Active Directory

275 checks4 Critical12 High17 Medium7 Low235 Info

Group Policy40Users29Groups23Computers20Permissions and delegation20DNS19Directory configuration18Sites and subnets18Service principal names14Domain and forest14Domain controllers13Password policy11Certificate Services10Trusts7Schema5Organizational units5Account security4Replication4Printers1

Run theseInvoke-Maester -Product adCopy

275 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

AD-GPOREP-17No GPOs should contain a cpasswordGroup PolicyCriticalAD-GPOREP-18No GPOs should contain a cpasswordGroup PolicyCriticalAD-SPN-12No domain admin accounts should have SPNs configuredService principal namesCriticalAD-SPN-13No domain admin accounts should have SPNs configuredService principal namesCriticalAD-DC-02SMBv1 should be disabled on all domain controllersDomain controllersHighAD-DC-04SMB signing should be enabled on all domain controllersDomain controllersHighAD-DCOMP-02Non-DC computers should not have unconstrained delegationComputersHighAD-GPOREP-19No GPOs should contain a default passwordGroup PolicyHighAD-GPOREP-20No GPOs should contain a default passwordGroup PolicyHighAD-TRUST-04No trusts should lack SID filtering (quarantine)TrustsHighAD-USER-29No users should be configured for unconstrained delegationUsersHighZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAUsersHighZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAComputersHighZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAGroupsHighZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAPermissions and delegationHighZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAPermissions and delegationHighAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdComputersMediumAD-GPOL-05GPO blocked inheritance count should be compliantGroup PolicyMediumAD-GPOREP-01No GPOs should be missing permissionsGroup PolicyMediumAD-GPOREP-02No GPOs should be missing permissionsGroup PolicyMediumAD-GPOREP-03GPOs without authenticated users count should be retrievableGroup PolicyMediumAD-GPOREP-04GPOs without authenticated users details should be retrievableGroup PolicyMediumAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableGroup PolicyMediumAD-GPOREP-07GPOs with deny ACE count should be retrievableGroup PolicyMediumAD-GPOREP-08GPOs with deny ACE details should be retrievableGroup PolicyMediumAD-GPOREP-09GPO inherited permissions count should be retrievableGroup PolicyMediumAD-GPOREP-15No GPOs should have version mismatchesGroup PolicyMediumAD-GPOREP-16No GPOs should have version mismatchesGroup PolicyMediumAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumAccount securityMediumAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Account securityMediumAD-PWDPOL-04Password complexity should be enabledPassword policyMediumAD-PWDPOL-05Password reversible encryption should be disabledPassword policyMediumAD-SCH-05LAPS should be installed in Active DirectorySchemaMediumAD-DFSR-01All domain controllers should have DFS-R subscriptionsReplicationLowAD-GPO-04Unlinked GPO count should be compliantGroup PolicyLowAD-GPO-05GPO unlinked details should be compliantGroup PolicyLowAD-GPOL-03GPO unlinked target count should be compliantGroup PolicyLowAD-GPOREP-06GPOs without domain computers count should be retrievableGroup PolicyLowAD-REPL-01No replication connections should be disabledReplicationLowAD-ROOTDSE-03Root DSE should be synchronizedReplicationLowAD-CFG-01Tombstone lifetime configuration should be retrievableDirectory configurationInfoAD-CFG-02dSHeuristics count should be retrievableDirectory configurationInfoAD-CFG-03SPN mappings should be retrievableDirectory configurationInfoAD-CFG-04Optional features count should be retrievableDirectory configurationInfoAD-CFG-05Recycle bin enabled paths should be retrievableDirectory configurationInfoAD-CFG-06LDAP query policy count should be retrievableDirectory configurationInfoAD-CFG-07Default query policy should be retrievableDirectory configurationInfoAD-CFG-08AuthN policy container count should be retrievableDirectory configurationInfoAD-CFG-09AD activation objects count should be retrievableDirectory configurationInfoAD-CFG-10Well-known security principals count should be retrievableDirectory