Technology: Microsoft Active Directory
Tenant: dp.net
Assessment Date: 05/29/2026 06:37:36
Technologies Covered: [ Microsoft Active Directory ]
Tests Evaluated:375
This Introduction contains a global summary of the health and security scans performed on the company infrastructure with Active Directory Assessment. Detailed information about the scans can be found in the Health & Security Maturity Framework and Technical Findings sections of this report. The assessment was performed according to ANSSI and MITRE ATT&CK definition. ANSSI is French National Agency for the Security of Information Systems. For more information, please check out here: https://www.cert.ssi.gouv.fr/uploads/guide-ad.html. There are tests that also recommended by Microsoft have been performed too.
Active Directory tests are divided into three main categories: AD Security, AD Configuration , and AD Health Check. You can click on each category in the left section or select the Score Category to view the associated tests and their status. Please note there are no sub-categories for AD Health Issues.
9
CRITICAL
123
HIGH
12
MEDIUM
8
LOW
204
PASSED
0
MANUAL CHECK
0
KNOWN ISSUES
Shows overall Security score for AD Forest based on the tests executed by Assessment. Overall Score includes Security-Config and Health AD Tests.
OVERALL SCORE
Shows overall score settings that need to be configured correctly in AD Domains. These settings are recommended by Microsoft.
SECURITY SCORE
Shows overall score settings that need to be configured correctly in AD Domains. These settings are recommended by Microsoft.
CONFIGURATION SCORE
Shows health score for AD and Domain Controllers. Health issues can be found in AD Health Status category in left pane.
HEALTH SCORE
Shows overall score settings that need to be configured correctly in AD Domains as per ANSSI. These settings are recommended by ANSSI.
ANSSI SCORE
Shows overall score settings that need to be configured correctly in AD Domains as per MITRE. These settings are recommended by MITRE.
MITRE SCORE
Technology Categories and Status
CRTIICAL
HIGH
MEDIUM
LOW
PASSED
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
vuln3_protected_users
|
Protected Users Group Status | High | 1 | Total Domains Not Using Protected Users Group:1 | MITREANSSI | NO |
X
TEST NAME Protected Users Group Status Description If Addressed: Adding admin accounts to the protected Users group Reduces risks of credential theft, replay attacks, and disables legacy protocols like NTLM, DES, and unconstrained delegation. If Not Addressed: Privileged credentials remain Exposed to legacy authentication methods, making them more vulnerable to credential theft and misuse. Recommendation and Steps Step 1: Open Active Directory Users and Computers (ADUC) on a system with administrative privileges. Step 2: In the left pane, navigate to Users under your domain. Step 3: Locate the Protected Users group in the list. Step 4: Double-click the Protected Users group to open its properties. Step 5: Click on the -Members- tab and then click -Add- to begin adding users. Step 6: Add 2 or more Admin Accounts initially to the Protected Users group for testing. Step 7: Monitor these accounts for at least 1 week to confirm there are no authentication or functionality issues. Step 8: If no issues are reported, proceed to add all remaining Admin Accounts to the Protected Users group. Step 9: Document the change and update internal procedures or policies related to admin account management. Step 10: Regularly review the membership of the Protected Users group to ensure it includes all necessary admin accounts. Associated Objects Per Domain/AD Forest 
Affected Objects
More Information TEST IDvuln3_protected_users
|
| Microsoft-Recommended
|
Missing Microsoft LAPS in AD Forest | High | Not Deployed | Microsoft LAPS Status:Not Deployed | MITREANSSI | NO |
X
TEST NAME Missing Microsoft LAPS in AD Forest Description If addressed: Deploying Microsoft LAPS ensures that local administrator passwords on domain-joined computers are unique, randomly generated, and securely stored, greatly reducing the risk of lateral movement and credential theft. If not addressed: Without LAPS, local administrator accounts often share common or static passwords, making it easier for attackers to move laterally and escalate privileges across multiple systems in the domain. Recommendation and Steps 1. Assess Current Local Admin Password Management: Determine how local administrator passwords are currently managed and identify gaps. 2. Download and Install LAPS: Obtain the latest Microsoft LAPS package from Microsoft- official site and install the management tools on admin workstations. 3. Extend Active Directory Schema: Use the LAPS schema extension tools to add attributes for storing local admin passwords and expiration timestamps in AD. 4. Delegate Permissions: Configure appropriate permissions on the OU level to allow authorized users or groups to read/reset the stored passwords. 5. Configure Group Policy: Create and link a Group Policy Object (GPO) that enables LAPS, sets password parameters (length, complexity, expiration), and applies it to targeted computers. 6. Deploy LAPS Client: Ensure the LAPS client is installed on all domain-joined computers (either manually, via software deployment tools, or via GPO). 7. Verify Password Management: Confirm that LAPS is successfully managing and rotating local administrator passwords across machines. 8. Train Administrators: Educate IT staff on how to retrieve passwords securely using the LAPS management tools and proper handling procedures. 9. Monitor and Audit: Enable auditing on password retrieval and LAPS-related activities to detect potential misuse or unauthorized access. 10.Maintain and Update: Regularly update LAPS client and management tools, review delegation settings, and ensure ongoing compliance. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Recycle Bin Status | Medium | Disabled | AD Recycle Bin Status:Disabled | Configuration | NO |
X
TEST NAME AD Recycle Bin Status Description If Not Addressed (Recycle Bin Disabled): -Deleted AD objects are permanently lost or require complex recovery methods, increasing downtime and risk of data loss. If Addressed (Recycle Bin Enabled): -Allows easy restoration of deleted objects with all attributes intact, reducing recovery time and minimizing operational impact. Recommendation and Steps 1. Verify Forest Functional Level is Windows Server 2008 R2 or Higher Get-ADForest | Select-Object ForestMode2. Check if AD Recycle Bin is Enabled Get-ADOptionalFeature -Filter 'name -like Recycle Bin Feature' | Get-ADObject3. Plan a Maintenance Window for Enabling Recycle Bin 4. Backup Active Directory Before Making Changes 5. Enable AD Recycle Bin Using PowerShell Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target (Get-ADForest).Name6. Verify Recycle Bin is Enabled Get-ADOptionalFeature -Filter 'name -like Recycle Bin Feature' | Get-ADObject7. Document the Change and Inform the IT Team 8. Test Deletion and Restoration of a Test Object 9. Train Helpdesk and Admins on Using AD Recycle Bin 10. Integrate AD Recycle Bin Usage into Disaster Recovery Procedures Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Managed Service Accounts Status | Medium | Are not in use | Managed Service Accounts Status:Are not in use | Configuration | NO |
X
TEST NAME Managed Service Accounts Status Description If Not Addressed (MSAs Not Used): -Service accounts may use hardcoded, weak, or expired passwords, leading to security vulnerabilities and management overhead. If Addressed (MSAs Used): -Provides automatic password management and simplified administration, improving security and service reliability. Recommendation and Steps 1. Identify Services Using Traditional Service Accounts
-Run:
Get-WmiObject win32_service | Where-Object { $_.StartName -notlike Local* -and $_.StartName -notlike *$ }
2. Review Services and Applications That Can Use MSAs
-MSAs are ideal for Windows services, IIS app pools, scheduled tasks, etc
3. Ensure Prerequisites Are Met
-Functional level: Windows Server 2008 R2 or higher
-Key Distribution Service (KDS) must be running.
4. Create a Group Managed Service Account (gMSA)
New-ADServiceAccount -Name gmsaApp1 -DNSHostName yourdomain.local -PrincipalsAllowedToRetrieveManagedPassword Domain\ServerGroup
5. Install the gMSA on the Target Server
Install-ADServiceAccount -Identity gmsaApp1
6. Configure the Service to Use the gMSA
-Update the service logon to: Domain\gmsaApp1$
7. Restart the Service and Test Functionality
8. Remove Old/Unused Traditional Service Accounts
9. Monitor and Log gMSA Usage and Access
10. Regularly Audit Services to Ensure gMSAs Are Used Where Applicable
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
gMSA Accounts Status | Low | 0 | Total Domains With gMSA Accounts:0 | MITREANSSI | NO |
X
TEST NAME gMSA Accounts Status Description If Not Addressed (gMSAs Not Used or Tracked): Services may run under standard or overly privileged accounts with hardcoded passwords, increasing the risk of compromise and management overhead. If Addressed (gMSAs Identified and Used Properly): Enhances security, simplifies password management, and ensures compliance with least privilege principles for services and tasks. Recommendation and Steps 1. Query Active Directory for All gMSA Accounts
Get-ADServiceAccount -Filter * | Where-Object { $_.ObjectClass -eq 'msDS-GroupManagedServiceAccount' }2. Document All Discovered gMSAs with Usage Purpose and Assigned Hosts
3. Verify gMSA Usage Across Services, Scheduled Tasks, or Applications
-Check if any are unused, misconfigured, or expired.
4. Replace Standard or User Accounts Running Services With gMSAs Where Applicable
5. Ensure Target Computers Are Members of the gMSA- PrincipalsAllowedToRetrieveManagedPassword
6. Install gMSA on Required Servers
Install-ADServiceAccount -Identity gMSAName7. Configure Services to Use gMSAs
-Use the format: DOMAIN\gMSAName$
8. Monitor gMSA Usage and Service Health
9. Remove or Decommission Unused gMSAs
10. Schedule Periodic Audits of gMSAs for Security and Usage Validation
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| vuln2_compatible_2000_anonymous
|
Anonymous or EVERYONE in Pre-Windows 2000 Group | Critical | 1 | Number of Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME Anonymous or EVERYONE in Pre-Windows 2000 Group Description If Not Addressed (Anonymous/Everyone Included): -Risks unauthorized access and information disclosure, enabling unauthenticated users to gain elevated privileges. If Addressed (Anonymous/Everyone Removed): -Enhances security by limiting group membership to authorized accounts only, reducing exposure to anonymous access attacks. Recommendation and Steps 1. Identify Members of Pre-Windows 2000 Compatibility Group Get-ADGroupMember -Identity Pre-Windows 2000 Compatible Access2. Check for Presence of Anonymous and Everyone Principals 3. Document Current Group Membership and Access Permissions 4. Communicate Remediation Plan to Security and Admin Teams 5. Remove Anonymous and Everyone from the Group Remove-ADGroupMember -Identity Pre-Windows 2000 Compatible Access -Members Anonymous, Everyone -Confirm:$false6. Verify Group Membership After Removal 7. Review Group Policies and Access Controls Affected by This Change 8. Audit for Any Services or Applications Dependent on Legacy Group Membership 9. Test Access and Functionality Post-Change 10. Schedule Regular Reviews of Special Groups and Their Membership Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_compatible_2000_anonymous
|
| Microsoft-Recommended
|
Anyone can Join Computers to Domain | High | 1 | Total Domains Allowing Normal Users to Join Computers to domain:1 | MITREANSSI | NO |
X
TEST NAME Anyone can Join Computers to Domain Description If Not Addressed (Unprivileged Users Can Add Computers): -Increases risk of unauthorized devices joining the domain, leading to potential security breaches and lateral movement by attackers. If Addressed (Only Authorized Users Can Add Computers): -Strengthens domain security by limiting computer account creation to trusted administrators, reducing attack surface. Recommendation and Steps 1. Audit Current Permissions on the Computers Container Get-ACL AD:\CNComputers,DCdomain,DCcom2. Identify Users or Groups with Permissions to Add Computers 3. Review Group Policy for -dd Workstations to Domain-User Right --Location: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment 4. Remove Unprivileged Users or Groups from the -dd Workstations to Domain-Policy 5. Delegate Computer Creation Permissions Only to Trusted Groups 6. Restrict -reate Computer Objects-and -elete Computer Objects-Permissions in AD 7. Implement Monitoring and Alerts for New Computer Account Creation 8. Educate Helpdesk and Admins on Proper Procedures 9. Test Changes by Attempting Computer Account Creation with Unprivileged Account 10. Regularly Review and Audit Computer Account Permissions Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | Service Accounts Supported Encryption Algorithms | High | 1 | Service account encryption types summary:1 | MITREANSSI | NO |
X
TEST NAME Service Accounts Supported Encryption Algorithms Description If addressed: Ensuring service accounts use strong, modern encryption algorithms protects credentials during authentication, reducing the risk of interception and unauthorized access. If not addressed: Use of weak or outdated encryption algorithms can lead to credential compromise through attacks such as downgrade or brute force, increasing the risk of account takeover and data breaches. Recommendation and Steps 1. Identify service accounts: List all service accounts in your environment that use encryption algorithms for authentication. 2. Audit supported encryption algorithms: Review current encryption protocols and algorithms allowed for these accounts. 3. Check for weak algorithms: Identify any use of deprecated or weak encryption methods (e.g., DES, RC4, MD5). 4. Update policy configurations: Configure domain policies, Group Policy, or application settings to enforce strong encryption algorithms (e.g., AES, SHA-2). 5. Upgrade legacy systems: Replace or update legacy systems or services that only support weak encryption. 6. Test compatibility: Ensure services and clients support and properly negotiate stronger encryption without disruption. 7. Deploy changes gradually: Roll out configuration changes in a controlled manner to prevent service interruptions. 8. Monitor authentication logs: Track authentication attempts and encryption negotiation to detect weak algorithm usage. 9. Educate administrators: Train IT staff on encryption standards and the importance of secure algorithms. 10.Regularly review and update Periodically re-audit encryption settings and algorithms to adapt to evolving security standards. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Smart Card Authentication Not Enforced for AD Users | High | 15137 | Users without smart card enforcement:15137 | MITREANSSI | NO |
X
TEST NAME Found Smart Card Authentication Not Enforced for AD Users Description If addressed: Enforcing smart card authentication adds an extra layer of security by requiring two-factor authentication, significantly reducing the risk of credential theft or reuse. If not addressed: Without smart card enforcement, users can authenticate with only a username and password, increasing exposure to phishing, credential stuffing, and brute-force attacks. Recommendation and Steps 1. Identify target users:Use tools like PowerShell or Active Directory Users and Computers (ADUC) to find users not configured to require smart card logon (e.g., SmartcardLogonRequired not set). 2. Verify infrastructure readiness:Ensure smart card readers and PKI infrastructure (e.g., Certificate Authority, OCSP responders) are properly configured and available. 3. Deploy user certificates:Issue smart card certificates to all applicable users via auto-enrollment or manual issuance from your enterprise CA. 4. Configure user accounts:In ADUC or via PowerShell, set the Smart card is required for interactive logon flag on user accounts.Set-ADUser username -SmartcardLogonRequired $true 5. Update Group Policies:Ensure Group Policy Objects (GPOs) enforce smart card login and appropriate certificate mapping (e.g., enable Interactive logon: Require smart card). 6. Test smart card logins:Validate that users can successfully authenticate using their smart cards and certificates on multiple systems. 7. Plan fallback mechanisms:Define emergency access procedures (e.g., break-glass accounts or temporary exemptions) in case of smart card loss or reader failure. 8. Monitor authentication attempts:Use event logs and SIEM tools to track smart card usage and failed logon attempts for auditing and anomaly detection. 9. Educate end users:Provide training and documentation on how to use smart cards, manage PINs, and handle lost or malfunctioning cards. 10. Enforce organization-wide rollout:Gradually enforce smart card logon for all applicable user accounts across departments, ensuring compliance with security policy. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Microsoft Defender Antivirus SmartScreen Disabled | High | 1 | Servers with SmartScreen disabled:1 | MITREANSSI | NO |
X
