Active Directory
300 checks4 Critical12 High20 Medium28 Low236 Info
Run these
Invoke-Maester -Product adAD-GPOREP-17No GPOs should contain a cpasswordGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-18No GPOs should contain a cpasswordGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-SPN-12No domain admin accounts should have SPNs configuredService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-SPN-13No domain admin accounts should have SPNs configuredService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-DC-02SMBv1 should be disabled on all domain controllersDomain controllersInfrastructure hardeningHighLowMediumT1210nist-800-53-r5:CM-7Active DirectoryAD-DC-04SMB signing should be enabled on all domain controllersDomain controllersInfrastructure hardeningHighLowLowT1557nist-800-53-r5:SC-8Active DirectoryAD-DCOMP-02Non-DC computers should not have unconstrained delegationComputersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryAD-GPOREP-19No GPOs should contain a default passwordGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-20No GPOs should contain a default passwordGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-TRUST-04No trusts should lack SID filtering (quarantine)TrustsExternal access and sharingHighMediumMediumT1134.005nist-800-53-r5:AC-4, nist-800-53-r5:SC-7Active DirectoryAD-USER-29No users should be configured for unconstrained delegationUsersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAUsersPrivileged accessHighLowLowT1558, T1550.003—Microsoft Zero Trust AssessmentZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAComputersPrivileged accessHighLowMediumT1078.003, T1550.002—Microsoft Zero Trust AssessmentZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAGroupsPrivileged accessHighLowLowT1078.002—Microsoft Zero Trust AssessmentZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAPermissions and delegationPrivileged accessHighLowLowT1003.006—Microsoft Zero Trust AssessmentZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAPermissions and delegationPrivileged accessHighLowMediumT1003.006—Microsoft Zero Trust AssessmentAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdComputersIdentity lifecycle and hygieneMediumLowMediumT1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-GPOL-05GPO blocked inheritance count should be compliantGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-01No GPOs should be missing permissionsGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-02No GPOs should be missing permissionsGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-03GPOs without authenticated users count should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-04GPOs without authenticated users details should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-07GPOs with deny ACE count should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-08GPOs with deny ACE details should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-09GPO inherited permissions count should be retrievableGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-15No GPOs should have version mismatchesGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-16No GPOs should have version mismatchesGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumAccount securityAuthenticationMediumLowLowT1558.001nist-800-53-r5:IA-5Active DirectoryAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Account securityAuthenticationMediumLowLowT1098nist-800-53-r5:CM-6Active DirectoryAD-PWDPOL-04Password complexity should be enabledPassword policyAuthenticationMediumMediumLowT1110—Active DirectoryAD-PWDPOL-05Password reversible encryption should be disabledPassword policyAuthenticationMediumMediumMediumT1556.005—Active DirectoryAD-SCH-05LAPS should be installed in Active DirectorySchemaPrivileged accessMediumLowMediumT1078.003, T1550.002nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2)Active DirectoryAD-DFSR-01All domain controllers should have DFS-R subscriptionsReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-04Unlinked GPO count should be compliantGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-05GPO unlinked details should be compliantGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOL-03GPO unlinked target count should be compliantGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOREP-06GPOs without domain computers count should be retrievableGroup PolicyAccess controlLowLowMedium——Active DirectoryAD-REPL-01No replication connections should be disabledReplicationInfrastructure hardeningLowLowLow——Active DirectoryAD-ROOTDSE-03Root DSE should be synchronizedReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-CFG-01Tombstone lifetime configuration should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-02dSHeuristics count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-03SPN mappings should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-04Optional features count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-05Recycle bin enabled paths should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-06LDAP query policy count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-07Default query policy should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-08AuthN policy container count should be retrievableDirectory configurationAuthenticationInfo————Active DirectoryAD-CFG-09AD activation objects count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-10Well-known security principals count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-11Registered DHCP servers count should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-12Enterprise CA count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-13Certificate templates count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-14Enrollment templates count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-15Enrollment CA certificate details should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-16Trusted root CA count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-17Trusted root CA details should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-18Intermediate CA count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-19Intermediate CA details should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-20CRL distribution points count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-21NTAuth certificates count should be retrievableCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-22KDS root key count should be acceptableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-23SMTP site links count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-CFG-24IP site links count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-COMP-01Computer disabled count should be retrievableComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-02Computer dormant count should be retrievableComputersIdentity lifecycle and hygieneInfo——T1078.002—Active DirectoryAD-COMP-03Computer CreatorSid count should be retrievableComputersAccess controlInfo————Active DirectoryAD-COMP-04Computer non-standard primary group count should be retrievableComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-05Computer SID History count should be retrievableComputersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-COMP-06Computer default container count should be retrievableComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-07Computer OU count should be retrievableComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-08Computer per OU average should be retrievableComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-09Computer delegation count should be retrievableComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-COMP-10Computer delegation details should be retrievableComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DACL-01Distinct DACL object count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-02OU DACL entry count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-03Conflict object count should be investigatedPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-04Conflict object details should be investigatedPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-05Deny ACE count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-06Deny ACE details should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-07Distinct DACL identity count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-08DACL ACE distribution per identity should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-09Privileged allow ACE count should be investigatedPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-10Privileged allow ACE details should be investigatedPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-11Privileged extended right count should be investigatedPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-12Privileged extended right details should be investigatedPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-13Privileged extended right identities should be investigatedPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-14Non-inherited ACE count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-15Unresolved SID count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-16Unresolved SID details should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-17Inherited object type count should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-18Inherited object type details should be investigatedPermissions and delegationAccess controlInfo————Active DirectoryAD-DC-01DC site coverage count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-03SMBv3.1.1 enabled count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-05DCs with all FSMO roles count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-06FSMO role holder details should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-07DC operating system count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-08DC operating system details should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-01DC non-standard LDAP port count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-02DC non-standard LDAPS port count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-03Read-only domain controller count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-04Non-Global Catalog DC count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-01Computers with unconstrained delegation count should be investigatedComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-04Computer operating system count should be investigatedComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-05Computer operating system details should be investigatedComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-07Computer DNS host name count should be investigatedComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-08Computer DNS zone count should be investigatedComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-09Computer DNS zone details should be investigatedComputersInfrastructure hardeningInfo————Active DirectoryAD-DNS-01DNS zone count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-02Zones with only SOA/NS records should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-03Root servers with incorrect IPs should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-04Root server incorrect IP details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-05Dynamic DNS record count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-06Zones with non-default records should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-07Zone record count details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-08Zone delegation count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-09Zone delegation details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-10SOA record details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-11AD DS SRV record count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-12AD DS SRV record details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-13DNSSEC record count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-14Empty zone count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-15Duplicate zone count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-16Reverse lookup zone count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-17Non-standard zone count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-18Reverse zone network count should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-19Reverse zone network details should be retrievableDNSInfrastructure hardeningInfo————Active DirectoryAD-DOM-01Domain functional level should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-02Machine account quota should be retrievableDomain and forestAccess controlInfo——T1136.002—Active DirectoryAD-DOM-03Domain controller count should be retrievableDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DOM-04RIDs remaining should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-05Domain name standard compliance should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-06Domain name non-standard details should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-07NetBIOS name standard compliance should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-08NetBIOS name non-standard details should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOMS-01Allowed DNS suffixes count should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FEAT-01Optional feature count should be investigatedDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FEAT-02Optional feature enabled details should be investigatedDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FGPP-01Fine-grained password policy count should be retrievablePassword policyAuthenticationInfo————Active DirectoryAD-FGPP-02Fine-grained password policy value count should be retrievablePassword policyAuthenticationInfo————Active DirectoryAD-FGPP-03Fine-grained password policy setting counts should be retrievablePassword policyAuthenticationInfo————Active DirectoryAD-FGPP-04Fine-grained password policy application targets should be retrievablePassword policyAuthenticationInfo————Active DirectoryAD-FOR-01Forest functional level should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-02Forest domain count should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-03Tombstone lifetime should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FOR-04Recycle Bin status should be retrievableDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FORS-01UPN suffixes count should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-02UPN suffixes details should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-03SPN suffixes count should be retrievableDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-04Cross-forest references count should be retrievableDomain and forestExternal access and sharingInfo————Active DirectoryAD-GCHG-01Average group