configurationInfoAD-CFG-11Registered DHCP servers count should be retrievableDirectory configurationInfoAD-CFG-12Enterprise CA count should be retrievableCertificate ServicesInfoAD-CFG-13Certificate templates count should be retrievableCertificate ServicesInfoAD-CFG-14Enrollment templates count should be retrievableCertificate ServicesInfoAD-CFG-15Enrollment CA certificate details should be retrievableCertificate ServicesInfoAD-CFG-16Trusted root CA count should be retrievableCertificate ServicesInfoAD-CFG-17Trusted root CA details should be retrievableCertificate ServicesInfoAD-CFG-18Intermediate CA count should be retrievableCertificate ServicesInfoAD-CFG-19Intermediate CA details should be retrievableCertificate ServicesInfoAD-CFG-20CRL distribution points count should be retrievableCertificate ServicesInfoAD-CFG-21NTAuth certificates count should be retrievableCertificate ServicesInfoAD-CFG-22KDS root key count should be acceptableDirectory configurationInfoAD-CFG-23SMTP site links count should be retrievableSites and subnetsInfoAD-CFG-24IP site links count should be retrievableSites and subnetsInfoAD-COMP-01Computer disabled count should be retrievableComputersInfoAD-COMP-02Computer dormant count should be retrievableComputersInfoAD-COMP-03Computer CreatorSid count should be retrievableComputersInfoAD-COMP-04Computer non-standard primary group count should be retrievableComputersInfoAD-COMP-05Computer SID History count should be retrievableComputersInfoAD-COMP-06Computer default container count should be retrievableComputersInfoAD-COMP-07Computer OU count should be retrievableComputersInfoAD-COMP-08Computer per OU average should be retrievableComputersInfoAD-COMP-09Computer delegation count should be retrievableComputersInfoAD-COMP-10Computer delegation details should be retrievableComputersInfoAD-DACL-01Distinct DACL object count should be investigatedPermissions and delegationInfoAD-DACL-02OU DACL entry count should be investigatedPermissions and delegationInfoAD-DACL-03Conflict object count should be investigatedPermissions and delegationInfoAD-DACL-04Conflict object details should be investigatedPermissions and delegationInfoAD-DACL-05Deny ACE count should be investigatedPermissions and delegationInfoAD-DACL-06Deny ACE details should be investigatedPermissions and delegationInfoAD-DACL-07Distinct DACL identity count should be investigatedPermissions and delegationInfoAD-DACL-08DACL ACE distribution per identity should be investigatedPermissions and delegationInfoAD-DACL-09Privileged allow ACE count should be investigatedPermissions and delegationInfoAD-DACL-10Privileged allow ACE details should be investigatedPermissions and delegationInfoAD-DACL-11Privileged extended right count should be investigatedPermissions and delegationInfoAD-DACL-12Privileged extended right details should be investigatedPermissions and delegationInfoAD-DACL-13Privileged extended right identities should be investigatedPermissions and delegationInfoAD-DACL-14Non-inherited ACE count should be investigatedPermissions and delegationInfoAD-DACL-15Unresolved SID count should be investigatedPermissions and delegationInfoAD-DACL-16Unresolved SID details should be investigatedPermissions and delegationInfoAD-DACL-17Inherited object type count should be investigatedPermissions and delegationInfoAD-DACL-18Inherited object type details should be investigatedPermissions and delegationInfoAD-DC-01DC site coverage count should be retrievableDomain controllersInfoAD-DC-03SMBv3.1.1 enabled count should be retrievableDomain controllersInfoAD-DC-05DCs with all FSMO roles count should be retrievableDomain controllersInfoAD-DC-06FSMO role holder details should be retrievableDomain controllersInfoAD-DC-07DC operating system count should be retrievableDomain controllersInfoAD-DC-08DC operating system details should be retrievableDomain controllersInfoAD-DCD-01DC non-standard LDAP port count should be retrievableDomain controllersInfoAD-DCD-02DC non-standard LDAPS port count should be retrievableDomain controllersInfoAD-DCD-03Read-only domain controller count should be retrievableDomain controllersInfoAD-DCD-04Non-Global Catalog DC count should be retrievableDomain controllersInfoAD-DCOMP-01Computers