AD Hardening Audit Generator
Generate comprehensive PowerShell scripts to analyze and audit the security posture of your Active Directory environment
Requirements: The
ActiveDirectory PowerShell module (RSAT), and read access to your AD domain. Some checks require Domain Admin or Enterprise Admin privileges. Run from a domain-joined machine.
Read-only audit: This script only reads Active Directory — it makes no changes. However, always review generated scripts and test in a staging environment before running in production.
0
Total Checks
0
Critical
0
High
0
Medium
0
Low
0
Categories
Configuration
Audit Categories
Select which hardening categories to include in the audit. Each category contains specific security checks aligned with CIS Benchmarks, NIST 800-53, and Microsoft security baselines.
Password Policy
Critical
Analyze domain password policies, fine-grained password policies (PSOs), and password complexity settings.
Privileged Access
Critical
Audit membership of high-privilege groups, nested group chains, and AdminSDHolder-protected accounts.
Kerberos Security
High
Detect Kerberoastable SPNs, AS-REP roastable accounts, unconstrained delegation, and weak encryption types.
Stale & Inactive Objects
Medium
Find inactive user and computer accounts, stale service accounts, and orphaned objects.
Trust Relationships
High
Enumerate domain and forest trusts, SID filtering status, and selective authentication settings.
Group Policy Security
Medium
Audit GPOs for security settings, unlinked policies, and potentially dangerous configurations.
LDAP & Protocol Security
High
Check LDAP signing requirements, channel binding, SMB signing, and NTLMv1 usage indicators.
Domain Controller Security
Critical
Audit DC OS versions, functional levels, SYSVOL replication, and KRBTGT account status.
Account Security Hygiene
Medium
Check locked-out accounts, accounts without manager, accounts with delegation allowed, and more.
DNS Security
Low
Enumerate AD-integrated DNS zones, check dynamic update settings, and aging/scavenging configuration.
Invoke-ADHardeningAudit.ps1
Continuous AD hardening monitoring with OnePAM
OnePAM provides continuous access monitoring, automated compliance reports, session recording across Active Directory, SSH, RDP, and databases — all from a single pane of glass.