TEST NAME Found Servers with Microsoft Defender Antivirus SmartScreen Disabled Description If addressed: Enabling SmartScreen helps protect servers from phishing sites, malicious downloads, and unsafe apps by providing reputation-based warnings and blocking risky content. If not addressed: With SmartScreen disabled, users and processes are more likely to access or execute untrusted content, increasing the risk of malware infections, phishing attacks, and data breaches. Recommendation and Steps 1. Log in to the Target Server using an account with administrative rights. 2. Open the Local Group Policy Editor:Press Win + R, type gpedit.msc, and press Enter. 3. Navigate to SmartScreen Settings:Go to:Computer Configuration > Administrative Templates > Windows Components > File Explorer. 4. Configure the Setting Configure Windows Defender SmartScreen: -- Double-click the setting. -- Set it to Enabled. -- Under Options, select Require approval from an administrator before running downloaded unknown software. -- Click Apply, then OK. 5. Check SmartScreen for Microsoft Edge (if used on server):Go to:Computer Configuration > Administrative Templates > Microsoft Edge > SmartScreen Settings. 6. Enable Configure Microsoft Defender SmartScreen in Edge: -- Set it to Enabled to protect against malicious websites and downloads via the browser. 7. Force Group Policy Update:Open Command Prompt and run:gpupdate /force. 8. Verify SmartScreen Status: -- Use PowerShell to check SmartScreen:Get-MpPreference | Select-Object SmartScreenEnabled -- It should return 1 (Enabled). 9. Apply via Group Policy Object (for multiple servers): -- Open Group Policy Management Console (GPMC). -- Create or edit a GPO and apply the same settings from Steps 3-. -- Link the GPO to the appropriate Organizational Units (OUs). 10. Monitor SmartScreen Functionality: -Regularly audit with endpoint protection tools. Ensure Defender Antivirus logs show SmartScreen activity and are being forwarded to your SIEM (Security Information and Event Management) system. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Secure Boot Disabled | High | 1 | Servers with Secure Boot Disabled:1 | MITREANSSI | NO |
X
TEST NAME Found Servers with Secure Boot Disabled Description If addressed: Enabling Secure Boot ensures only trusted, signed bootloaders and OS kernels run during startup, protecting servers from bootkits, rootkits, and unauthorized firmware-level malware. If not addressed: Disabled Secure Boot leaves servers vulnerable to low-level malware infections that can persist across reboots and evade traditional security controls, leading to deep system compromise. Recommendation and Steps 1. Check Server Hardware Compatibility to confirm Secure Boot support (UEFI firmware required). 2. Backup Critical Data before making firmware changes to avoid accidental data loss. 3. Reboot the Server and Enter the UEFI/BIOS Setup:Usually by pressing Del, F2, or another manufacturer-specific key during POST. 4. Locate the Secure Boot Setting within the UEFI firmware menus (often under Security or Boot tabs). 5. Enable Secure Boot: --Change the Secure Boot setting from Disabled to Enabled. 6. Save and Exit UEFI/BIOS and allow the server to reboot. 7. Verify OS Compatibility: --Confirm the OS supports Secure Boot (Windows Server 2012 and later versions do). --Fix any boot errors by repairing boot files if necessary. 8. Update Firmware and Drivers to latest versions to ensure compatibility with Secure Boot. 9. Audit and Document Changes including the firmware version and Secure Boot status for compliance tracking. 10. Implement Monitoring: --Use system management tools to regularly check Secure Boot status. -lert on any unauthorized changes to Secure Boot settings. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Users With Empty Passwords | High | 15151 | Users With No Password Required:15151 | MITREANSSI | NO |
X
TEST NAME Found Users With Empty Passwords Description If addressed: Removing empty passwords enforces account security by requiring strong authentication, significantly reducing the risk of unauthorized access and compromise. If not addressed: Accounts with empty passwords are highly vulnerable to immediate exploitation, allowing attackers easy entry into systems and potentially leading to data breaches or privilege escalation. Recommendation and Steps 1. Identify all user accounts with empty passwords using tools like PowerShell or Active Directory queries. 2. Export a list of affected accounts for review. 3. Notify users and administrators about the security risk and planned password enforcement. 4. Enforce password policies requiring non-empty, complex passwords via Group Policy. 5. Force password resets for all accounts with empty passwords. 6. Use PowerShell or ADUC to set strong passwords or require users to change their passwords at next login. 7. Disable or lock accounts that cannot be immediately remediated. 8. Audit password policies and account settings to prevent creation of empty passwords in the future. 9. Educate users on password security best practices. 10. Implement continuous monitoring to detect any future accounts with empty or weak passwords. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Non-DC Servers with Unconstrained Delegation | High | 1 | Non-DC Servers with Unconstrained Delegation:1 | MITREANSSI | NO |
X
TEST NAME Found Non-DC Servers with Unconstrained Delegation Description If addressed: Removing unconstrained delegation from non-domain controller servers reduces the risk of credential theft and lateral movement attacks, strengthening overall network security. If not addressed: Servers with unconstrained delegation can be exploited by attackers to impersonate users and access sensitive resources, potentially leading to full domain compromise. Recommendation and Steps 1. Identify all non-domain controller servers configured with unconstrained delegation using tools like PowerShell or Active Directory queries. 2. Generate a report listing these servers and their delegation settings. 3. Notify IT and security teams about the risks and planned remediation. 4. Review whether unconstrained delegation is truly required for these servers. 5. Backup current server configurations before making changes. 6. Change delegation settings from unconstrained to either constrained delegation or disable delegation entirely: -- Open Active Directory Users and Computers (ADUC). -- Locate the server computer object. -- Right-click > Properties > Delegation tab. -- Select -rust this computer for delegation to specified services only-(constrained delegation) or -o not trust this computer for delegation- 7. Specify only required services for constrained delegation if applicable. 8. Apply and replicate changes across domain controllers. 9. Test applications and services relying on delegation to ensure they function correctly. 10. Implement ongoing monitoring to detect and prevent unauthorized delegation settings. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure GPO Setting Network security-Restrict NTLM-Outgoing NTLM traffic to remote servers is configured to DCs | High | 1 | Restrict NTLM Outgoing Traffic DC Setting:1 | MITREANSSI | NO |
X
TEST NAME Ensure GPO Setting Network security-Restrict NTLM-Outgoing NTLM traffic to remote servers is configured to DCs Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure GPO Setting compound authentication and Kerberos armoring is enabled for DCs | High | 1 | Kerberos Armoring for DCs:1 | MITREANSSI | NO |
X
TEST NAME Ensure GPO Setting compound authentication and Kerberos armoring is enabled for DCs Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure No vulnerabilities because of 2016-AD Prep | High | 1 | Enterprise Key Admins FullControl ACE:1 | MITREANSSI | NO |
X
TEST NAME Ensure No vulnerabilities because of 2016-AD Prep Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Domain Controllers have Auditing Policies configured | High | 1 | Domain Controllers Auditing Policies:1 | MITREANSSI | NO |
X
TEST NAME Ensure Domain Controllers have Auditing Policies configured Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure RODCs have read-only access to SYSVOL folder | High | 1 | RODC access to SYSVOL checked:1 | MITREANSSI | NO |
X
TEST NAME Ensure RODCs have read-only access to SYSVOL folder Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Recovery console-Allow automatic administrative logon GPO setting is turned off | High | 2 | Recovery Console Admin Logon Setting:2 | MITREANSSI | NO |
X
TEST NAME Ensure Recovery console-Allow automatic administrative logon GPO setting is turned off Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Denied RODC Password Replication Group includes default members | High | 8 | Denied RODC PRG missing members:8 | MITREANSSI | NO |
X
TEST NAME Ensure Denied RODC Password Replication Group includes default members Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure RIGHT_DS_LIST_OBJECT is correctly configured to enforce isolation between OUs | High | 1 | DS List Object Mode Enforcement:1 | MITREANSSI | NO |
X
TEST NAME Ensure RIGHT_DS_LIST_OBJECT is correctly configured to enforce isolation between OUs Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Admin Accounts have Emails configured | High | 1 | Admin Accounts Missing Email:1 | MITREANSSI | NO |
X
TEST NAME Ensure Admin Accounts have Emails configured Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure GPO Setting Turn off multicast name resolution is enabled to prevent LLMNR | High | 2 | Turn Off Multicast Name Resolution Setting:2 | MITREANSSI | NO |
X
TEST NAME Ensure GPO Setting Turn off multicast name resolution is enabled to prevent LLMNR Description Recommendation and Steps Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Computers with Unconstrained Delegation | High | 1 | Computers with Unconstrained Delegation:1 | MITREANSSI | NO |
X
TEST NAME Found Computers with Unconstrained Delegation Description If addressed: Removing unconstrained delegation from computer accounts mitigates the risk of attackers abusing these machines to impersonate any user and access sensitive resources, thereby enhancing overall domain security. If not addressed: Computers with unconstrained delegation can be exploited to perform unrestricted Kerberos delegation attacks, enabling attackers to move laterally and escalate privileges across the network. Recommendation and Steps 1. Identify all computer accounts configured with unconstrained delegation using PowerShell or Active Directory queries. 2. Generate a report listing affected computers and their delegation settings. 3. Notify IT security teams and system administrators about the risks and remediation plan. 4. Assess whether unconstrained delegation is necessary for each computer. 5. Backup Active Directory data and computer account settings before changes. 6. Modify the delegation settings for affected computer accounts: --Open Active Directory Users and Computers (ADUC). --Find and right-click the computer account > Properties > Delegation tab. --Select -rust this computer for delegation to specified services only-(constrained delegation) or -o not trust this computer for delegation-if delegation is not needed. 7. If delegation is required, configure constrained delegation by specifying only necessary services. 8. Apply the changes and ensure they replicate to all domain controllers. 9. Test functionality of applications and services running on the computers to confirm they operate correctly after changes. 10.Implement continuous monitoring and alerting for any delegation changes on computer accounts to maintain secure delegation practices. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Computers Without PowerShell Logging Enabled | High | 1 | Computers Without PowerShell Logging Enabled:1 | MITREANSSI | NO |
X
TEST NAME Computers Without PowerShell Logging Enabled Description If addressed: Enabling PowerShell logging improves visibility into script execution and command usage, aiding in early detection of malicious activities such as script-based attacks or unauthorized changes. If not addressed: Without PowerShell logging, malicious or unauthorized PowerShell activities can go unnoticed, increasing the risk of undetected attacks and complicating forensic investigations. Recommendation and Steps 1. Identify all computers without PowerShell logging enabled via Group Policy or endpoint management tools. 2. Notify IT and security teams about the importance of enabling PowerShell logging. 3. Backup current Group Policy Objects (GPOs) before making changes. 4. Create or modify a GPO to enable the following PowerShell logging settings: -- Script Block Logging -- Module Logging -- Transcription Logging 5. Apply the GPO to the Organizational Units (OUs) containing the target computers. 6. Force Group Policy update on target computers using gpupdate /force or via reboot. 7. Verify PowerShell logging is enabled by checking the registry or Event Viewer (under Microsoft-Windows-PowerShell/Operational). 8. Set up centralized log collection (e.g., via SIEM) for PowerShell logs to facilitate monitoring and alerting. 9. Train security teams to monitor and analyze PowerShell logs for suspicious activity. 10. Implement ongoing auditing and periodic review to ensure PowerShell logging remains enabled and effective. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | DC Computer Accounts with Unprivileged Owners | High | 1 | DC Computer Accounts with Unprivileged Owners:1 | MITREANSSI | NO |
X
TEST NAME DC Computer Accounts with Unprivileged Owners Description If addressed: Ensuring that only privileged and trusted administrators own Domain Controller (DC) computer accounts helps prevent unauthorized changes, enhancing the security and integrity of critical DC objects. If not addressed: If unprivileged users own DC computer accounts, they may modify sensitive attributes or permissions, potentially leading to privilege escalation, unauthorized access, or domain compromise. Recommendation and Steps 1. Identify DC computer accounts where the owner is an unprivileged user or group using PowerShell or AD auditing tools. 2. Export a report listing these DC accounts and their current owners. 3. Notify security and Active Directory administrators about the findings and risks. 4. Verify the appropriate privileged groups/users who should own DC computer accounts (e.g., Domain Admins). 5. Backup Active Directory and related objects before making changes. 6. Change ownership of affected DC computer accounts to a privileged group such as Domain Admins:Use PowerShell or Active Directory tools to set ownership. For example:$dcAccount Get-ADComputer -Identity DCComputerName$acl Get-Acl -Path AD:$($dcAccount.DistinguishedName)$acl.SetOwner([System.Security.Principal.NTAccount]DOMAIN\Domain Admins)Set-Acl -Path AD:$($dcAccount.DistinguishedName) -AclObject $acl 7. Review and remove any unauthorized permissions granted to unprivileged users on DC computer accounts. 8. Test domain controller operations to ensure no disruption after ownership changes. 9. Implement Group Policy and permissions best practices to restrict who can change ownership of DC accounts. 10. Establish continuous monitoring and alerting for changes in ownership or permissions on DC computer accounts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Domain Controllers vulnerable to MS17-010-Patch Status | High | 1 | Domain Controllers without MS17-010 patch:1 | MITREANSSI | NO |
X
TEST NAME Domain Controllers vulnerable to MS17-010-Patch Status Description If addressed: Patching MS17-010 vulnerability on Domain Controllers protects the network from critical exploits like EternalBlue, preventing ransomware attacks (e.g., WannaCry) and unauthorized remote code execution that could compromise the entire domain. If not addressed: Unpatched Domain Controllers remain highly susceptible to devastating attacks, enabling attackers to gain control over domain infrastructure, steal data, disrupt services, and propagate malware rapidly across the network. Recommendation and Steps 1. Identify all Domain Controllers vulnerable to MS17-010 using vulnerability scanners or Microsoft security tools. 2. Backup critical data and system state of all Domain Controllers before applying patches. 3. Notify IT, security teams, and stakeholders about the urgency of patching. 4. Download and test the relevant MS17-010 patches (KB4013389 or later) on a non-production environment. 5. Schedule maintenance windows to apply patches on all Domain Controllers to minimize disruption. 6. Apply the security patches to all Domain Controllers promptly. 7. Verify patch installation by checking system updates and running vulnerability scans again. 8. Restart Domain Controllers if required to complete patch installation. 9. Implement additional mitigations such as disabling SMBv1 protocol if still in use. 10.Establish continuous patch management and monitoring to prevent recurrence of similar vulnerabilities. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Domain Controllers vulnerable to MS14-068 | High | 1 | Domain Controllers without MS14-068 patch (KB3011780):1 | MITREANSSI | NO |
X
TEST NAME Domain Controllers vulnerable to MS14-068 Description If addressed: Applying the MS14-068 patch protects Domain Controllers from a critical Kerberos elevation of privilege vulnerability, preventing attackers from forging Kerberos tickets to gain unauthorized domain admin rights. If not addressed: Unpatched Domain Controllers remain vulnerable to attackers exploiting the flaw to elevate privileges, potentially leading to full domain compromise and persistent unauthorized access. Recommendation and Steps 1. Identify Domain Controllers missing the MS14-068 security update using vulnerability scans or system inventory tools. 2. Backup the system state and critical data of Domain Controllers before patching. 3. Notify IT and security teams about the vulnerability and planned remediation. 4. Download the MS14-068 patch (KB3011780 or relevant cumulative update) from Microsoft- official site. 5. Test the patch in a lab or staging environment to ensure compatibility and no service disruption. 6. Schedule a maintenance window to apply the patch on production Domain Controllers. 7. Apply the security update to all Domain Controllers promptly. 8. Verify the update was installed successfully by checking system update logs and using vulnerability scanners. 9. Restart Domain Controllers as required to finalize patch installation. 10.Establish ongoing patch management and monitoring to ensure Domain Controllers stay protected against Kerberos and other vulnerabilities. Associated Objects Per Domain/AD Forest
Affected Objects
|
| vuln3_rodc_denied_group
|
Denied RODC Password Replication Group missing Privileged Accounts | High | 8 | Total Missing Privileged Groups in Denied RODC Password Replication Group:8 | MITREANSSI | NO |
X
TEST NAME Denied RODC Password Replication Group missing Privileged Accounts Description If Addressed: Ensures privileged credentials are never cached on RODCs, reducing exposure If the RODC is compromised. If Not Addressed: Privileged account credentials Could be replicated and cached on RODCs, making them vulnerable to offline attacks. Recommendation and Steps Step 1: Open Active Directory Users and Computers on a Domain Controller.