with unconstrained delegation count should be investigatedComputersInfoAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedComputersInfoAD-DCOMP-04Computer operating system count should be investigatedComputersInfoAD-DCOMP-05Computer operating system details should be investigatedComputersInfoAD-DCOMP-07Computer DNS host name count should be investigatedComputersInfoAD-DCOMP-08Computer DNS zone count should be investigatedComputersInfoAD-DCOMP-09Computer DNS zone details should be investigatedComputersInfoAD-DNS-01DNS zone count should be retrievableDNSInfoAD-DNS-02Zones with only SOA/NS records should be retrievableDNSInfoAD-DNS-03Root servers with incorrect IPs should be retrievableDNSInfoAD-DNS-04Root server incorrect IP details should be retrievableDNSInfoAD-DNS-05Dynamic DNS record count should be retrievableDNSInfoAD-DNS-06Zones with non-default records should be retrievableDNSInfoAD-DNS-07Zone record count details should be retrievableDNSInfoAD-DNS-08Zone delegation count should be retrievableDNSInfoAD-DNS-09Zone delegation details should be retrievableDNSInfoAD-DNS-10SOA record details should be retrievableDNSInfoAD-DNS-11AD DS SRV record count should be retrievableDNSInfoAD-DNS-12AD DS SRV record details should be retrievableDNSInfoAD-DNS-13DNSSEC record count should be retrievableDNSInfoAD-DNS-14Empty zone count should be retrievableDNSInfoAD-DNS-15Duplicate zone count should be retrievableDNSInfoAD-DNS-16Reverse lookup zone count should be retrievableDNSInfoAD-DNS-17Non-standard zone count should be retrievableDNSInfoAD-DNS-18Reverse zone network count should be retrievableDNSInfoAD-DNS-19Reverse zone network details should be retrievableDNSInfoAD-DOM-01Domain functional level should be retrievableDomain and forestInfoAD-DOM-02Machine account quota should be retrievableDomain and forestInfoAD-DOM-03Domain controller count should be retrievableDomain controllersInfoAD-DOM-04RIDs remaining should be retrievableDomain and forestInfoAD-DOM-05Domain name standard compliance should be retrievableDomain and forestInfoAD-DOM-06Domain name non-standard details should be retrievableDomain and forestInfoAD-DOM-07NetBIOS name standard compliance should be retrievableDomain and forestInfoAD-DOM-08NetBIOS name non-standard details should be retrievableDomain and forestInfoAD-DOMS-01Allowed DNS suffixes count should be retrievableDomain and forestInfoAD-FEAT-01Optional feature count should be investigatedDirectory configurationInfoAD-FEAT-02Optional feature enabled details should be investigatedDirectory configurationInfoAD-FGPP-01Fine-grained password policy count should be retrievablePassword policyInfoAD-FGPP-02Fine-grained password policy value count should be retrievablePassword policyInfoAD-FGPP-03Fine-grained password policy setting counts should be retrievablePassword policyInfoAD-FGPP-04Fine-grained password policy application targets should be retrievablePassword policyInfoAD-FOR-01Forest functional level should be retrievableDomain and forestInfoAD-FOR-02Forest domain count should be retrievableDomain and forestInfoAD-FOR-03Tombstone lifetime should be retrievableDirectory configurationInfoAD-FOR-04Recycle Bin status should be retrievableDirectory configurationInfoAD-FORS-01UPN suffixes count should be retrievableDomain and forestInfoAD-FORS-02UPN suffixes details should be retrievableDomain and forestInfoAD-FORS-03SPN suffixes count should be retrievableDomain and forestInfoAD-FORS-04Cross-forest references count should be retrievableDomain and forestInfoAD-GCHG-01Average group membership changes per year should be investigatedGroupsInfoAD-GMC-01Distinct groups with members count should be retrievableGroupsInfoAD-GMC-02Distinct account types of members count should be retrievableGroupsInfoAD-GMC-03Member account types breakdown should be retrievableGroupsInfoAD-GMC-04Trust members count should be investigatedGroupsInfoAD-GMC-05Trust members details by group should be investigatedGroupsInfoAD-GMC-06Foreign SID principals count should be investigatedGroupsInfoAD-GMC-07Foreign SID details by domain should be investigatedGroupsInfoAD-GMC-08Empty non-privileged group count should be investigatedGroupsInfoAD-GMC-09Empty non-privileged group details should be