membership changes per year should be investigatedGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-01Distinct groups with members count should be retrievableGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-02Distinct account types of members count should be retrievableGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-03Member account types breakdown should be retrievableGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-04Trust members count should be investigatedGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-05Trust members details by group should be investigatedGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-06Foreign SID principals count should be investigatedGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-07Foreign SID details by domain should be investigatedGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-08Empty non-privileged group count should be investigatedGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-09Empty non-privileged group details should be investigatedGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-10Privileged groups with members count should be investigatedGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GMC-11Privileged groups with members details should be investigatedGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GPO-01GPO total count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-02GPO created before 2020 count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-03GPO stale-before-2020 count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-01GPO linked count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-02Disabled GPO link count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-04Enforced GPO link count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-06GPO linked OU count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-12GPO disabled link count should be retrievableGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-13GPO disabled link details should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-14GPO enforcement count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-01GPO state total count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-02WMI filter count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-03WMI filter details should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-04Disabled GPO settings count should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-05Computer disabled GPO settings details should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-06User disabled GPO settings details should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-07All disabled GPO settings details should be investigatedGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-08GPO owner distinct count should be investigatedGroup PolicyAccess controlInfo————Active DirectoryAD-GPOS-09GPO owner details should be investigatedGroup PolicyAccess controlInfo————Active DirectoryAD-GRP-01Group AdminCount should be retrievableGroupsPrivileged accessInfo————Active DirectoryAD-GRP-02Groups in container objects count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-03Stale groups count should be retrievableGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-04Groups with manager count should be retrievableGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-05Group SID History count should be retrievableGroupsIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-GRP-06Distribution group count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-07Security group count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-08Domain local group count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-09Global group count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-10Universal group count should be retrievableGroupsInfrastructure hardeningInfo————Active DirectoryAD-KRBTGT-02KRBTGT last logon should be investigatedAccount securityAuthenticationInfo——T1078.001—Active DirectoryAD-MSA-01Managed service account count should be investigatedAccount securityApplications and workload identitiesInfo————Active DirectoryAD-OU-01OU overlapping name count should be retrievableOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-02OU at domain root count should be retrievableOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-03OU stale count should be retrievableOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-04OU empty count should be retrievableOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-05OU empty details should be retrievableOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-PRINT-01Printer total count should be retrievablePrintersInfrastructure hardeningInfo————Active DirectoryAD-PWDPOL-01Password history count should be retrievablePassword policyAuthenticationInfo——T1110.004—Active DirectoryAD-PWDPOL-02Password maximum age should be retrievablePassword policyAuthenticationInfo——T1110.002, T1078.002—Active DirectoryAD-PWDPOL-03Password minimum length should be retrievablePassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-06Account lockout duration should be retrievablePassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-07Account lockout threshold should be retrievablePassword policyAuthenticationInfo——T1110—Active DirectoryAD-REPL-02Non-auto replication connection count should be investigatedReplicationInfrastructure hardeningInfo————Active DirectoryAD-ROOTDSE-01Supported SASL mechanism count should be investigatedDirectory configurationAuthenticationInfo————Active DirectoryAD-ROOTDSE-02Supported SASL mechanism details should be investigatedDirectory configurationAuthenticationInfo————Active DirectoryAD-SCH-01Schema modification year count should be retrievableSchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-02Schema modification year details should be retrievableSchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-03Schema version entry count should be retrievableSchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-04Schema version details should be retrievableSchemaInfrastructure hardeningInfo————Active DirectoryAD-SITE-01Site total count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-02Sites without domain controllers count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-03Sites without domain controllers details should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-04Sites without subnet associations count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-05Sites without subnet associations details should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SPN-01Computer SPN service class count should be retrievableService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-02Computer SPN service class usage should be retrievableService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-03Computer SPN unknown service class count should be retrievableService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-04Computer SPN unknown service class details should be investigatedService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-05Computer SPN non-FQDN hosts should be investigatedService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-06User SPN total count should be investigatedService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-07User SPN service class count should be investigatedService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-08User SPN service class usage should be