Step 2: Enable Advanced Features from the View menu.
Step 3: Navigate to the container Users and find the group named:
Denied RODC Password Replication Group.
Step 4: Double-click the group to open its properties and go to the Members tab.
Step 5: Add all critical groups and privileged accounts, such as:
- Domain Admins
- Enterprise Admins
- Backup Operators
- Server Operators
- Account Operators
- Any other admin or elevated custom groups
Step 6: Click Apply and OK to save changes.
Step 7: Document the groups added for future auditing.
Step 8: Repeat the process in all domains having RODCs.
Step 9: Inform the security team about this change as a preventive security measure.
Step 10: Review and revalidate the group membership quarterly.
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_rodc_denied_group
|
| Microsoft-Recommended
|
Schema Admin Group members | High | 1 | Schema Admins Group contains members:1 | MITREANSSI | NO |
X
TEST NAME Schema Admin Group members Description If Addressed: Reduces risk of unauthorized schema changes by limiting membership to This powerful group. If Not Addressed: Active membership may be misused to modify AD schema, potentially leading to directory corruption or privilege abuse. Recommendation and Steps Step 1: Open Active Directory Users and Computers (ADUC). Step 2: Enable Advanced Features from the View menu. Step 3: Navigate to the Users container in the forest root domain. Step 4: Locate and double-click the group named Schema Admins. Step 5: Go to the Members tab and check the current users or groups listed. Step 6: Verify if any user currently needs schema modification rights (very rare). Step 7: If no schema update is in progress, remove all users from this group. Step 8: Click Apply and OK to save the changes. Step 9: Document the group state and reason for change. Step 10: Monitor regularly to ensure it remains empty unless absolutely required. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Missing Domain Zones Scavenging | High | 1 | Total Domain Zones Not Enabled with Scavenging:1 | Configuration | NO |
X
TEST NAME Missing Domain Zones Scavenging Description If Addressed: -Helps maintain clean and accurate DNS zones by removing outdated records. If Not Addressed: -Stale records may cause resolution failures, IP conflicts, or security issues due to outdated information. Recommendation and Steps Step 1: Open DNS Manager on the DNS server. Step 2: In the console tree, right-click the zone name (e.g., nmc.local) under Forward Lookup Zones, and select Properties. Step 3: Go to the General tab and click the Aging button. Step 4: Enable Scavenge stale resource records. Step 5: Set a suitable value for No-refresh interval and Refresh interval (default is 7 days each). Step 6: Click OK to apply changes and return to zone properties. Step 7: Now, go back to the DNS Manager, right-click on the server name, select Set Aging/Scavenging for All Zones. Step 8: In the dialog box, enable scavenging at the server level as well. Step 9: Monitor the zone for a few days to ensure scavenging works and doesn-t remove needed static records. Step 10: Document the change, including interval values and server settings. Step 11: Communicate to DNS and IT teams that scavenging is now enabled, and plan regular audits of DNS zones. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Partitions Backup Status | High | 5 | Total AD Partitions not backed up since last 7 days:5 | HealthCheck | NO |
X
TEST NAME AD Partitions Backup Status Description If NOT Addressed (No Regular AD Partition Backups): -Permanent loss of Active Directory data in case of corruption, deletion, or failure Unable to restore users, computers, GPOs, DNS records, or domain structure Increased downtime and recovery time during a disaster. -Higher risk of security breaches or compliance violations -No authoritative restore option available If Addressed (Regular Backups in Place): -Ability to recover from accidental deletion or corruption -Meets disaster recovery and compliance requirements -Supports authoritative/non-authoritative restores -Faster incident response and minimal disruption -Ensures data integrity and security Recommendation and Steps 1. Identify AD-Integrated Services to Backu -Include: -- NTDS.dit (AD database) -- SYSVOL -- DNS (if integrated) -- Group Policies -- Certificate Services (if installed) 2. Choose a Backup Tool -Use Windows Server Backup, DPM, Veeam, or other enterprise-grade backup software. 3. Install Windows Server Backup (if needed) -Run:Install-WindowsFeature Windows-Server-Backup 4. Plan Backup Frequency -Best practice: Daily full system state backup -Retain backups for at least 30 days 5. Configure System State Backup -Run:wbadmin start systemstatebackup -backuptarget:E: -quiet(Replace E: with backup volume/drive) 6. Schedule Automatic Backups -Use Task Scheduler or backup software to automate daily backups. 7. Store Backups Securely -Use a separate volume, network share, or cloud storage. -Ensure backup encryption and access control are in place. 8. Regularly Test Backup Integrity -Perform test restores to validate the backups are usable. 9. Document Backup Strategy -Maintain records of: -- Backup schedules -- Retention policies -- Recovery procedures 10. Monitor Backup Logs -eview logs or configure alerts for backup failures. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln1_permissions_adminsdholder
|
Orphaned Admins on AdminSDHolder | Passed | 0 | Total Possible Orphaned Admins in all Domains on AdminSDHolder object:0 | MITREANSSI | YES |
X
TEST NAME Orphaned Admins on AdminSDHolder Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_permissions_adminsdholder
|
| vuln1_privileged_members_perm vuln2_privileged_members_perm
|
Dangerous Permissions on AdminSDHolder | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Dangerous Permissions on AdminSDHolder Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_privileged_members_perm vuln2_privileged_members_perm
|
| vuln1_permissions_adminsdholder
|
AdminSDHolder was Modified in last 30 days | Passed | 0 | AdminSDHolder Object was modified in total domains:0 | MITREANSSI | YES |
X
TEST NAME AdminSDHolder was Modified in last 30 days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_permissions_adminsdholder
|
| vuln1_delegation_a2d2
|
Constrained delegation to domain controller service | Passed | 0 | Total Computers with Constrained Delegation in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Constrained delegation to domain controller service Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_delegation_a2d2
|
| vuln1_delegation_sourcedeleg
|
Resource-based constrained delegation on domain controllers | Passed | 0 | Total Computers with Resource-Based Delegation in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Resource-based constrained delegation on domain controllers Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_delegation_sourcedeleg
|
| vuln1_dsheuristics_bad
|
Anonymous Access to Active Directory | Passed | 0 | Anonymous Access To Active Directory:0 | MITREANSSI | YES |
X
TEST NAME Anonymous Access to Active Directory Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dsheuristics_bad
|
| Microsoft-Recommended
|
Found Hidden Domain Controllers | Passed | 0 | Total Hidden Domain Controllers:0 | MITREANSSI | YES |
X
TEST NAME Found Hidden Domain Controllers Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Successful Exploit Machine Accounts Found | Passed | 0 | Total Exploit Machine Accounts:0 | MITREANSSI | YES |
X
TEST NAME Successful Exploit Machine Accounts Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Possible User-based Service Accounts found | Passed | 0 | Total Possible User-Based Service Accounts:0 | MITREANSSI | YES |
X
TEST NAME Possible User-based Service Accounts found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Domain Trusts Found | Passed | Not Found | Domain Trusts Status:Not Found | MITREANSSI | YES |
X
TEST NAME Domain Trusts Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | Found Bitlocker Disabled Computers | Passed | 0 | Computers missing BitLocker Recovery Info in AD:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Computers Running Obsolete OS Versions | Passed | 0 | Computers running obsolete OS versions:0 | MITREANSSI | YES |
X
TEST NAME Found Computers Running Obsolete OS Versions Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Service Accounts With Unchanged Passwords | Passed | 0 | Service accounts with unchanged passwords:0 | MITREANSSI | YES |
X
TEST NAME Found Service Accounts With Unchanged Passwords Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Inactive Service Accounts | Passed | 0 | Inactive service accounts (>90 days):0 | MITREANSSI | YES |
X
TEST NAME Found Inactive Service Accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Computers With Anomalous Primary Group ID | Passed | 0 | Computers with incorrect PrimaryGroupID:0 | MITREANSSI | YES |
X
TEST NAME Found Computers With Anomalous Primary Group ID Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Computers With Unreadable Primary Group ID | Passed | 0 | Computers with unreadable or missing PrimaryGroupID:0 | MITREANSSI | YES |
X
TEST NAME Found Computers With Unreadable Primary Group ID Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Large Groups | Passed | 0 | AD Groups with >600 Members:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Shadow Admins | Passed | 0 | Accounts with powerful delegated rights:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Dangerous dsHeuristics Settings | Passed | 0 | Domains with dangerous dsHeuristics settings:0 | MITREANSSI | YES |
X
TEST NAME Found Dangerous dsHeuristics Settings Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Remote Desktop Drive Redirection Enabled | Passed | 0 | Servers with RDP Drive Redirection Enabled:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Remote Desktop Drive Redirection Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Remote Desktop Connections Allowed Without Password Prompt | Passed | 0 | Servers allowing RDP without password prompt:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Remote Desktop Connections Allowed Without Password Prompt Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Automatic Sign-in After Restart Enabled | Passed | 0 | Servers with Automatic Sign-in enabled:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Automatic Sign-in After Restart Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Backup Rights Assigned to Non-Administrators | Passed | 0 | Backup rights assigned to non-admin accounts:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Backup Rights Assigned to Non-Administrators Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Remote Desktop Client Saving Passwords | Passed | 0 | Remote Desktop Client Saving Passwords:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Remote Desktop Client Saving Passwords Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Print Driver Packages Downloaded Over HTTP | Passed | 0 | Print Driver Packages Downloaded Over HTTP:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Print Driver Packages Downloaded Over HTTP Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Servers with Internet Printing Enabled | Passed | 0 | Servers with Internet Printing Enabled:0 | MITREANSSI | YES |
X
TEST NAME Found Servers with Internet Printing Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Duplicate SamAccountNames | Passed | 0 | Duplicate SamAccountNames:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Duplicate UPNs | Passed | 0 | Duplicate UserPrincipalNames:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Duplicate Emails | Passed | 0 | Duplicate Email Addresses:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Authenticated Users can create DNS records | Passed | 0 | Authenticated Users Can Create DNS Records:0 | MITREANSSI | YES |
X
TEST NAME Found Authenticated Users can create DNS records Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Historical SIDs on User Accounts | Passed | 0 | User Accounts with Historical SIDs:0 | MITREANSSI | YES |
| Microsoft-Recommended | Found Sensitive Group Members with Oldest Password Age | Passed | 0 | Sensitive Group Members With Old Passwords:0 | MITREANSSI | YES |
X
TEST NAME Found Sensitive Group Members with Oldest Password Age Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Admin Accounts with Unprivileged Owners | Passed | 0 | Admin Accounts With Unprivileged Owners:0 | MITREANSSI | YES |
X
TEST NAME Found Admin Accounts with Unprivileged Owners Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found gMSAs With Passwords Older Than 60 Days | Passed | 0 | gMSAs With Passwords Older Than 60 Days:0 | MITREANSSI | YES |
X
TEST NAME Found gMSAs With Passwords Older Than 60 Days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Users With Passwords Older Than a Year | Passed | 0 | Users With Passwords Older Than One Year:0 | MITREANSSI | YES |
X
TEST NAME Found Users With Passwords Older Than a Year Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found users with Unconstrained Delegation | Passed | 0 | Users with Unconstrained Delegation:0 | MITREANSSI | YES |
X
TEST NAME Found users with Unconstrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Well Known Groups are not assigned Dangerious Privileges in GPOs. | Passed | 0 | Well Known Groups Dangerous Privileges:0 | MITREANSSI | YES |
X
TEST NAME Ensure Well Known Groups are not assigned Dangerious Privileges in GPOs. Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure no GPO is assigning Well Known Groups to Local Groups | Passed | 0 | Well-Known Groups assigned to Local Groups:0 | MITREANSSI | YES |
X
TEST NAME Ensure no GPO is assigning Well Known Groups to Local Groups Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure No GPOs are configured to allow LM Hash | Passed | 0 | LM Hash storage allowed:0 | MITREANSSI | YES |
X
TEST NAME Ensure No GPOs are configured to allow LM Hash Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Limit local account use of blank passwords to console logon only GPO Setting is enabled | Passed | 0 | LimitBlankPasswordUse Setting:0 | MITREANSSI | YES |
X
TEST NAME Ensure Limit local account use of blank passwords to console logon only GPO Setting is enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure wellKnownObjects has not been modified | Passed | 0 | Modified wellKnownObjects Locations:0 | MITREANSSI | YES |
X
TEST NAME Ensure wellKnownObjects has not been modified Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure SIDHistory is enabled for trusts | Passed | 0 | SIDHistory enabled trusts:0 | MITREANSSI | YES |
X
TEST NAME Ensure SIDHistory is enabled for trusts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Membership in Allowed RODC Password Replication Group is limited | Passed | 0 | Allowed RODC PRG unauthorized members:0 | MITREANSSI | YES |
X
TEST NAME Ensure Membership in Allowed RODC Password Replication Group is limited Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Dangerous Rights are detected on OUs and removed | Passed | 0 | Exploitable Delegation Rights on OUs:0 | MITREANSSI | YES |
X
TEST NAME Ensure Dangerous Rights are detected on OUs and removed Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Well Known Groups are not granted Dangerous Delegation on OUs | Passed | 0 | Well Known Groups granted Dangerous Delegation on OUs:0 | MITREANSSI | YES |
X