investigatedGroupsInfoAD-GMC-10Privileged groups with members count should be investigatedGroupsInfoAD-GMC-11Privileged groups with members details should be investigatedGroupsInfoAD-GPO-01GPO total count should be retrievableGroup PolicyInfoAD-GPO-02GPO created before 2020 count should be retrievableGroup PolicyInfoAD-GPO-03GPO stale-before-2020 count should be investigatedGroup PolicyInfoAD-GPOL-01GPO linked count should be investigatedGroup PolicyInfoAD-GPOL-02Disabled GPO link count should be retrievableGroup PolicyInfoAD-GPOL-04Enforced GPO link count should be retrievableGroup PolicyInfoAD-GPOL-06GPO linked OU count should be retrievableGroup PolicyInfoAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedGroup PolicyInfoAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedGroup PolicyInfoAD-GPOREP-12GPO disabled link count should be retrievableGroup PolicyInfoAD-GPOREP-13GPO disabled link details should be investigatedGroup PolicyInfoAD-GPOREP-14GPO enforcement count should be investigatedGroup PolicyInfoAD-GPOS-01GPO state total count should be investigatedGroup PolicyInfoAD-GPOS-02WMI filter count should be investigatedGroup PolicyInfoAD-GPOS-03WMI filter details should be investigatedGroup PolicyInfoAD-GPOS-04Disabled GPO settings count should be investigatedGroup PolicyInfoAD-GPOS-05Computer disabled GPO settings details should be investigatedGroup PolicyInfoAD-GPOS-06User disabled GPO settings details should be investigatedGroup PolicyInfoAD-GPOS-07All disabled GPO settings details should be investigatedGroup PolicyInfoAD-GPOS-08GPO owner distinct count should be investigatedGroup PolicyInfoAD-GPOS-09GPO owner details should be investigatedGroup PolicyInfoAD-GRP-01Group AdminCount should be retrievableGroupsInfoAD-GRP-02Groups in container objects count should be retrievableGroupsInfoAD-GRP-03Stale groups count should be retrievableGroupsInfoAD-GRP-04Groups with manager count should be retrievableGroupsInfoAD-GRP-05Group SID History count should be retrievableGroupsInfoAD-GRP-06Distribution group count should be retrievableGroupsInfoAD-GRP-07Security group count should be retrievableGroupsInfoAD-GRP-08Domain local group count should be retrievableGroupsInfoAD-GRP-09Global group count should be retrievableGroupsInfoAD-GRP-10Universal group count should be retrievableGroupsInfoAD-KRBTGT-02KRBTGT last logon should be investigatedAccount securityInfoAD-MSA-01Managed service account count should be investigatedAccount securityInfoAD-OU-01OU overlapping name count should be retrievableOrganizational unitsInfoAD-OU-02OU at domain root count should be retrievableOrganizational unitsInfoAD-OU-03OU stale count should be retrievableOrganizational unitsInfoAD-OU-04OU empty count should be retrievableOrganizational unitsInfoAD-OU-05OU empty details should be retrievableOrganizational unitsInfoAD-PRINT-01Printer total count should be retrievablePrintersInfoAD-PWDPOL-01Password history count should be retrievablePassword policyInfoAD-PWDPOL-02Password maximum age should be retrievablePassword policyInfoAD-PWDPOL-03Password minimum length should be retrievablePassword policyInfoAD-PWDPOL-06Account lockout duration should be retrievablePassword policyInfoAD-PWDPOL-07Account lockout threshold should be retrievablePassword policyInfoAD-REPL-02Non-auto replication connection count should be investigatedReplicationInfoAD-ROOTDSE-01Supported SASL mechanism count should be investigatedDirectory configurationInfoAD-ROOTDSE-02Supported SASL mechanism details should be investigatedDirectory configurationInfoAD-SCH-01Schema modification year count should be retrievableSchemaInfoAD-SCH-02Schema modification year details should be retrievableSchemaInfoAD-SCH-03Schema version entry count should be retrievableSchemaInfoAD-SCH-04Schema version details should be retrievableSchemaInfoAD-SITE-01Site total count should be retrievableSites and subnetsInfoAD-SITE-02Sites without domain controllers count should be retrievableSites and subnetsInfoAD-SITE-03Sites without domain controllers details should be retrievableSites and subnetsInfoAD-SITE-04Sites without subnet associations count should be retrievableSites and subnetsInfoAD-SITE-05Sites without subnet associations details should be