifactStagingDirectory)" -SkipGraphConnect -NonInteractive

🧪 Test Development & Validation

All 300+ tests were developed following a rigorous 20-phase methodology:

Phase 1-6: Core objects (Computers, SPNs, Password Policies, DNS, Domain, DCs)
Phase 7-10: Policy and structure (GPO, Groups, Users, OUs)
Phase 11-14: Infrastructure (Sites, Trusts, Schema, Config)
Phase 15-20: Advanced security (DC details, Forest, Security Accounts, Replication, GPO State, DACL)

Each test includes:

PowerShell test function
Pester unit tests
Markdown documentation with security context
Validation against live Domain Controllers

📚 Available Commands

New AD-Specific Cmdlets

Cmdlet	Description
`Get-MtADDomainState`	Collect and cache AD state data
`Get-MtADDacls`	Retrieve DACL information
`Get-MtADDomainState`	Get domain configuration state
`Get-MtADGpoState`	Get GPO detailed state
`Clear-MtADCache`	Clear AD cache data

🤝 Contributing

Active Directory testing is an ongoing effort. We welcome contributions for:

New test categories (e.g., Certificate Services, ADFS)
Additional test cases for existing categories
Performance optimizations
Documentation improvements

See our Contributing Guide to get started.

🙏 Thank You

This massive undertaking wouldn't be possible without the Maester community. Special thanks to all contributors who helped design, implement, and validate these 300+ tests.

🚀 Get Started Today

# Update Maester
Update-Module Maester -Force

# Install latest tests
cd ~/maester-tests
Update-MaesterTests

# Explicitly validate the Active Directory connection
Connect-Maester -Service ActiveDirectory

# Run AD tests on your domain controller
Invoke-Maester -Path "./ad" -SkipGraphConnect -NonInteractive

📖 Resources

Happy AD Testing! 🏰🔒

🎯 Highlights at a Glance​

Why Active Directory Testing Matters​

📊 Test Coverage Overview​

Identity & Access Management​

Domain Infrastructure​

Security Configuration​

Network & Integration​

🔍 Key Test Categories Explained​

User Security Tests​

Group Policy Security​

DACL Analysis​

🚀 Getting Started​

Prerequisites​

Installation​

Running AD Tests​

Using the AD Test Runner​

📈 Understanding Test Results​

Test Output Format​

Sample Output​

HTML Reports​

🔐 Security Recommendations​

Password Policies​

User Accounts​

Group Policy​

Domain Controllers​

🔄 Integration with CI/CD​

GitHub Actions​

Azure DevOps​

🧪 Test Development & Validation​

📚 Available Commands​

New AD-Specific Cmdlets​

🤝 Contributing​

🙏 Thank You​

🚀 Get Started Today​

📖 Resources​

🎯 Highlights at a Glance

Why Active Directory Testing Matters

📊 Test Coverage Overview

Identity & Access Management

Domain Infrastructure

Security Configuration

Network & Integration

🔍 Key Test Categories Explained

User Security Tests

Group Policy Security

DACL Analysis

🚀 Getting Started

Prerequisites

Installation

Running AD Tests

Using the AD Test Runner

📈 Understanding Test Results

Test Output Format

Sample Output

HTML Reports

🔐 Security Recommendations

Password Policies

User Accounts

Group Policy

Domain Controllers

🔄 Integration with CI/CD

GitHub Actions

Azure DevOps

🧪 Test Development & Validation

📚 Available Commands

New AD-Specific Cmdlets

🤝 Contributing

🙏 Thank You

🚀 Get Started Today

📖 Resources