TEST NAME Ensure Well Known Groups are not granted Dangerous Delegation on OUs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Do not require Kerberos preauthentication is unchecked for Admin Accounts | Passed | 0 | Admin Accounts with 'Do not require Kerberos preauthentication' enabled:0 | MITREANSSI | YES |
X
TEST NAME Ensure Do not require Kerberos preauthentication is unchecked for Admin Accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure unixUserPassword and userPassword attributes are not set for user accounts | Passed | 0 | Users with unixUserPassword or userPassword attributes set:0 | MITREANSSI | YES |
X
TEST NAME Ensure unixUserPassword and userPassword attributes are not set for user accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Computers have changed their password in last 90 days | Passed | 0 | Computers with password older than 90 days:0 | MITREANSSI | YES |
X
TEST NAME Ensure Computers have changed their password in last 90 days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure DCs have no constrained Delegation | Passed | 0 | DCs with Constrained Delegation Configured:0 | MITREANSSI | YES |
X
TEST NAME Ensure DCs have no constrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure DCs have no constrained Delegation with Protocol Transition | Passed | 0 | DCs with Constrained Delegation & Protocol Transition:0 | MITREANSSI | YES |
X
TEST NAME Ensure DCs have no constrained Delegation with Protocol Transition Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Stale users have no permissions to modify Group Memberships | Passed | 0 | Stale Users Group Modify Permissions:0 | MITREANSSI | YES |
X
TEST NAME Ensure Stale users have no permissions to modify Group Memberships Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Non-Default Principals do not have DCShadow rights | Passed | 0 | Non-Default Principals With DCShadow Rights:0 | MITREANSSI | YES |
X
TEST NAME Ensure Non-Default Principals do not have DCShadow rights Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Misconfigured CA Certificates Found | Passed | 0 | CA Signing Certificate Misconfiguration:0 | MITREANSSI | YES |
X
TEST NAME Misconfigured CA Certificates Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Dangerous Certificate Authority ACLs Found | Passed | 0 | Dangerous CA ACLs:0 | MITREANSSI | YES |
X
TEST NAME Dangerous Certificate Authority ACLs Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure Admin Accounts do not have Unprivileged Owners | Passed | 0 | Admin Accounts With Unprivileged Owners:0 | MITREANSSI | YES |
X
TEST NAME Ensure Admin Accounts do not have Unprivileged Owners Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Computers with Resource-Based Constrained Delegation | Passed | 0 | Computers with Resource-Based Constrained Delegation:0 | MITREANSSI | YES |
X
TEST NAME Found Computers with Resource-Based Constrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Service Accounts Configured with Constrained Delegation | Passed | 0 | Service Accounts with Constrained Delegation:0 | MITREANSSI | YES |
X
TEST NAME Found Service Accounts Configured with Constrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Objects with msds-AllowedToDelegateTo Attribute Populated | Passed | 0 | Objects with msds-AllowedToDelegateTo attribute populated:0 | MITREANSSI | YES |
X
TEST NAME Found Objects with msds-AllowedToDelegateTo Attribute Populated Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs | Passed | 0 | Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs:0 | MITREANSSI | YES |
X
TEST NAME Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt | Passed | 0 | Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt account:0 | MITREANSSI | YES |
X
TEST NAME Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Resource-Based Constrained Delegation Enabled for KRBTGT | Passed | 0 | Resource-Based Constrained Delegation on KRBTGT Account:0 | MITREANSSI | YES |
X
TEST NAME Resource-Based Constrained Delegation Enabled for KRBTGT Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | NSPI Access Enabled | Passed | 0 | NSPI Access Enabled on Domain Controllers:0 | MITREANSSI | YES |
X
TEST NAME NSPI Access Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Foreign Security Principals in Administrative Groups | Passed | 0 | Foreign Security Principals in Administrative Groups:0 | MITREANSSI | YES |
X
TEST NAME Foreign Security Principals in Administrative Groups Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Outbound Trust with SID History Enabled | Passed | 0 | Outbound trusts with SID History enabled:0 | MITREANSSI | YES |
X
TEST NAME Outbound Trust with SID History Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure SDProp Process is Enabled for Critical Groups | Passed | 2 | SDProp Protection on Critical Groups:2 | MITREANSSI | YES |
X
TEST NAME Ensure SDProp Process is Enabled for Critical Groups Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Found Users using smart card with unchanged password for a long time | Passed | 0 | Smart Card Users with Old Passwords:0 | MITREANSSI | YES |
X
TEST NAME Found Users using smart card with unchanged password for a long time Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Users with AD Replication Permissions | Passed | 0 | Accounts with AD Replication Permissions:0 | MITREANSSI | YES |
X
TEST NAME Users with AD Replication Permissions Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Domain Controllers vulnerable to MS17-010 | Passed | 0 | Domain Controllers with SMBv1 Enabled:0 | MITREANSSI | YES |
X
TEST NAME Domain Controllers vulnerable to MS17-010 Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Certificate Templates Editable by Everyone | Passed | 0 | Templates with Insecure Permissions:0 | MITREANSSI | YES |
X
TEST NAME Certificate Templates Editable by Everyone Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Trusts SID Filtering Check | Passed | 0 | Trusts with SID Filtering Disabled:0 | MITREANSSI | YES |
X
TEST NAME Trusts SID Filtering Check Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Replication Errors DCs | Passed | 0 | Total DCS in Replication Errors:0 | HealthCheck | YES |
X
TEST NAME Replication Errors DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln3_rodc_allowed_group
|
Allowed RODC Password Replication Group is not empty | Passed | 0 | Total Members in RODC Replication Group:0 | MITREANSSI | YES |
X
TEST NAME Allowed RODC Password Replication Group is not empty Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_rodc_allowed_group
|
| vuln_password_change_msa_no_change_90
|
Managed service accounts with passwords unchanged for more than 90 days | Passed | 0 | Total Managed Service Accounts Password Unchanged Since last 90 days:0 | MITREANSSI | YES |
X
TEST NAME Managed service accounts with passwords unchanged for more than 90 days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_password_change_msa_no_change_90
|
| vuln3_rodc_never_reveal
|
msDS-NeverRevealGroupattribute RODC missing Privileged Accounts | Passed | 0 | Total Privileged Groups Not in PRP Denied List:0 | MITREANSSI | YES |
X
TEST NAME msDS-NeverRevealGroupattribute RODC missing Privileged Accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_rodc_never_reveal
|
| vuln1_dnszone_bad_prop vuln3_dnszone_bad_prop
|
Unsecure Updates Zones | Passed | 0 | Total DNS Zones accepting non-secure updates:0 | Configuration | YES |
X
TEST NAME Unsecure Updates Zones Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dnszone_bad_prop vuln3_dnszone_bad_prop
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? | |||||||
| vuln2_dont_expire
|
Users with LastPasswordSet was never Set | High | 15136 | Total Users with LastPasswordSet was never set in all Domains:15136 | MITREANSSI | NO |
X
TEST NAME Users with LastPasswordSet was never Set Description If Addressed: -Identifies accounts that never changed Passwords, helping enforce password policies and hygiene. If Not Addressed: -accounts may be using default or Stale Passwords, exposing the environment to brute-force or replay attacks. Recommendation and Steps Step 1: Open Active Directory Users and Computers (ADUC) on a domain controller. Step 2: From the top menu, click on View and enable Advanced Features. Step 3: Navigate to the Users container or the specific OU where user accounts are stored. Step 4: Manually inspect user properties (right-click user > Properties > Attribute Editor tab). Step 5: Check for the attribute pwdLastSet. If it's set to 0, the password has never been set. Step 6: Repeat for multiple users or coordinate with the AD team to get a filtered export. Step 7: Determine if these accounts are service, test, or dormant accounts. Step 8: For accounts not in use, disable them and monitor. Step 9: For accounts in use, enforce password change and ensure they are compliant with password policies. Step 10: Document the action taken and notify the concerned user/team. Step 11: Continue periodic auditing to avoid accumulation of such accounts. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_dont_expire
| ||||||
| vuln1_user_accounts_dormant
|
Users with PWDLastSet to ZERO | High | 15136 | Total Users with PWDLastSet to ZERO in all Domains:15136 | MITREANSSI | NO |
X
TEST NAME Users with PWDLastSet to ZERO Description If Addressed: -Forces these accounts to change Passwords and Ensures compliance with security policy. If Not Addressed: -these accounts may allow login without password changes, leading to extended password reuse and risk of compromise. Recommendation and Steps Step 1: Access Active Directory Users and Computers (ADUC). Step 2: Enable Advanced Features via the View menu. Step 3: Browse through the user OUs and review properties of each account. Step 4: In the Attribute Editor tab, check pwdLastSet. Step 5: If value is 0, it means the password has never been set. Step 6: Confirm whether the account is active and needed. Step 7: If not needed, disable and document the action. Step 8: If required, force a password change or notify the user. Step 9: Apply account policies to enforce periodic password changes. Step 10: Maintain a record for auditing purposes. Step 11: Include these checks in your regular health assessment. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_user_accounts_dormant
| ||||||
| vuln1_user_accounts_dormant
|
Stale User Accounts | High | 15136 | Total Stale User Accounts in all Domains:15136 | MITREANSSI | NO |
X
TEST NAME Stale User Accounts Description If Addressed: Reduces attack surface by disabling or removing unused accounts that may otherwise be exploited. If Not Addressed: dormant accounts may be leveraged for privilege escalation or persistence without detection Recommendation and Steps Step 1: Open Active Directory Users and Computers (ADUC) on a domain controller. Step 2: Click -View- from the menu and enable -Advanced Features-. Step 3: Right-click the domain > Find > Advanced tab > Field: Last Logon > Condition: Not within last 90 days. Step 4: Review and export the list of user accounts shown. Step 5: Verify with department heads or asset owners if those accounts are in use. Step 6: Temporarily disable identified stale accounts to monitor for any access issues. Step 7: If no issues occur for 30 days, proceed to delete the accounts. Step 8: Update documentation and AD inventory with disabled/deleted status. Step 9: Apply a scheduled task or tool to check stale users monthly. Step 10: Communicate and document stale account policy as part of AD governance. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_user_accounts_dormant
| ||||||
| vuln2_dont_expire
|
User Accounts Pass Never Expires | High | 1 | Total Users with Password Never Expires in all Domains:1 | MITREANSSI | NO |
X
TEST NAME User Accounts Pass Never Expires Description If Addressed: -Enforces regular password changes, improving password hygiene and reducing risk of password-based attacks. If Not Addressed: -Passwords may never be changed, increasing likelihood of compromise due to reuse or aging. Recommendation and Steps Step 1: Open ADUC and access the Organizational Unit (OU) containing the user accounts. Step 2: Right-click any user > Properties > Account tab. Step 3: Check if -Password Never Expires- is enabled. Step 4: If enabled, uncheck it for the user manually. Step 5: Repeat this process for all 992 accounts using a saved query or filtered view. Step 6: Inform affected users about upcoming password expiration enforcement. Step 7: Create a Group Policy Object (GPO) enforcing password expiration (e.g., 60 or 90 days). Step 8: Link the GPO to applicable OUs and test with a sample group. Step 9: Audit password expiration compliance through reports. Step 10: Monitor, enforce, and adjust policies periodically. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_dont_expire
| ||||||
| Microsoft-Recommended
|
Users Sending Bad Logons | Medium | 1 | Total Users sending Bad Logons in all Domains:1 | MITREANSSI | NO |
X
TEST NAME Users Sending Bad Logons Description If Not Addressed (Too Many Bad Logons Ignored): -May indicate brute-force attacks, compromised devices, or misconfigured services -potentially leading to account lockouts or breaches. If Addressed (Bad Logon Attempts Monitored): -Helps detect early signs of attacks or misconfigurations, enhances account security, and supports proactive incident response. Recommendation and Steps 1. Enable Advanced Audit Policy for Logon Events
AuditPol /set /subcategory:Logon /success:enable /failure:enable2. Use Event ID 4625 to Track Failed Logons
-Look for:
-- Account Name
-- Failure Reason
-- Caller Machine Name
3. Set Up Alerts or SIEM Rules for Excessive Attempts
-Threshold example: 5+ bad logons in 10 minutes
4. Identify Affected Users and Source Systems
-Use logs or tools like Microsoft Defender, Splunk, or Log Analytics.
5. Check for Misconfigured Services or Cached Credentials
-Especially on servers, scripts, or mapped drives using old passwords.
6. Educate Users on Lockout Causes and Password Hygiene
7. Enforce Account Lockout Policies
-Example (per CIS/Microsoft):
-- Lockout threshold: 5
-- Lockout duration: 15 minutes
8. Isolate and Scan Potentially Compromised Devices
9. Regularly Review Event Logs and Reports
Get-WinEvent -FilterHashtable @{LogName'Security'; ID4625}10. 10.Implement Rate Limiting or Smart Lockout (if using Azure AD)
Associated Objects Per Domain/AD Forest
Affected Objects
| ||||||
| vuln_user_accounts_dormant
|
Users Disabled | Medium | 9 | Total Disabled Users in all Domains:9 | MITREANSSI | NO |
X
TEST NAME Users Disabled Description If Addressed: Enhances security by isolating disabled accounts Improves AD organization and simplifies audits Reduces risk of accidental reactivation or misuse If Not Addressed: Disabled user accounts may remain scattered and unmanaged Increases risk of unauthorized access or misconfiguration Causes clutter and confusion in Active Directory Recommendation and Steps 1. Open PowerShell with Active Directory module
- Run as a user with sufficient AD permissions.
2.Identify disabled user accounts
-Get-ADUser -Filter 'Enabled -eq $False'
3. Export the list (optional) for reviewGet-- -ADUser -Filter 'Enabled -eq $False' | Export-Csv DisabledUsers.csv -NoTypeInformation
4. Review with HR or managers
-Confirm that the disabled accounts are not needed anymore.
5. Create a dedicated OU for disabled users if not already in place
- Example: OUDisabledUsers,DCyourdomain,DCcom
6. Set proper permissions on the OU
-Limit access to prevent accidental reactivation or deletion.
