Active Directory Tests

These tests collect and validate on-premises Active Directory configuration, including users, groups, GPOs, DNS, trusts, sites, and domain controllers.

270 checks4 Critical7 High17 Medium7 Low235 Info

Run theseInvoke-Maester -Suite adCopy

270 checks

Group byProductFeatureAreaSeverityNone

Columns

ProductFeatureAreaSeverityUser impactEffortATT&CKControlsSourceReset to default

ID↕Check↕Product↕Feature↕Area↕Severity↕User impact↕Effort↕ATT&CK↕Controls↕Source↕

AD-GPOREP-17No GPOs should contain a cpasswordActive DirectoryGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-18No GPOs should contain a cpasswordActive DirectoryGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-SPN-12No domain admin accounts should have SPNs configuredActive DirectoryService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-SPN-13No domain admin accounts should have SPNs configuredActive DirectoryService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-DC-02SMBv1 should be disabled on all domain controllersActive DirectoryDomain controllersInfrastructure hardeningHighLowMediumT1210nist-800-53-r5:CM-7Active DirectoryAD-DC-04SMB signing should be enabled on all domain controllersActive DirectoryDomain controllersInfrastructure hardeningHighLowLowT1557nist-800-53-r5:SC-8Active DirectoryAD-DCOMP-02Non-DC computers should not have unconstrained delegationActive DirectoryComputersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryAD-GPOREP-19No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-20No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-TRUST-04No trusts should lack SID filtering (quarantine)Active DirectoryTrustsExternal access and sharingHighMediumMediumT1134.005nist-800-53-r5:AC-4, nist-800-53-r5:SC-7Active DirectoryAD-USER-29No users should be configured for unconstrained delegationActive DirectoryUsersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdActive DirectoryComputersIdentity lifecycle and hygieneMediumLowMediumT1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-GPOL-05GPO blocked inheritance count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-01No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-02No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-03GPOs without authenticated users count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-04GPOs without authenticated users details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-07GPOs with deny ACE count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-08GPOs with deny ACE details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-09GPO inherited permissions count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-15No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-16No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumActive DirectoryAccount securityAuthenticationMediumLowLowT1558.001nist-800-53-r5:IA-5Active DirectoryAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Active DirectoryAccount securityAuthenticationMediumLowLowT1098nist-800-53-r5:CM-6Active DirectoryAD-PWDPOL-04Password complexity should be enabledActive DirectoryPassword policyAuthenticationMediumMediumLowT1110—Active DirectoryAD-PWDPOL-05Password reversible encryption should be disabledActive DirectoryPassword policyAuthenticationMediumMediumMediumT1556.005—Active DirectoryAD-SCH-05LAPS should be installed in Active DirectoryActive DirectorySchemaPrivileged accessMediumLowMediumT1078.003, T1550.002nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2)Active DirectoryAD-DFSR-01All domain controllers should have DFS-R subscriptionsActive DirectoryReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-04Unlinked GPO count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-05GPO unlinked details should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOL-03GPO unlinked target count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOREP-06GPOs without domain computers count should be retrievableActive DirectoryGroup PolicyAccess controlLowLowMedium——Active DirectoryAD-REPL-01No replication connections should be disabledActive DirectoryReplicationInfrastructure hardeningLowLowLow——Active DirectoryAD-ROOTDSE-03Root DSE should be synchronizedActive DirectoryReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-CFG-01Tombstone lifetime configuration should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-02dSHeuristics count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-03SPN mappings should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-04Optional features count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-05Recycle bin enabled paths should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-06LDAP query policy count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-07Default query policy should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-08AuthN policy container count should be retrievableActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-CFG-09AD activation objects count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-10Well-known security principals count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-11Registered DHCP servers count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-12Enterprise CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-13Certificate templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-14Enrollment templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-15Enrollment CA certificate details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-16Trusted root CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-17Trusted root CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-18Intermediate CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-19Intermediate CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-20CRL distribution points count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-21NTAuth certificates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-22KDS root key count should be acceptableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-23SMTP site links count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-CFG-24IP site links count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-COMP-01Computer disabled count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-02Computer dormant count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1078.002—Active DirectoryAD-COMP-03Computer CreatorSid count should be retrievableActive DirectoryComputersAccess controlInfo————Active DirectoryAD-COMP-04Computer non-standard primary group count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-05Computer SID History count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-COMP-06Computer default container count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-07Computer OU count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-08Computer per OU average should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-09Computer delegation count should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-COMP-10Computer delegation details should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DACL-01Distinct DACL object count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-02OU DACL entry count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-03Conflict object count should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-04Conflict object details should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-05Deny ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-06Deny ACE details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-07Distinct DACL identity count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-08DACL ACE distribution per identity should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-09Privileged allow ACE count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-10Privileged allow ACE details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-11Privileged extended right count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-12Privileged extended right details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-13Privileged extended right identities should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-14Non-inherited ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-15Unresolved SID count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-16Unresolved SID details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-17Inherited object type count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-18Inherited object type details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DC-01DC site coverage count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-03SMBv3.1.1 enabled count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-05DCs with all FSMO roles count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-06FSMO role holder details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-07DC operating system count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-08DC operating system details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-01DC non-standard LDAP port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-02DC non-standard LDAPS port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-03Read-only domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-04Non-Global Catalog DC count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-01Computers with unconstrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-04Computer operating system count should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-05Computer operating system details should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-07Computer DNS host name count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-08Computer DNS zone count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-09Computer DNS zone details should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DNS-01DNS zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-02Zones with only SOA/NS records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-03Root servers with incorrect IPs should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-04Root server incorrect IP details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-05Dynamic DNS record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-06Zones with non-default records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-07Zone record count details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-08Zone delegation count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-09Zone delegation details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-10SOA record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-11AD DS SRV record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-12AD DS SRV record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-13DNSSEC record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-14Empty zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-15Duplicate zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-16Reverse lookup zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-17Non-standard zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-18Reverse zone network count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-19Reverse zone network details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DOM-01Domain functional level should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-02Machine account quota should be retrievableActive DirectoryDomain and forestAccess controlInfo——T1136.002—Active DirectoryAD-DOM-03Domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DOM-04RIDs remaining should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-05Domain name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-06Domain