retrievableSites and subnetsInfoAD-SPN-01Computer SPN service class count should be retrievableService principal namesInfoAD-SPN-02Computer SPN service class usage should be retrievableService principal namesInfoAD-SPN-03Computer SPN unknown service class count should be retrievableService principal namesInfoAD-SPN-04Computer SPN unknown service class details should be investigatedService principal namesInfoAD-SPN-05Computer SPN non-FQDN hosts should be investigatedService principal namesInfoAD-SPN-06User SPN total count should be investigatedService principal namesInfoAD-SPN-07User SPN service class count should be investigatedService principal namesInfoAD-SPN-08User SPN service class usage should be investigatedService principal namesInfoAD-SPN-09User SPN unknown service class count should be investigatedService principal namesInfoAD-SPN-10User SPN unknown service class details should be investigatedService principal namesInfoAD-SPN-11User SPN non-FQDN hosts should be investigatedService principal namesInfoAD-SUB-01Subnet total count should be retrievableSites and subnetsInfoAD-SUB-02Sites with subnet associations count should be retrievableSites and subnetsInfoAD-SUB-03Catch-all subnets count should be retrievableSites and subnetsInfoAD-SUB-04IPv6 subnets count should be retrievableSites and subnetsInfoAD-SUB-05IPv6 catch-all subnets count should be retrievableSites and subnetsInfoAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableSites and subnetsInfoAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableSites and subnetsInfoAD-SUB-08Distinct first octets count should be retrievableSites and subnetsInfoAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableSites and subnetsInfoAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableSites and subnetsInfoAD-SUB-11Subnets without site associations count should be retrievableSites and subnetsInfoAD-TRUST-01Trust total count should be investigatedTrustsInfoAD-TRUST-02Trust inter-forest count should be investigatedTrustsInfoAD-TRUST-03Trust quarantined count should be investigatedTrustsInfoAD-TRUST-05Trust configuration details should be investigatedTrustsInfoAD-TRUST-06Trust stale count should be investigatedTrustsInfoAD-TRUST-07Trust stale details should be investigatedTrustsInfoAD-USER-01Disabled user count should be retrievableUsersInfoAD-USER-02Dormant enabled user count should be retrievableUsersInfoAD-USER-03Non-expiring password user count should be retrievableUsersInfoAD-USER-04Reversible encryption user count should be retrievableUsersInfoAD-USER-05Delegation-enabled user count should be retrievableUsersInfoAD-USER-06DES-only Kerberos user count should be retrievableUsersInfoAD-USER-07No pre-authentication user count should be retrievableUsersInfoAD-USER-08Never-logged-in enabled user count should be retrievableUsersInfoAD-USER-09Password-not-required user count should be retrievableUsersInfoAD-USER-10Workstation-restricted user count should be retrievableUsersInfoAD-USER-11User AdminCount count should be retrievableUsersInfoAD-USER-12User non-standard primary group count should be retrievableUsersInfoAD-USER-13User SID History count should be retrievableUsersInfoAD-USER-14User SPN count should be retrievableService principal namesInfoAD-USER-15User manager count should be retrievableUsersInfoAD-USER-16User home directory count should be retrievableUsersInfoAD-USER-17User profile path count should be retrievableUsersInfoAD-USER-18User script path count should be retrievableUsersInfoAD-USER-19User in container count should be retrievableUsersInfoAD-USER-20Known service account count should be retrievableUsersInfoAD-USER-21Known service account details should be investigatedUsersInfoAD-USER-22Built-in administrator account count should be investigatedUsersInfoAD-USER-23Enabled built-in administrator details should be investigatedUsersInfoAD-USER-24Built-in administrator last logon details should be investigatedUsersInfoAD-USER-25Built-in administrator password age details should be investigatedUsersInfoAD-USER-26Honey pot user count should be investigatedUsersInfoAD-USER-27Honey pot user details should be investigatedUsersInfoAD-USER-28User delegation configured count should be investigatedUsersInfo