7. Move the disabled users to the OUGet-ADUser -Filter 'Enabled -eq $False' | ForEach-Object { Move-ADObject -Identity $_.DistinguishedName --TargetPath OUDisabledUsers,DCyourdomain,DCcom}
8. Verify the move
Check in ADUC or run a query to confirm location.
9. Update internal documentation
-Record OU details and procedures for audits and IT teams.
10. Schedule regular reviews
-Automate or document a monthly/quarterly review of disabled users.
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_user_accounts_dormant
| ||||||
| vuln1_spn_priv
|
Users with SPNs Configured | Passed | 0 | Total Users with SPN defined in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users with SPNs Configured Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_spn_priv
| ||||||
| vuln_smartcard_expire_passwords
|
Password Expiration is missing for smart card users | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Password Expiration is missing for smart card users Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_smartcard_expire_passwords
| ||||||
| Microsoft-Recommended
|
Accounts vulnerable to Kerberoasting Found | Passed | 0 | Total Kerberoasting Accounts Found:0 | MITREANSSI | YES |
X
TEST NAME Accounts vulnerable to Kerberoasting Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| vuln2_kerberos_properties_deskey
|
Users With DES encryption | Passed | 0 | Total Users with DES Encryption in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users With DES encryption Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_kerberos_properties_deskey
| ||||||
| vuln3_reversible_password
|
Users With Reversible Encryption | Passed | 0 | Total Users with Reversible Encryption set in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users With Reversible Encryption Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_reversible_password
| ||||||
| vuln1_kerberos_properties_preauth_priv vuln2_kerberos_properties_preauth
|
Users With Kerberos Pre-Authentication | Passed | 0 | Total Pre-Authentication Users in all domains:0 | MITREANSSI | YES |
X
TEST NAME Users With Kerberos Pre-Authentication Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_kerberos_properties_preauth_priv vuln2_kerberos_properties_preauth
| ||||||
| vuln3_primary_group_id_nochange vuln1_primary_group_id_1000
|
Users Modified with PrimaryGroupID | Passed | 0 | Total Users with PrimaryGroupID Modified in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users Modified with PrimaryGroupID Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_primary_group_id_nochange vuln1_primary_group_id_1000
| ||||||
| Microsoft-Recommended
|
Users Expired | Passed | 0 | Total Expired Users in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users Expired Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| vuln2_dont_expire
|
User Accounts Pass Not Required | Passed | 0 | Total Users with Password Not Required set in all Domains:0 | MITREANSSI | YES |
X
TEST NAME User Accounts Pass Not Required Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_dont_expire
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| vuln1_spn_priv
|
Computers with SPNs Configured | Passed | 0 | Total Computers using ServicePrincipalNames in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computers with SPNs Configured Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_spn_priv
|
| vuln2_delegation_t4d
|
Computers With Unconstrained Delegation | Passed | 0 | Total Computers with Unconstrained Delegation in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computers With Unconstrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_delegation_t4d
|
| vuln3_primary_group_id_nochange vuln1_primary_group_id_1000
|
Computers Modified with PrimaryGroupID | Passed | 0 | Total Computers modified with PrimaryGroupID:0 | MITREANSSI | YES |
X
TEST NAME Computers Modified with PrimaryGroupID Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_primary_group_id_nochange vuln1_primary_group_id_1000
|
| Microsoft-Recommended
|
Computers Sending Bad Logons | Passed | 0 | Total Computers sending Bad Logon Attempts in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computers Sending Bad Logons Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| vuln_user_accounts_dormant
|
Computers Disabled | Passed | 0 | Total Disabled Computer Accounts in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computers Disabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_user_accounts_dormant
|
| vuln1_user_accounts_dormant
|
Stale Computer Accounts | Passed | 0 | Total Stale Computer Accounts in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Stale Computer Accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_user_accounts_dormant
|
| Microsoft-Recommended
|
Unsupported Operating Systems | Passed | 0 | Total End Of Life-Unsupported Operating Systems:0 | Configuration | YES |
X
TEST NAME Unsupported Operating Systems Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Admins Sending Bad Logons | Critical | 1 | Total Privileged Users With Bad Logon Attempts:1 | MITREANSSI | NO |
X
TEST NAME Admins Sending Bad Logons Description If Addressed: -Identifies misconfigured services or outdated credentials using privileged accounts, helping secure them and reduce unnecessary log failures. If Not Addressed: -Frequent failed logons from privileged accounts can increase attack surface, trigger account lockouts, and obscure brute-force attempts Recommendation and Steps Step 1: Open Event Viewer on a domain controller or the relevant system. Step 2: Navigate to Windows Logs > Security. Step 3: Use the Filter Current Log option and filter by Event ID 4625 (Failed Logon). Step 4: In the filter results, look for entries where the account name matches the privileged/admin account mentioned in the report. Step 5: Review the Failure Reason, Logon Type, and Caller Process Name fields in the event details. Step 6: Determine the source machine/IP where the failed logon attempt originated. Step 7: Check if this is due to: -A saved credential on a service or scheduled task -An outdated password cached on a device -Manual mistyped attempts by a user Step 8: If it-s a service or task, update the stored credentials with the correct password. Step 9: If it's a cached password, remove or update it in Credential Manager or related configuration. Step 10: If the logon failure is suspicious, consider alerting your security team for further investigation. Step 11: Monitor the logs to confirm that bad logon attempts have stopped. Associated Objects Per Domain/AD Forest
Affected Objects
|
| vuln1_spn_priv
|
Admins with SPNs Configured | Passed | 0 | Total Admin Accounts With ServicePrincipalName Identified:0 | MITREANSSI | YES |
X
TEST NAME Admins with SPNs Configured Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_spn_priv
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| vuln1_permissions_dc
|
Domain Controllers not owned by Admins | Passed | 0 | Total Domain Controllers owned by non-privileged accounts:0 | Configuration | YES |
X
TEST NAME Domain Controllers not owned by Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_permissions_dc
|
| vuln3_owner
|
Computer Objects not managed by Admins | Passed | 0 | Total Computers Not Managed By Admins in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computer Objects not managed by Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| vuln3_owner
|
Organizational Units not managed by Admins | Passed | 0 | Total Organizational Units Not Managed By Admins:0 | MITREANSSI | YES |
X
TEST NAME Organizational Units not managed by Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Sensitive GPOs Modified | Passed | Not Modified | Sensitive GPOs Status in Last 10 Days:Not Modified | MITREANSSI | YES |
X
TEST NAME Sensitive GPOs Modified Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Recently Created Privileged Admins | Passed | 0 | Total Privileged Accounts created in last 10 days in all domains:0 | MITREANSSI | YES |
X
TEST NAME Recently Created Privileged Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Changes to Privileged Groups in Last 15 days | Passed | 0 | Total Privileged Groups Modified in Last 15 Days in All Domains:0 | MITREANSSI | YES |
X
TEST NAME Changes to Privileged Groups in Last 15 days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Users Identified with Privileged SIDs in sIDHistory | Passed | 0 | Total Users containing Admin Accounts in sIDHistory in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Users Identified with Privileged SIDs in sIDHistory Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Computers Identified with Privileged SIDs in sIDHistory | Passed | 0 | Total Computers containing Admin Accounts in sIDHistory in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Computers Identified with Privileged SIDs in sIDHistory Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Found Excluded Groups by AdminSDHolder and SDProp | Passed | 0 | Total Excluded Groups by SDProp Process:0 | MITREANSSI | YES |
X
TEST NAME Found Excluded Groups by AdminSDHolder and SDProp Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
krbtgt Account with Resource-Based Constrained Delegation | Passed | 0 | Affected number of Domains:0 | MITREANSSI | YES |
X
TEST NAME krbtgt Account with Resource-Based Constrained Delegation Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Built-In Admin Account Not protected | High | 1 | Default Administrator Account not protected in all domains:1 | MITREANSSI | NO |
X
TEST NAME Built-In Admin Account Not protected Description If Not Addressed: The default Administrator account is a prime target for attackers; if unprotected, it can lead to unauthorized access and full domain compromise. If Addressed: Protecting this account reduces risk of brute force attacks, unauthorized use, and strengthens overall domain security. Recommendation and Steps 1. Rename the Default Administrator Account --Change the account name to a non-obvious name to avoid targeted attacks. 2. Set a Strong, Complex Password --Use a long, complex password following best practices and store it securely. 3. Disable the Account if Not in Use --If possible, disable the account and use other delegated admin accounts. 4. Enable Account Lockout Policy --Configure lockout thresholds to prevent brute force attempts. 5. Limit Logon Hours and Workstations --Restrict when and where the account can be used. 6. Audit and Monitor Account Usage --Enable detailed logging and review all Administrator account activities. 7. Implement Multi-Factor Authentication (MFA) --Enforce MFA on the Administrator account wherever possible. 8. Restrict Group Memberships --Ensure the Administrator account is not added to unnecessary groups. 9. Review and Remove Unnecessary Privileges --Minimize privileges to the essential level required. 10. Document and Regularly Review Account Protection Policies --Keep records of changes and audit protection measures routinely. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Built-In Admin Account Not Disabled | High | 1 | Default Admin Account not disabled in Total Domains:1 | MITREANSSI | NO |
X
TEST NAME Built-In Admin Account Not Disabled Description If Addressed: disabling the default admin account Reduces exposure to well-known credentials and brute-force attacks. If Not Addressed: attackers may target the default Administrator account as It exists in every domain and cannot be renamed without disabling it. Recommendation and Steps Step 1: Open ADUC and locate the default -Administrator- account. Step 2: Right-click the account > Properties > General tab. Step 3: In the -Account Options-, check -Account is disabled-. Step 4: Apply and confirm that the account is disabled. Step 5: If disabling is not feasible, ensure it is renamed and restricted. Step 6: Remove any unnecessary group memberships. Step 7: Enable login auditing for this account. Step 8: Monitor for any login attempts and generate alerts. Step 9: Document the rationale for keeping or disabling the account. Step 10: Review policy quarterly to determine if account can be permanently retired. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Built-In Admin Account Not Renamed | High | 1 | Default Admin Account not renamed in Total Domains:1 | MITREANSSI | NO |
X
TEST NAME Built-In Admin Account Not Renamed Description If Addressed: Renaming the default admin account adds a layer of obscurity and makes brute-force attacks more difficult. If Not Addressed: attackers can directly target the default -Administrator- username, making It easier to attempt password guessing or exploit attempts. Recommendation and Steps Step 1: In ADUC, locate the built-in Administrator account. Step 2: Right-click the account and choose -Rename-. Step 3: Assign a unique name that does not reveal its purpose (e.g., SysMgmt_001). Step 4: Press Enter and confirm the rename. Step 5: Notify the security team of the change for monitoring purposes. Step 6: Ensure that the renamed account still has required access if active. Step 7: Apply logon restrictions or login hours if applicable. Step 8: Log and document the name change in the AD change log. Step 9: Update internal access control documentation. Step 10: Audit renamed accounts monthly to confirm no reversal or duplicates Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Built-In Admin Account Password Not Changed in 90 days | High | 1 | Total Domains in which Default Administrator password not changed since last 90 days:1 | MITREANSSI | NO |
X
TEST NAME Built-In Admin Account Password Not Changed in 90 days Description If Addressed: Enforces password rotation for the most powerful account in the domain, improving security hygiene. If Not Addressed: Stale Passwords increase the risk of compromise through replay, brute-force, or previously leaked credentials. Recommendation and Steps Step 1: Open the Local Users and Groups console on the domain controller. Step 2: Locate the built-in Administrator account. Step 3: Right-click and select -Set Password-. Step 4: Choose a strong, complex password that meets policy. Step 5: Store the new password in a secure vault (e.g., Bitwarden, CyberArk). Step 6: Inform authorized personnel of the change securely. Step 7: Apply a reminder or policy to change the password every 60-90 days. Step 8: Confirm that services using the account (if any) still function. Step 9: Monitor logs for any failed logins post-change. Step 10: Document the update in privileged account tracking sheets Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Built-In Admin Account was used in last 10 days | High | 1 | Total Domains in which Default Administrator account was used in last 10 days:1 | MITREANSSI | NO |
X
TEST NAME Built-In Admin Account was used in last 10 days Description If Addressed: Usage of the built-in admin can be restricted or monitored more closely to encourage use of named accounts for accountability. If Not Addressed: Unmonitored use may hide malicious activity, as the account lacks personal attribution. Recommendation and Steps Step 1: Open Event Viewer > Security Logs. Step 2: Filter for Event ID 4624 and 4625 and find entries tied to the built-in admin. Step 3: Identify the source IP, computer, and user involved in the logon. Step 4: Confirm whether the login was legitimate and approved. Step 5: If unauthorized, initiate a security investigation. Step 6: Disable or rename the built-in account immediately if not required. Step 7: Restrict account use to break-glass emergencies only. Step 8: Setup real-time alerts on usage of this account. Step 9: Require documentation and dual-authorization for any future use. Step 10: Review access policies to reduce dependency on built-in accounts. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Guest Account is not renamed | High | 1 | Guest Account not renamed in Total Domains:1 | MITREANSSI | NO |
X
TEST NAME Guest Account is not renamed Description If Addressed: Renaming the Guest account Helps prevent automated attacks that target default account names. If Not Addressed: Guest accounts may be exploited for unauthorized access, especially If enabled and Not monitored. Recommendation and Steps Step 1: Open ADUC and locate the -Guest- account. Step 2: Right-click the account > Rename. Step 3: Use a non-identifiable name like svc_guest001. Step 4: Apply and confirm the name change. Step 5: Disable the account if not needed. Step 6: Remove group memberships and restrict permissions. Step 7: Set a blank or complex password to lock out interactive use. Step 8: Monitor logs for attempts to use this account. Step 9: Inform IT security team of account status. Step 10: Include guest account checks in audit reviews. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln2_krbtgt
|
