Findings & security rules
20 open issues · 26 rules evaluated
All DCs are supported
No domain controller runs an out-of-support OS.
Keep DCs on a supported version (Server 2016+).
krbtgt rotated recently
The krbtgt account password was rotated less than 40 days ago, limiting Golden Ticket risk.
Rotate krbtgt twice a year (spaced double rotation).
SMBv1 disabled
The vulnerable SMBv1 protocol is disabled on all controllers.
No action — keep SMBv1 disabled fleet-wide.
Filtering active
The forest trust enforces SID filtering and authentication selectivity.
No action required.
Schema Admins empty
The Schema Admins group has no permanent member.
Keep this group empty outside schema-change operations.
Recycle Bin enabled
The Active Directory Recycle Bin is enabled: deleted objects can be recovered.
No action — good practice in place.
1 exposed GPO (cpassword)
A GPO contains an encrypted password (cpassword) readable by any authenticated user in SYSVOL.
Remove GPP preferences containing passwords; reset exposed accounts.
7 objects with unconstrained delegation
Non-DC accounts are trusted for unconstrained delegation: an attacker can capture privileged TGTs there.
Switch to constrained delegation (S4U2Proxy) and flag sensitive accounts as 'Account is sensitive'.
1 trust without SID filtering
An external trust does not enforce SID filtering: privilege escalation risk via SID History injection.
Enable SID filtering (quarantine) on external trusts.
4 controllers affected
Controllers do not enforce LDAP signing: exposure to NTLM relay and man-in-the-middle attacks.
Enforce LDAP signing and channel binding via GPO on the DCs.
1 privileged service account
A service account (with SPN, kerberoastable) is a member of Domain Admins: a successful Kerberoasting grants Tier 0 access.
Remove the service account from privileged groups; apply least privilege.
56 out-of-support machines
Machines run an end-of-support operating system (Windows 7/8.1, Server 2008R2/2012R2) no longer receiving patches.
Plan migration or network isolation of out-of-support systems.
7 Domain Admins members
The Domain Admins group has 7 members. Too many permanent admins increases compromise risk.
Reduce to 2-4 dedicated accounts; use just-in-time administration (JIT/PAM).
28 kerberoastable accounts
SPN accounts with an old password are vulnerable to Kerberoasting (offline extraction and cracking).
Use gMSA (120-character passwords) for SPN service accounts.
39 accounts inactive > 90 d
Enabled accounts have not logged on for more than 90 days. They needlessly widen the attack surface.
Disable then delete inactive accounts; set up a quarterly review.
12 accounts without pre-auth
Accounts have Kerberos pre-authentication disabled: their hash can be obtained without authentication.
Re-enable Kerberos pre-authentication on these accounts.
8 accounts with SID History
Accounts retain a sIDHistory attribute from migrations, potentially exploitable.
Purge sIDHistory after validating completed migrations.
4 accounts with reversible encryption
Accounts store their password with reversible encryption (equivalent to clear text).
Remove the 'Store password using reversible encryption' option and reset passwords.
134 machines without LAPS
Machines lack a LAPS-managed local administrator password, easing lateral movement.
Deploy Windows LAPS across the fleet via GPO.
15 unprotected admins
Privileged accounts are not members of the Protected Users group, which hardens authentication.
Add Tier 0 accounts to the Protected Users group (after compatibility testing).
Min length = 8 characters
The minimum password length is 8 characters, below recommendations (≥ 12-14).
Raise the minimum length to 14 characters and deploy a banned-password policy.
84 accounts affected
Accounts have the DONT_EXPIRE_PASSWORD flag: the password is never rotated.
Remove the flag on user accounts; use gMSA for services.
Quota = 10
Any authenticated user can join up to 10 machines to the domain (default), exploitable (e.g. RBCD).
Set ms-DS-MachineAccountQuota to 0 and delegate domain join to a dedicated team.
44 inactive computers
Computer objects have not authenticated for more than 90 days.
Clean up stale computer objects after verification.
Forest: 2012 R2
The forest functional level is Windows Server 2012 R2, blocking recent security features.
Raise the functional level after upgrading the DCs.
7 DES accounts
Some accounts only allow the breakable DES encryption for Kerberos.
Remove the 'Use Kerberos DES encryption types' option from these accounts.