Findings & security rules

All DCs are supported

No domain controller runs an out-of-support OS.

krbtgt rotated recently

The krbtgt account password was rotated less than 40 days ago, limiting Golden Ticket risk.

SMBv1 disabled

The vulnerable SMBv1 protocol is disabled on all controllers.

Filtering active

The forest trust enforces SID filtering and authentication selectivity.

Schema Admins empty

The Schema Admins group has no permanent member.

Recycle Bin enabled

The Active Directory Recycle Bin is enabled: deleted objects can be recovered.

1 exposed GPO (cpassword)

A GPO contains an encrypted password (cpassword) readable by any authenticated user in SYSVOL.

7 objects with unconstrained delegation

Non-DC accounts are trusted for unconstrained delegation: an attacker can capture privileged TGTs there.

1 trust without SID filtering

An external trust does not enforce SID filtering: privilege escalation risk via SID History injection.

4 controllers affected

Controllers do not enforce LDAP signing: exposure to NTLM relay and man-in-the-middle attacks.

1 privileged service account

A service account (with SPN, kerberoastable) is a member of Domain Admins: a successful Kerberoasting grants Tier 0 access.

56 out-of-support machines

Machines run an end-of-support operating system (Windows 7/8.1, Server 2008R2/2012R2) no longer receiving patches.

7 Domain Admins members

The Domain Admins group has 7 members. Too many permanent admins increases compromise risk.

28 kerberoastable accounts

SPN accounts with an old password are vulnerable to Kerberoasting (offline extraction and cracking).

39 accounts inactive > 90 d

Enabled accounts have not logged on for more than 90 days. They needlessly widen the attack surface.

12 accounts without pre-auth

Accounts have Kerberos pre-authentication disabled: their hash can be obtained without authentication.

8 accounts with SID History

Accounts retain a sIDHistory attribute from migrations, potentially exploitable.

4 accounts with reversible encryption

Accounts store their password with reversible encryption (equivalent to clear text).

134 machines without LAPS

Machines lack a LAPS-managed local administrator password, easing lateral movement.

15 unprotected admins

Privileged accounts are not members of the Protected Users group, which hardens authentication.

Min length = 8 characters

The minimum password length is 8 characters, below recommendations (≥ 12-14).

84 accounts affected

Accounts have the DONT_EXPIRE_PASSWORD flag: the password is never rotated.

Quota = 10

Any authenticated user can join up to 10 machines to the domain (default), exploitable (e.g. RBCD).

44 inactive computers

Computer objects have not authenticated for more than 90 days.

Forest: 2012 R2

The forest functional level is Windows Server 2012 R2, blocking recent security features.

7 DES accounts

Some accounts only allow the breakable DES encryption for Kerberos.