KRBTGT Account Password Not Changed | Passed | 0 | Total Domains Using KRBTGT Old Password:0 | MITREANSSI | YES |
X
TEST NAME KRBTGT Account Password Not Changed Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Guest Account is enabled | Passed | 0 | Total Guest Accounts Enabled in All Domains:0 | MITREANSSI | YES |
X
TEST NAME Guest Account is enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | Administrator Account ServicePrincipalNames Found | Passed | 0 | Total AD Domains Affected:0 | MITREANSSI | YES |
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Misconfigured Administrative Accounts Found | Critical | 4 | Total Admins Misconfigured:4 | MITREANSSI | NO |
X
TEST NAME Misconfigured Administrative Accounts Found Description If Addressed: Enabling -sensitive and cannot be delegated- Prevents admin credentials from being Exposed during delegation, significantly strengthening security for privileged accounts. If Not Addressed: admin credentials may be Exposed through delegation, increasing the risk of credential theft and lateral movement by attackers Recommendation and Steps Step 1: Open Active Directory Users and Computers (ADUC) on a domain controller or administrative system. Step 2: Click on the View menu and ensure Advanced Features is checked. Step 3: Browse to the admin accounts listed in Sheet2 of the report. Step 4: Right-click each account and select Properties. Step 5: Go to the Account tab. Step 6: Tick the checkbox Account is sensitive and cannot be delegated. Step 7: Click Apply and then OK to save the change. Step 8: Initially, perform this change for only 1-2 admin accounts. Step 9: Wait for one week and monitor to ensure there are no application or authentication issues. Step 10: If no issues are reported, proceed to apply the same setting to all remaining misconfigured admin accounts. Step 11: Document changes and update your security baseline documentation. Step 12: Notify relevant teams that delegation restrictions are in place for admin accounts. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln2_privileged_members_password
|
Weak Password Policies Affected Admins | Critical | 2 | Total Privileged Account using Weak Password Policy:2 | MITREANSSI | NO |
X
TEST NAME Weak Password Policies Affected Admins Description If addressed: Enforcing strong password policies for privileged users significantly reduces the risk of account compromise through brute force, guessing, or credential theft, thereby protecting critical systems and data. If not addressed: Weak passwords on privileged accounts increase vulnerability to attacks, potentially leading to unauthorized access, privilege escalation, and full domain or system compromise. Recommendation and Steps 1. Define Strong Password Requirements: Establish clear criteria including length, complexity (uppercase, lowercase, numbers, symbols), and expiration policies for privileged accounts. 2. Identify Privileged Users: Create a list of all privileged accounts that require enforcement of strong password policies. 3. Review Current Password Policies: Audit current domain or system password policies applied to privileged users to identify gaps. 4. Enforce Password Policy via Group Policy: Configure and apply Group Policy Objects (GPOs) or equivalent controls to enforce strong password settings for privileged users. 5. Implement Multi-Factor Authentication (MFA): Require MFA for all privileged accounts to add an additional layer of security beyond passwords. 6. Educate Privileged Users: Train users on the importance of strong passwords and best practices for password management. 7. Regularly Monitor Password Compliance: Use auditing tools to verify privileged accounts comply with password policies. 8. Implement Account Lockout Policies: Configure lockout thresholds to prevent brute force attempts against privileged accounts. 9. Enforce Regular Password Changes: Set password expiration policies to require periodic changes for privileged accounts. 10. Document and Review: Maintain documentation of password policies, enforcement actions, and periodically review the effectiveness of these measures. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_privileged_members_password
|
| vuln3_protected_users
|
Missing Privileged Groups in Protected Users Group | High | Not In Use | Total Missing Privileged Groups in Protected Users Group:Not In Use | MITREANSSI | NO |
X
TEST NAME Missing Privileged Groups in Protected Users Group Description If Addressed: Adding privileged groups to the protected Users group disables legacy authentication and Enhances credential protection. If Not Addressed: privileged accounts remain Exposed to weaker protocols (NTLM, DES) and ticket forwarding. Recommendation and Steps Step 1: Open ADUC > Find the -Protected Users- group in the domain. Step 2: Right-click > Properties > Members tab. Step 3: Click Add > enter names of Domain Admins and Enterprise Admins. Step 4: Confirm these users do not rely on legacy protocols (NTLM, DES). Step 5: Test user login and access to services to ensure compatibility. Step 6: Monitor for login issues and audit log events. Step 7: Educate admins on limitations and security benefits of this group. Step 8: Retain a list of privileged users added for documentation. Step 9: Review Protected Users group membership quarterly. Step 10: Enforce policy to include all new Tier 0 admins in this group. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_protected_users
|
| vuln_privileged_members
|
Too Many Privileged Accounts | High | 1 | Affected AD Domains:1 | MITREANSSI | NO |
X
TEST NAME Too Many Privileged Accounts Description If Addressed: Reduces attack surface by ensuring only required Users have administrative privileges. If Not Addressed: Excess privileged accounts increase the chance of misuse, misconfiguration, or compromise. Recommendation and Steps Step 1: Open ADUC and navigate to privileged groups like Domain Admins, Enterprise Admins. Step 2: Review membership list and identify non-essential users. Step 3: Engage with department heads to validate access needs. Step 4: Remove unnecessary accounts and document justifications. Step 5: Create separate groups for delegation instead of direct admin access. Step 6: Introduce role-based access control (RBAC) for fine-grained permissions. Step 7: Implement Just-In-Time (JIT) admin solutions if available. Step 8: Audit group memberships weekly using internal tools. Step 9: Maintain a privileged user registry with access history. Step 10: Review privileged access policy annually. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_privileged_members
|
| vuln1_password_change_priv
|
Passwords Not Changed within 90 days | High | 4 | Total Admin Accounts Did Not Change Their Passwords Since Last 90 Days:4 | MITREANSSI | NO |
X
TEST NAME Passwords Not Changed within 90 days Description If Addressed: Improves overall password hygiene by enforcing rotation policies, reducing the risk of Old password exposure. If Not Addressed: Long-standing Passwords are more likely to be guessed or already leaked, exposing accounts to compromise. Recommendation and Steps Step 1: Open ADUC and locate all users under privileged OUs or groups. Step 2: Go to Attribute Editor > pwdLastSet and check the date of last password update. Step 3: Filter accounts with passwords not changed in the last 90 days. Step 4: Communicate with the account owners to update their passwords immediately. Step 5: For unresponsive or shared admin accounts, reset the passwords manually. Step 6: Document the password change with timestamp and person responsible. Step 7: Enforce password expiry policy via Group Policy for admin OUs. Step 8: Enable alerting for overdue password changes. Step 9: Provide secure password storage methods if needed (e.g., password vault). Step 10: Monitor this metric monthly as part of privileged access review. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_password_change_priv
|
| vuln1_dont_expire_priv
|
Password Do Not Expire | High | 4 | Total Admin Accounts set to PasswordNeverExpires:4 | MITREANSSI | NO |
X
TEST NAME Password Do Not Expire Description If Addressed: Forces regular password changes for admin accounts, reducing the risk of password-based attacks. If Not Addressed: admin credentials remain unchanged for extended periods, increasing the chance of exposure and compromise. Recommendation and Steps Step 1: Open ADUC and locate privileged users (Domain Admins, etc.). Step 2: Right-click user > Properties > Account tab. Step 3: Check if -Password Never Expires- is enabled. Step 4: Uncheck this setting for each account unless there's an approved exception. Step 5: Communicate the change to each user and provide a timeline for password reset. Step 6: Create a GPO for privileged OUs to enforce password expiry (e.g., 60 days). Step 7: Implement a strong password policy: complexity, history, and minimum age. Step 8: Monitor privileged account status weekly using reports. Step 9: Log all changes in a privileged account tracking system. Step 10: Establish a monthly audit routine for privilege-based password settings. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dont_expire_priv
|
| vuln2_dont_expire
|
Privileged Accounts Pass Never Expires | Passed | 0 | Total Privileged Accounts set to Password Never Expire in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Privileged Accounts Pass Never Expires Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_dont_expire
|
| vuln1_user_accounts_dormant
|
Inactive Admins | Passed | 0 | Total Enabled Admin Accounts Not In Use Since Last 30 Days:0 | MITREANSSI | YES |
X
TEST NAME Inactive Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_user_accounts_dormant
|
| vuln1_privileged_members
|
Privileged Groups Contain more than 20 members | Passed | 0 | Privileged Groups Contain More than 20 members:0 | MITREANSSI | YES |
X
TEST NAME Privileged Groups Contain more than 20 members Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| vuln1_kerberos_properties_preauth_priv
|
Kerberos Pre-authentication Disabled | Passed | 0 | Total Pre-Authentication Admins in all domains:0 | MITREANSSI | YES |
X
TEST NAME Kerberos Pre-authentication Disabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_kerberos_properties_preauth_priv
|
| Microsoft-Recommended
|
Disabled Admins part of Privileged Groups | Passed | 0 | Total Disabled Admins In Privileged Groups:0 | MITREANSSI | YES |
X
TEST NAME Disabled Admins part of Privileged Groups Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln1_dnsadmins and vuln1_permissions_msdn
|
DNSAdmins Group has members | Passed | 0 | Total Members In DNSAdmins Group In All Domains:0 | MITREANSSI | YES |
X
TEST NAME DNSAdmins Group has members Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dnsadmins and vuln1_permissions_msdn
|
| Microsoft-Recommended
|
Privileged Groups Contained Computer Accounts | Passed | 0 | Total computer accounts part of privileged groups:0 | MITREANSSI | YES |
X
TEST NAME Privileged Groups Contained Computer Accounts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Privileged Admins missing AdminCount=1 Flag | Passed | 0 | Total Admins not set with AdminCount=1 flag in all domains:0 | MITREANSSI | YES |
X
TEST NAME Privileged Admins missing AdminCount=1 Flag Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
ForeignSecurityPrincipals In Privileged Groups | Passed | 0 | Total ForeignSecurityPrincipal in Privileged Groups:0 | MITREANSSI | YES |
X
TEST NAME ForeignSecurityPrincipals In Privileged Groups Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Operators Groups are not empty | Passed | 0 | Operators Groups containing total members in all domains:0 | MITREANSSI | YES |
X
TEST NAME Operators Groups are not empty Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
AdminsCount Flag set users not acting as Admins | Passed | 0 | Total Unknown Admins Found:0 | MITREANSSI | YES |
X
TEST NAME AdminsCount Flag set users not acting as Admins Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| vuln2_privileged_members_password
|
Default Domain Policy-Minimum Password Length | High | 1 | Account Policies Not Configured correctly in Total Domains:1 | Configuration | NO |
X
TEST NAME Default Domain Policy-Minimum Password Length Description If Not Addressed (Policies Misconfigured or Weak): -Increases the risk of unauthorized access, brute-force attacks, and non-compliance with security standards (e.g., ISO, NIST, CIS). If Addressed (Policies Correctly Set): -Enforces strong authentication controls, improves domain-wide security posture, and ensures regulatory compliance. Recommendation and Steps 1. Open Group Policy Management Console (GPMC) -Navigate to:Default Domain Policy - Computer Configuration - Windows Settings - Security Settings - Account Policies 2. Review the Following Key Settings: -Password Policy -Account Lockout Policy -Kerberos Policy 3. Compare Current Settings with Best Practices -Example CIS or Microsoft Baselines: -- Minimum password length: 14 characters -- Lockout after 5 failed attempts -- Lockout duration: 15 minutes -- Password history: 24 passwords remembered 4. Document Existing Policy Configuration 5. Backup the Default Domain Policy (DDP) Backup-GPO -Name Default Domain Policy -Path C:\GPOBackup 6. Modify Settings According to Best Practices -Apply via the Default Domain Policy for domain-wide effect. 7. Apply GPO Updates to Domain Controllers gpupdate /force 8. Verify Policy Is Being Enforced rsop.msc Or: gpresult /r 9. Monitor for Authentication or Lockout Issues 10. Schedule Periodic Policy Reviews and Audits Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_privileged_members_password
|
| vuln2_privileged_members_password
|
FGPP Policies-Minimum Password Length | High | Not Created | FGPP Not Configured Correctly In Domains:Not Created | Configuration | NO |
X
TEST NAME FGPP Policies-Minimum Password Length Description If Addressed: -Improves password complexity enforcement for privileged Users through Fine-Grained password Policies. If Not Addressed: -Weak or short Passwords may still be used by privileged accounts, reducing password strength and security. Recommendation and Steps Step 1: Open Active Directory Administrative Center (ADAC). Step 2: Navigate to the domain node and expand -System > Password Settings Container-. Step 3: Right-click and select -New > Password Settings-. Step 4: Set name (e.g., -AdminPasswordPolicy-) and enter minimum password length (e.g., 14). Step 5: Set complexity, lockout, history, and expiration options as per organization policy. Step 6: In -Directly Applies To-, add privileged user accounts or admin groups. Step 7: Click OK to create the FGPP (Fine-Grained Password Policy). Step 8: Confirm that the policy appears under Password Settings Container. Step 9: Document the FGPP creation and assigned scope. Step 10: Audit and adjust policy as organization security requirements evolve. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_privileged_members_password
|
| Microsoft-Recommended
|
FGPP Policies Not Applying | High | Not Created | Total FGPP Not Applying in All Domains:Not Created | Configuration | NO |
X
TEST NAME FGPP Policies Not Applying Description If Addressed: -Ensures the defined password policies are enforced correctly on targeted Users or groups. If Not Addressed: -Policy misapplication may lead to inconsistent password enforcement and weaker protection. Recommendation and Steps Step 1: Open ADAC and navigate to the -Password Settings Container-. Step 2: Open the created FGPP policy and check the -Applies To- section. Step 3: Ensure the correct users or groups (e.g., Admins) are listed. Step 4: If missing, add the desired users or groups. Step 5: Click OK and apply the settings. Step 6: Use ADUC to verify if msDS-PSOApplied attribute is set on the user object. Step 7: Log in as the user and test password policy enforcement. Step 8: Review effective settings for conflicts from multiple policies. Step 9: Document and standardize FGPP application rules. Step 10: Schedule audits to verify FGPP consistency and effectiveness. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? | |
| Microsoft-Recommended
|
TLS 1.1 Enabled DCs | Critical | 1 | Total Domain Controllers with TLS 1.1 Protocol Enabled:1 | MITREANSSI | NO |
X