name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-07NetBIOS name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-08NetBIOS name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOMS-01Allowed DNS suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FEAT-01Optional feature count should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FEAT-02Optional feature enabled details should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FGPP-01Fine-grained password policy count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-02Fine-grained password policy value count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-03Fine-grained password policy setting counts should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-04Fine-grained password policy application targets should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FOR-01Forest functional level should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-02Forest domain count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-03Tombstone lifetime should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FOR-04Recycle Bin status should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FORS-01UPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-02UPN suffixes details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-03SPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-04Cross-forest references count should be retrievableActive DirectoryDomain and forestExternal access and sharingInfo————Active DirectoryAD-GCHG-01Average group membership changes per year should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-01Distinct groups with members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-02Distinct account types of members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-03Member account types breakdown should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-04Trust members count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-05Trust members details by group should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-06Foreign SID principals count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-07Foreign SID details by domain should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-08Empty non-privileged group count should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-09Empty non-privileged group details should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-10Privileged groups with members count should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GMC-11Privileged groups with members details should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GPO-01GPO total count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-02GPO created before 2020 count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-03GPO stale-before-2020 count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-01GPO linked count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-02Disabled GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-04Enforced GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-06GPO linked OU count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-12GPO disabled link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-13GPO disabled link details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-14GPO enforcement count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-01GPO state total count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-02WMI filter count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-03WMI filter details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-04Disabled GPO settings count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-05Computer disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-06User disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-07All disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-08GPO owner distinct count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOS-09GPO owner details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GRP-01Group AdminCount should be retrievableActive DirectoryGroupsPrivileged accessInfo————Active DirectoryAD-GRP-02Groups in container objects count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-03Stale groups count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-04Groups with manager count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-05Group SID History count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-GRP-06Distribution group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-07Security group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-08Domain local group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-09Global group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-10Universal group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-KRBTGT-02KRBTGT last logon should be investigatedActive DirectoryAccount securityAuthenticationInfo——T1078.001—Active DirectoryAD-MSA-01Managed service account count should be investigatedActive DirectoryAccount securityApplications and workload identitiesInfo————Active DirectoryAD-OU-01OU overlapping name count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-02OU at domain root count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-03OU stale count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-04OU empty count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-05OU empty details should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-PRINT-01Printer total count should be retrievableActive DirectoryPrintersInfrastructure hardeningInfo————Active DirectoryAD-PWDPOL-01Password history count should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.004—Active DirectoryAD-PWDPOL-02Password maximum age should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.002, T1078.002—Active DirectoryAD-PWDPOL-03Password minimum length should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-06Account lockout duration should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-07Account lockout threshold should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-REPL-02Non-auto replication connection count should be investigatedActive DirectoryReplicationInfrastructure hardeningInfo————Active DirectoryAD-ROOTDSE-01Supported SASL mechanism count should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-ROOTDSE-02Supported SASL mechanism details should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-SCH-01Schema modification year count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-02Schema modification year details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-03Schema version entry count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-04Schema version details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SITE-01Site total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-02Sites without domain controllers count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-03Sites without domain controllers details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-04Sites without subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-05Sites without subnet associations details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SPN-01Computer SPN service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-02Computer SPN service class usage should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-03Computer SPN unknown service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-04Computer SPN unknown service class details should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-05Computer SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-06User SPN total count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-07User SPN service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-08User SPN service class usage should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-09User SPN unknown service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-10User SPN unknown service class details should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-11User SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesAuthenticationInfo————Active DirectoryAD-SUB-01Subnet total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-02Sites with subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-03Catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-04IPv6 subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-05IPv6 catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-08Distinct first octets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-11Subnets without site associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-TRUST-01Trust total count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-02Trust inter-forest count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-03Trust quarantined count should be investigatedActive DirectoryTrustsExternal access and sharingInfo——T1134.005—Active DirectoryAD-TRUST-05Trust configuration details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-06Trust stale count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-07Trust stale details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-USER-01Disabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-02Dormant enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-USER-03Non-expiring password user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-04Reversible encryption user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1556.005—Active DirectoryAD-USER-05Delegation-enabled user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-USER-06DES-only Kerberos user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558—Active DirectoryAD-USER-07No pre-authentication user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558.004—Active DirectoryAD-USER-08Never-logged-in enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-09Password-not-required user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-10Workstation-restricted user count should be retrievableActive DirectoryUsersAccess controlInfo————Active DirectoryAD-USER-11User AdminCount count should be retrievableActive DirectoryUsersPrivileged accessInfo————Active DirectoryAD-USER-12User non-standard primary group count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-13User SID History count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-USER-14User SPN count should be retrievableActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-USER-15User manager count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-16User home directory count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-17User profile path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-18User script path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo——T1037.003—Active DirectoryAD-USER-19User in container count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-20Known service account count should be retrievableActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-21Known service account details should be investigatedActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-22Built-in administrator account count should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-23Enabled built-in administrator details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-24Built-in administrator last logon details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-25Built-in administrator password age details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001, T1110.003—Active DirectoryAD-USER-26Honey pot user count should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-27Honey pot user details should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-28User delegation configured count should be investigatedActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active Directory