investigatedService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-09User SPN unknown service class count should be investigatedService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-10User SPN unknown service class details should be investigatedService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-11User SPN non-FQDN hosts should be investigatedService principal namesAuthenticationInfo————Active DirectoryAD-SUB-01Subnet total count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-02Sites with subnet associations count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-03Catch-all subnets count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-04IPv6 subnets count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-05IPv6 catch-all subnets count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-08Distinct first octets count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-11Subnets without site associations count should be retrievableSites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-TRUST-01Trust total count should be investigatedTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-02Trust inter-forest count should be investigatedTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-03Trust quarantined count should be investigatedTrustsExternal access and sharingInfo——T1134.005—Active DirectoryAD-TRUST-05Trust configuration details should be investigatedTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-06Trust stale count should be investigatedTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-07Trust stale details should be investigatedTrustsExternal access and sharingInfo————Active DirectoryAD-USER-01Disabled user count should be retrievableUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-02Dormant enabled user count should be retrievableUsersIdentity lifecycle and hygieneInfo——T1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-USER-03Non-expiring password user count should be retrievableUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-04Reversible encryption user count should be retrievableUsersAuthenticationInfo——T1556.005—Active DirectoryAD-USER-05Delegation-enabled user count should be retrievableUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-USER-06DES-only Kerberos user count should be retrievableUsersAuthenticationInfo——T1558—Active DirectoryAD-USER-07No pre-authentication user count should be retrievableUsersAuthenticationInfo——T1558.004—Active DirectoryAD-USER-08Never-logged-in enabled user count should be retrievableUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-09Password-not-required user count should be retrievableUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-10Workstation-restricted user count should be retrievableUsersAccess controlInfo————Active DirectoryAD-USER-11User AdminCount count should be retrievableUsersPrivileged accessInfo————Active DirectoryAD-USER-12User non-standard primary group count should be retrievableUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-13User SID History count should be retrievableUsersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-USER-14User SPN count should be retrievableService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-USER-15User manager count should be retrievableUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-16User home directory count should be retrievableUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-17User profile path count should be retrievableUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-18User script path count should be retrievableUsersInfrastructure hardeningInfo——T1037.003—Active DirectoryAD-USER-19User in container count should be retrievableUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-20Known service account count should be retrievableUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-21Known service account details should be investigatedUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-22Built-in administrator account count should be investigatedUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-23Enabled built-in administrator details should be investigatedUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-24Built-in administrator last logon details should be investigatedUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-25Built-in administrator password age details should be investigatedUsersPrivileged accessInfo——T1078.001, T1110.003—Active DirectoryAD-USER-26Honey pot user count should be investigatedUsersLogging and detectionInfo————Active DirectoryAD-USER-27Honey pot user details should be investigatedUsersLogging and detectionInfo————Active DirectoryAD-USER-28User delegation configured count should be investigatedUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryMP.CLT.ADUA.1001All Active Directory users have a manager.Community pack · CLT.ADUA—Medium————AD User AttributesMP.CLT.ADUA.1004All Active Directory users have an employee ID.Community pack · CLT.ADUA—Medium————AD User AttributesMP.CLT.ADUA.1011Every Active Directory employee ID belongs to only one user.Community pack · CLT.ADUA—Medium————AD User AttributesMP.CLT.ADUA.1002All Active Directory users have a job title.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1003All Active Directory users have a department.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1005All Active Directory users have a company name.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1006All Active Directory users have a complete office address.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1007All Active Directory users have a business phone.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1008All Active Directory users have a mobile phone.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1010All Active Directory users have an office location.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1012Active Directory phone numbers use international E.164 format.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1013Active Directory name, job and location attributes have no stray spaces.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1014Active Directory country values use an approved spelling.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1015Active Directory departments are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1016Active Directory job titles are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1017Active Directory company names are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1018Active Directory street addresses are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1019Active Directory cities are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1020Active Directory states or provinces are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1021Active Directory postal codes are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1022Active Directory business phone numbers are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1023Active Directory user addresses match an approved office location.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1024All Active Directory users have the extension attributes your organisation requires.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1025Active Directory extension attribute values are on the approved list.Community pack · CLT.ADUA—Low————AD User AttributesMP.CLT.ADUA.1009All Active Directory users have a fax number.Community pack · CLT.ADUA—Info————AD User Attributes
No checks match.