TEST NAME TLS 1.1 Enabled DCs Description If Addressed: Disabling TLS 1.1 ensures domain controllers use modern, secure encryption protocols, reducing vulnerabilities to outdated cipher suite attacks. If Not Addressed: TLS 1.1 remains an exploitable protocol, increasing risk of downgrade attacks or exposure to weak encryption exploits. Recommendation and Steps Step 1: Log in to each of the 9 affected Domain Controllers. Step 2: Open the Registry Editor (regedit) by typing it in the Run dialog (Win + R). Step 3: Navigate to the following registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server Step 4: Check if there is a key named Enabled. If it exists and is set to 1, TLS 1.1 is enabled. Step 5: Before disabling TLS 1.1, ensure that no legacy systems or applications in your environment depend on TLS 1.1. Step 6: Monitor Event Viewer - Windows Logs - System or Application for any TLS-related error logs. Also, review logs for Event ID entries related to deprecated protocol usage. Step 7: Consult your application owners to confirm all client systems and apps support TLS 1.2 or higher. Step 8: Once compatibility is confirmed, return to the registry path mentioned in Step 3. Step 9: Set the Enabled value to 0 or delete the key entirely to disable TLS 1.1 for the server. Step 10: Repeat the process for the following path to ensure client-side TLS 1.1 is also disabled: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client Step 11: After making changes, restart the Domain Controller to apply the new settings. Step 12: Post-restart, monitor the event logs for any connection issues or application errors. Step 13: Document the change for auditing and compliance, and verify all 9 Domain Controllers are now free from TLS 1.1 usage. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
NTLM Authentication Enabled DCs | Critical | 1 | Total Domain Controllers with NTLM Enabled:1 | MITREANSSI | NO |
X
TEST NAME NTLM Authentication Enabled DCs Description If Addressed: Reduces reliance on NTLM, An outdated and less secure protocol, helping prevent NTLM relay attacks and credential theft. If Not Addressed: Continued NTLM Usage increases risk of relay attacks, pass-the-hash, and other legacy protocol vulnerabilities. Recommendation and Steps Step 1: Log in to each of the 9 affected Domain Controllers. Step 2: Open Local Group Policy Editor by running gpedit.msc. Step 3: Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Step 4: Locate the policy Network security: LAN Manager authentication level. Step 5: Double-click the policy and set the value to Send NTLMv2 response only. Refuse LM & NTLM. Step 6: Click Apply and then OK to save the changes. Step 7: Also check the policy Network security: Restrict NTLM: Incoming NTLM traffic and set it to Deny all accounts, if possible. Step 8: Run gpupdate /force to apply the policy changes. Step 9: Ensure that all systems and applications in the environment are compatible with this setting before enforcing, to avoid disruption. Step 10: Monitor the Event Logs for any authentication failures or issues following the change. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AllowNT4Crypto DCs | High | 1 | Total DCs with AllowNT4Crypto Enabled:1 | MITREANSSI | NO |
X
TEST NAME AllowNT4Crypto DCs Description If Addressed: Enhances cryptographic security by disabling NT4-style encryption for authentication. If Not Addressed: Weakened cryptography can be exploited in downgrade or man-in-the-middle attacks. Recommendation and Steps Step 1: Log into each domain controller using an admin account. Step 2: Open the Registry Editor (regedit). Step 3: Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Step 4: Locate the -LmCompatibilityLevel- or similar NT4-related entries. Step 5: If AllowNT4Crypto is found, change its value to 0 (disabled). Step 6: Exit and close regedit. Step 7: Reboot the system to apply changes. Step 8: Validate setting removal post-reboot. Step 9: Repeat for all 9 affected DCs. Step 10: Update security documentation and validate application compatibility. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
RC4 Encryption Enabled DCs | High | 1 | Total Domain Controllers With RC4 Encryption Enabled:1 | MITREANSSI | NO |
X
TEST NAME RC4 Encryption Enabled DCs Description If Addressed: disabling RC4 Helps enforce the use of stronger cryptographic algorithms during Kerberos authentication. If Not Addressed: RC4 is outdated and vulnerable to cryptanalysis, risking Kerberos ticket integrity. Recommendation and Steps Step 1: Log in to each domain controller. Step 2: Open Group Policy Management Editor. Step 3: Navigate to Computer Configuration > Administrative Templates > System > KDC. Step 4: Set -Supported Encryption Types- to exclude RC4 and include AES only. Step 5: Save and exit the policy editor. Step 6: Run gpupdate /force or wait for policy propagation. Step 7: Restart the domain controller if required. Step 8: Test with sample Kerberos-authenticated apps. Step 9: Validate encryption via Kerberos tickets. Step 10: Document changes and test results for audit. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Missing Updates DCs | High | 1 | Total DCs Not Updated Since Last 45 Days:1 | MITREANSSI | NO |
X
TEST NAME Missing Updates DCs Description If Addressed: Ensures DCs are protected with the latest security patches and bug fixes. If Not Addressed: Unpatched domain controllers may be vulnerable to known exploits and zero-day attacks Recommendation and Steps Step 1: Log into the affected domain controller. Step 2: Open Windows Update settings or WSUS client. Step 3: Click -Check for Updates- and wait for results. Step 4: Install all security and cumulative updates. Step 5: If managed by WSUS/SCCM, ensure compliance policies are correct. Step 6: Reboot the domain controller after updates are installed. Step 7: Monitor logs for update errors or failures. Step 8: Repeat for all 7 DCs. Step 9: Document patch levels and compliance status. Step 10: Schedule recurring patching for all DCs monthly Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln3_primary_group_id_nochange vuln1_primary_group_id_1000
|
Domain Controllers Modified with PrimaryGroupID | Passed | 0 | Total Domain Controllers modified with PrimaryGroupID:0 | MITREANSSI | YES |
X
TEST NAME Domain Controllers Modified with PrimaryGroupID Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_primary_group_id_nochange vuln1_primary_group_id_1000
|
| Microsoft-Recommended
|
SMB 1 Protocol Enabled DCs | Passed | 0 | Total Domain Controllers with SMB1 Server Protocol Enabled:0 | MITREANSSI | YES |
X
TEST NAME SMB 1 Protocol Enabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
SMB 1 Client Protocol Enabled DCs | Passed | 0 | Total Domain Controllers with SMB1 Client Service Enabled:0 | MITREANSSI | YES |
X
TEST NAME SMB 1 Client Protocol Enabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
LAN Manager password hashes Enabled DCs | Passed | 0 | Total DCs with LAN Manager Password Hashes:0 | MITREANSSI | YES |
X
TEST NAME LAN Manager password hashes Enabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
SMB Signing Disabled DCs | Passed | 0 | Total Domains Controller Without SMB Signing:0 | MITREANSSI | YES |
X
TEST NAME SMB Signing Disabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
LDAP Signing Disabled DCs | Passed | 0 | Total Domain Controllers Without LDAP Signing:0 | MITREANSSI | YES |
X
TEST NAME LDAP Signing Disabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln1_dc_inconsistent_uac
|
Inconsistent DCs | Passed | 0 | Total Domain Controllers in Inconsistent State:0 | MITREANSSI | YES |
X
TEST NAME Inconsistent DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dc_inconsistent_uac
|
| vuln1_password_change_inactive_dc
|
Unauthenticated DCs since last 45 Days | Passed | 0 | Total Domain Controllers Not Authenticated Within 45 days In All Domains:0 | MITREANSSI | YES |
X
TEST NAME Unauthenticated DCs since last 45 Days Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_password_change_inactive_dc
|
| vuln1_password_change_dc_no_change
|
Secrets not renewed DCs | Passed | 0 | Total Domain Controllers Not Changed Password Within 45 Days In All Domains:0 | MITREANSSI | YES |
X
TEST NAME Secrets not renewed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_password_change_dc_no_change
|
| Microsoft-Recommended | Missed Reboot Cycles DCs | Passed | 0 | Total DCs Not Rebooted Since Last 30 Days:0 | HealthCheck | YES |
X
TEST NAME Missed Reboot Cycles DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
No Contacts with Domain Controllers in Last Three Months | Passed | 0 | Total Domain Controllers not contacted since last three months:0 | MITREANSSI | YES |
X
TEST NAME No Contacts with Domain Controllers in Last Three Months Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Ensure UNC Paths for SYSVOL and NETLOGON are harderend | Passed | 0 | SYSVOL and Netlogon Hardening Missing on Total DCs:0 | MITREANSSI | YES |
X
TEST NAME Ensure UNC Paths for SYSVOL and NETLOGON are harderend Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? | ||
| Microsoft-Recommended
|
Missing DNS Scavenging DCs | Critical | 1 | Total DNS Servers Not Enabled with Server Level Scavenging:1 | Configuration | NO |
X
TEST NAME Missing DNS Scavenging DCs Description If Addressed: -Enables automatic removal of Stale DNS records, improving name resolution accuracy and reducing risks related to ghost devices or IP conflicts. If Not Addressed: -DNS zones may fill with outdated records, leading to resolution failures, confusion in asset tracking, and potential security loopholes. Recommendation and Steps Step 1: Log in to each of the 8 affected DNS servers individually. Step 2: Open the DNS Manager console (dnsmgmt.msc). Step 3: Right-click the server name and select Properties. Step 4: Go to the Advanced tab and check whether Enable automatic scavenging of stale records is enabled. Step 5: If it-s not enabled, do not enable it immediately. Step 6: First, expand Forward Lookup Zones and Reverse Lookup Zones to manually review all DNS records. Step 7: Identify and document any static records that do not have timestamps (these will not be scavenged unless manually updated). Step 8: Consider converting critical static records to dynamic ones or exclude them from scavenging. Step 9: Once reviewed, go back to the Server Properties > Advanced tab and enable the checkbox Enable automatic scavenging of stale records. Step 10: Click Apply and OK to save the setting. Step 11: Right-click the server again, choose Set Aging/Scavenging for All Zones, and configure a reasonable no-refresh and refresh interval (e.g., 7 days each). Step 12: Monitor the DNS records after enabling scavenging to ensure only stale, unused records are being deleted. Step 13: Repeat the above steps on each affected DNS server. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Scheduled Tasks found on Domain Controllers | High | 168 | Total Scheduled Tasks on DCs:168 | MITREANSSI | NO |
X
TEST NAME Scheduled Tasks found on Domain Controllers Description If Addressed: Reviewing scheduled tasks Ensures no unauthorized scripts or malicious jobs are running on DCs. If Not Addressed: malicious tasks Could persist, execute commands silently, or exfiltrate data from domain controllers. Recommendation and Steps Step 1: Log into each domain controller locally. Step 2: Open Task Scheduler and navigate to Task Scheduler Library. Step 3: Review each task-s name, author, trigger, and action. Step 4: Validate task purpose with application or infra teams. Step 5: Disable or delete unknown or unauthorized tasks. Step 6: Document all validated and removed tasks. Step 7: Monitor for recreation of deleted tasks (indicates compromise). Step 8: Implement GPO restrictions to limit task creation on DCs. Step 9: Report findings to security leadership. Step 10: Repeat task audit monthly. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing SSL Authentication DCs | Medium | 1 | Total DCs without SSL:1 | HealthCheck | NO |
X
TEST NAME Missing SSL Authentication DCs Description If Not Addressed (SSL Not Enabled): -Sensitive data like user credentials and LDAP queries may be transmitted in clear text, making them vulnerable to interception or tampering. If Addressed (SSL Enabled): -Ensures secure, encrypted communication for LDAP and authentication traffic, aligning with security best practices and compliance requirements. Recommendation and Steps 1. Verify If SSL (LDAPS) Is Already Enabled Get-ChildItem -Path Cert:\LocalMachine\MyCheck if a valid certificate for Server Authentication exists. 2. Ensure a Certificate Authority (CA) Is Available -Use Enterprise CA or trusted 3rd-party CA that issues certificates for DCs. 3. Request a Certificate for Each Domain Controller -The certificate must have: -- Server Authentication EKU -- DC's FQDN in Subject/Subject Alternative Name (SAN) 4. Enroll and Install the Certificate --Use MMC > Certificates (Local Computer) > Personal > Certificates > Enroll. 5. Bind Certificate to LDAPS -DCs automatically bind the correct certificate (restart may be required). 6. Restart the Domain Controller (if needed) 7. Test LDAPS Connectivity ldp.exe -Connect to the DC using port 636 (LDAPS). 8. Enable Clients/Apps to Use LDAPS Instead of LDAP 9. Monitor for SSL Certificate Expiration 10. Automate Certificate Renewal (e.g., via Autoenrollment) Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing Enough DNS Servers in NIC DCs | Medium | 1 | Total DCs With inadequate Number Of DNS Servers in NIC Property:1 | HealthCheck | NO |
X
TEST NAME Missing Enough DNS Servers in NIC DCs Description If Not Addressed (Too Few or Improper DNS Entries): -Can cause DNS resolution failures, replication issues, or even DCs failing to locate each other, disrupting AD services. If Addressed (Sufficient DNS Servers Set Properly): -Ensures robust name resolution, failover capability, and healthy AD replication between Domain Controllers. Recommendation and Steps 1. Log into the Domain Controller 2. Open Network Adapter Settings -Go to:Control Panel > Network and Sharing Center > Change adapter settings > [Your NIC] > Properties 3. Select -nternet Protocol Version 4 (TCP/IPv4)-- Click -roperties-4. Review DNS Settings -Check that at least two DNS servers are listed: -- Preferably, another DC's IP first -- Then optionally, its own IP (loopback) second 5. Avoid Using Only Loopback Address (127.0.0.1) -The loopback should not be the only DNS server; it prevents name resolution if DNS services fail on the local DC. 6. Recommended Order -Primary DNS: Another reliable DC/DNS server -Secondary DNS: Local DC (127.0.0.1 or actual IP) 7. Apply and Close Settings 8. Flush DNS Cache --ipconfig /flushdns 9. Test DNS Resolution and Replication --nslookup Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Not Enough Local Disks DCs | Medium | 1 | Total DCs Not Configured With Recommended Disk Configuration:1 | HealthCheck | NO |
X
TEST NAME Not Enough Local Disks DCs Description If Addressed: -Ensures that domain controllers are operating reliably and meeting diagnostic checks. If Not Addressed: -failures may go unnoticed, resulting in replication delays, service outages, or authentication issues. Recommendation and Steps Step 1: Log into each affected domain controller. Step 2: Run the built-in DCDiag tool via GUI or command (without PowerShell). Step 3: Identify test failures such as replication, frs, sysvol, or netlogon. Step 4: For replication errors, open Active Directory Sites and Services. Step 5: Verify NTDS settings and ensure connections exist between DCs. Step 6: For SYSVOL/Netlogon issues, check share availability. Step 7: Restart necessary services (e.g., DFSR, Netlogon). Step 8: Re-run DCDiag after corrective actions. Step 9: Document test results and close issues. Step 10: Monitor DCs weekly for persistent failures. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| vuln1_dc_inconsistent_uac
|
Orphaned DCs | Passed | 0 | Total Orphaned Domain Controllers:0 | HealthCheck | YES |
X
TEST NAME Orphaned DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_dc_inconsistent_uac
| |
| Microsoft-Recommended
|
Missing DNS Forwarders DCs | Passed | 0 | Total DNS Servers Do Not Have Forwarders Configured:0 | Configuration | YES |
X
TEST NAME Missing DNS Forwarders DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing Root Hints DCs | Passed | 0 | Total DNS Servers Do Not Have Root Hints Configured:0 | Configuration | YES |
X
TEST NAME Missing Root Hints DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing Host Records DCs | Passed | 0 | Total DCs Missing Host Records in DNS:0 | HealthCheck | YES |
X
TEST NAME Missing Host Records DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Not Enough Free Space DCs | Passed | 0 | Total DCs with Low Disk Space:0 | HealthCheck | YES |
X
TEST NAME Not Enough Free Space DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Loopback Address Missing DCs | Passed | 0 | Total DCs not configured with Loopback Address:0 | HealthCheck | YES |
X
TEST NAME Loopback Address Missing DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Multihomed DCs | Passed | 0 | Total DCS in Multihomed State:0 | HealthCheck | YES |
X
TEST NAME Multihomed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| vuln2_sysvol_ntfrs
|
NTFS Replication DCs | Passed | 0 | Total Domain Controllers utilizing NTFRS for AD Replication:0 | Configuration | YES |
X
TEST NAME NTFS Replication DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_sysvol_ntfrs
| |
| Microsoft-Recommended
|
Strict Replication Disabled DCs | Passed | 0 | Total DCs with Strict Replication Consistency not enabled:0 | Configuration | YES |
X
TEST NAME Strict Replication Disabled DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Out Of Default OUs DCs | Passed | 0 | Total DCs outside of it's Default OU:0 | Configuration | YES |
X
TEST NAME Out Of Default OUs DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Unsupported OS DCs | Passed | 0 | Total DCs running Unsupported Operating Systems:0 | Configuration | YES |
X
TEST NAME Unsupported OS DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing DNS Dynmaic Registration on NIC DCs | Passed | 0 | Total DCS NIC Dynamic Updates Not Enabled:0 | HealthCheck | YES |
X
TEST NAME Missing DNS Dynmaic Registration on NIC DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended
|
Missing _msdcs Zone DCs | Passed | 0 | Total DNS Servers Missing _msdcs Zone:0 | HealthCheck | YES |
X
TEST NAME Missing _msdcs Zone DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended | Event Log Config Not Correct DCs | Passed | 0 | Total DCs with Event Log misconfiguration:0 | Configuration | YES |
X
TEST NAME Event Log Config Not Correct DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| |
| Microsoft-Recommended | Event Log Size Not Optimized DCs | Passed | 0 | Total DCs with Event Log Size not optimal:0 | Configuration | YES |
X
TEST NAME Event Log Size Not Optimized DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Print Spooler Service Running DCs | Critical | 1 | Total Domain Controllers with Print Spooler Service running:1 | MITREANSSI | NO |
X
TEST NAME Print Spooler Service Running DCs Description If Addressed: disabling the Print Spooler service on domain controllers Reduces exposure to PrintNightmare and similar remote code execution vulnerabilities. If Not Addressed: An attacker Could exploit Spooler-related vulnerabilities to escalate privileges or execute code remotely on domain controllers. Recommendation and Steps Step 1: Log in to each of the 6 affected Domain Controllers individually. Step 2: Open the Services console by running services.msc. Step 3: In the list of services, locate Print Spooler. Step 4: Check if the service status is Running. Step 5: If it is running, right-click on Print Spooler and select Properties. Step 6: In the General tab, set the Startup type to Disabled. Step 7: Click Stop to immediately stop the service. Step 8: Click Apply and then OK to confirm the changes. Step 9: Repeat the above steps on all Domain Controllers where the Print Spooler service is running. Step 10: Monitor the systems for any unintended impact, especially if any printing-related applications are used on Domain Controllers (generally not recommended). Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Fax Server role installed DCs | Passed | 0 | Total Domain Controllers have Fax Server Installed::0 | MITREANSSI | YES |
X
TEST NAME Fax Server role installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Microsoft FTP service installed DCs | Passed | 0 | Total Domain Controllers have FTP Server Installed::0 | MITREANSSI | YES |
X
TEST NAME Microsoft FTP service installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Peer Name Resolution Protocol installed DCs | Passed | 0 | Total Domain Controllers have Peer Name Resolution Protocol Installed::0 | MITREANSSI | YES |
X
TEST NAME Peer Name Resolution Protocol installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Simple TCP-IP Services installed DCs | Passed | 0 | Total Domain Controllers have Simple TCP/IP Services Installed::0 | MITREANSSI | YES |
X
TEST NAME Simple TCP-IP Services installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Telnet Client installed DCs | Passed | 0 | Total Domain Controllers have Telnet Client Installed::0 | MITREANSSI | YES |
X
TEST NAME Telnet Client installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
TFTP Client installed DCs | Passed | 0 | Total Domain Controllers have TFTP Client Installed::0 | MITREANSSI | YES |
X
TEST NAME TFTP Client installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Server Message Block (SMB) v1 protocol Installed DCs | Passed | 0 | Total Domain Controllers have SMB 1.0/CIFS File Sharing Support Installed::0 | MITREANSSI | YES |
X
TEST NAME Server Message Block (SMB) v1 protocol Installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Windows PowerShell 2.0 installed DCs | Passed | 0 | Total Domain Controllers have Windows PowerShell 2.0 Engine Installed::0 | MITREANSSI | YES |
X
TEST NAME Windows PowerShell 2.0 installed DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
ADWS Service Set to Manual DCs | Passed | 0 | Total DCs ADWS Not Set to Start Automatic:0 | Configuration | YES |
X
TEST NAME ADWS Service Set to Manual DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
DHCP Service Running DCs | Passed | 0 | Total Domain Controllers with DHCP Server running:0 | Configuration | YES |
X
TEST NAME DHCP Service Running DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | Additional Roles and Features DCs | Passed | 1 | Total Domain Controllers with Roles Processed:1 | Configuration | YES |
X
TEST NAME Additional Roles and Features DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Services not running DCs | Passed | 0 | Total DCs with Services Not Running:0 | HealthCheck | YES |
X
TEST NAME AD Services not running DCs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? | |
| Microsoft-Recommended
|
Sites without Subnets Association | High | 1 | Total AD Sites Without Subnets:1 | Configuration | NO |
X
TEST NAME Sites without Subnets Association Description If Not Addressed (Subnets Not Mapped to Sites): -Clients may connect to random or distant domain controllers, causing slow logons, replication delays, and poor resource access. If Addressed (Subnets Properly Defined and Linked): -Clients are correctly mapped to local AD sites, improving logon speed, replication efficiency, and authentication performance. Recommendation and Steps 1. Open Active Directory Sites and Services -Run dssite.msc on a Domain Controller. 2. Expand Sites - Click on Subnets -Review existing subnets listed under the Subnets node. 3. Identify Missing Subnets -Compare your network's actual IP ranges with what's defined in AD. 4. Document the Network Subnet Ranges -Gather subnet details from DHCP scopes, VLANs, or network diagrams. 5. Right-Click -ubnets-- New Subnet -Add each missing subnet in CIDR format (e.g., 192.168.10.0/24). 6. Associate Subnet with the Correct AD Site -Choose the site that physically matches the subnet's location 7. Repeat for All Unmapped Subnets -Ensure every office, branch, or datacenter subnet is accounted for. 8. Test Site Assignment on Clients -Run on client machines:nltest /dsgetsite -Confirm the correct site name is returned. 9. Monitor Replication and Logon Performance -Look for improvements in authentication speed and reduced cross-site replication traffic. 10. Keep Subnet-to-Site Mapping Documented -Maintain and update this mapping when adding or decommissioning locations or networks. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Missing AD Sites Coverage | Medium | 1 | Total AD Sites Not Covered:1 | Configuration | NO |
X
TEST NAME Missing AD Sites Coverage Description If Addressed: Ensures reliable authentication and replication across sites Improves logon performance and application access for users in all sites Supports fault tolerance-sers can authenticate even if local DC is unavailable If Not Addressed: Users may experience logon failures or delays Domain controllers may not replicate properly across sites Risks in availability during site or DC failures Poor performance due to cross-site traffic for authentication Recommendation and Steps 1. Open Active Directory Sites and Services (ADSS) -- Run dssite.msc or open via Server Manager > Tools. 2. Review all AD sites -- Ensure each site has at least one DC or a mapped subnet. 3. Check subnets assigned to each site -- Go to Subnets in ADSS and verify proper mapping to sites. 4. Verify domain controllers are present in key sites -- Each major site should have a DC or coverage from a nearby site. 5. Create or assign subnets to uncovered sites -- Right-click Subnets > New Subnet, and assign it to the correct site. 6. Review and configure site links -- Ensure there are site links between all relevant sites for replication. 7. Check replication schedules -- Make sure replication intervals are appropriate for site connectivity. 8. Use tools to check site coverage -- Use nltest /dsgetsite on client machines to verify site detection. 9. Test failover and logon behavior -- Temporarily stop a local DC and verify clients can authenticate via another site. 10. Document the site and subnet configuration Maintain an updated diagram or document showing site coverage, links, and subnets. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Sites Missing Bridgehead Server | Medium | 1 | Number Of AD Sites Without Bridgehead Servers:1 | Configuration | NO |
X
TEST NAME Sites Missing Bridgehead Server Description If NOT Addressed (Manually Selected Bridgehead Servers): Risk of replication failures if the selected server is offline Poor fault tolerance -replication won't reroute automatically Increased administrative overhead to manage changes Potential bottlenecks or delays in inter-site replication Scalability issues in larger environments If Addressed (Automatically Selected Bridgehead Servers): High availability and resilience in replication paths KCC automatically selects the best server per site Reduced risk of single points of failure Simplified replication management Better performance and scalability Recommendation and Steps 1. Open Active Directory Sites and Services -Go to: Start > Administrative Tools > Active Directory Sites and Services. 2. Expand Sites and Select a Site -Navigate to Sites > [Site Name] > Servers. 3. Select a Server and Expand NTDS Settings -Right-click NTDS Settings under each server. 4. Check if a Manual Bridgehead Server is Configured -In the NTDS Settings Properties, go to Attribute Editor. -Look for bridgeheadTransportList attribute. 5. Remove Manual Bridgehead Configuration (If Any) -Clear any entries in bridgeheadTransportList to allow automatic selection. 6. Confirm Automatic Bridgehead Selection is Enabled -If the attribute is not set, KCC will choose automatically. 7. Repeat for All Sites -Ensure all sites with more than one domain controller have no hardcoded bridgehead servers unless absolutely necessary. 8. Force KCC to Recalculate Replication Topology -Run:repadmin /kcc * 9. Monitor Replication Health -Use: -dcdiag /test:replicationsEnsure replication works correctly across sites. 10. Document and Automate Checks -ocument changes and implement scheduled audits (via PowerShell or monitoring tools) to ensure bridgehead servers remain auto-configured. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Sites Redundancy | Medium | 1 | Total AD Sites with Only One Domain Controller:1 | Configuration | NO |
X
TEST NAME AD Sites Redundancy Description If NOT Addressed (Only One DC in Site): Single Point of Failure -if that DC fails, users may experience: Login failures GPO/application errors Replication delays No local replication partner -increases latency and reliance on other sites Reduced availability, especially in distributed or remote locations Higher risk of business disruption during patching, upgrades, or outages If Addressed (At Least Two DCs per Site): High availability for authentication and replication Improved fault tolerance and load balancing Local replication partner -faster and more efficient updates Minimal service disruption during maintenance or failure Scalable and resilient AD design Recommendation and Steps 1. Open Active Directory Sites and Services -Navigate to: Start > Administrative Tools > Active Directory Sites and Services. 2. Review Sites and Associated Servers -Expand Sites > [Site Name] > Servers -Check how many Domain Controllers (DCs) are present per site. 3. Identify Sites with Only One DC -Document the affected sites and note business-criticality and user counts. 4. Evaluate Infrastructure Readiness -Ensure the site has: - Stable network - Enough resources (CPU, RAM, storage) - Power/UPS for redundancy 5. Plan to Deploy a Second DC -Use consistent OS version and configuration -Plan replication settings and site assignments 6. Install AD DS on a New Server -On a member server in the site:Server Manager > Add Roles and Features > Active Directory Domain Services -Promote it to a domain controller. 7. Assign the DC to the Correct Site -In Active Directory Sites and Services, move the new DC to the right site. 8. Verify DNS and Global Catalog Roles -Ensure new DC: - Hosts DNS (if needed) - Is marked as Global Catalog (optional, but recommended) 9. Validate Replication Health -Use:repadmin /replsummarydcdiag /test:replications 10. Update Documentation and Monitor -Log new DC deployment -et up health monitoring (e.g., with SCOM, custom scripts Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Replication Interval Not Optimized Sites | Low | 1 | Replication Interval is not optimized for Site Links:1 | Configuration | NO |
X
TEST NAME Replication Interval Not Optimized Sites Description f NOT Addressed (Incorrect Replication Interval): Too Frequent Replication - Wastes bandwidth, especially over slow WAN links Too Infrequent Replication - Causes delayed AD updates, login/auth failures, stale data Inconsistent replication behavior across sites Unoptimized network performance Poor user experience and potential security risks If Addressed (Configured Per Microsoft Recommendation): Balanced performance and consistency across AD Efficient bandwidth usage Timely replication of changes (passwords, group updates, etc.) Improved user authentication reliability Better supportability and alignment with Microsoft guidance Recommendation and Steps 1. Open Active Directory Sites and Services -o to: Start > Administrative Tools > Active Directory Sites and Services. 2. Expand Inter-Site Transports -avigate to: Sites > Inter-Site Transports > IP. 3. Select Each Site Link -ight-click each site link and open Properties. 4. Check the Replication Interval -ook at the Replicate every value (default is 180 minutes). 5. Compare Against Best Practice -valuate the site-to-site bandwidth and business needs: -se 15 min for LAN or high-availability links -se 60-80 min for remote or slower connections 6. Document Current Settings -ecord all current intervals for tracking and rollback purposes. 7. Update the Replication Interval -odify the interval in the Properties window of each site link. 8. Set Different Intervals If Needed -ustomize intervals per site link depending on bandwidth/sensitivity. 9. Force Replication Topology -ecalculation Run: repadmin /kcc 10. Monitor and Validate Replication -ealth Run: repadmin /replsummary dcdiag /test:replications -onfirm replication is occurring on schedule and without errors Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Total Undefined Subnets | Passed | 0 | Total Undefined Subnets in AD Forest:0 | Configuration | YES |
X
TEST NAME Total Undefined Subnets Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Sites without ISTG Role | Passed | 0 | Total AD Sites Do Not Have ISTG Defined:0 | Configuration | YES |
X
TEST NAME Sites without ISTG Role Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Manual Replication Connection Objects | Passed | 0 | Total Manual Replication Connection Objects:0 | Configuration | YES |
X
TEST NAME Manual Replication Connection Objects Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Missing Global Catalog Sites | Passed | 0 | Total AD Sites Without Global Catalog Servers or No Universal Group Caching Enabled:0 | Configuration | YES |
X
TEST NAME Missing Global Catalog Sites Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Duplicate Site Links | Passed | 0 | Total Duplicate Site Links:0 | Configuration | YES |
X
TEST NAME Duplicate Site Links Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Sites With Manual Bridgehead Server | Passed | 0 | Number Of AD Sites With Manual Bridgehead Servers:0 | Configuration | YES |
X
TEST NAME Sites With Manual Bridgehead Server Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Sites creating Mesh Topology | Passed | 0 | Total AD Site Links Containing More than Two AD Sites:0 | Configuration | YES |
X
TEST NAME Sites creating Mesh Topology Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Sites without Site Link | Passed | 0 | Total AD Sites Not In Site Links:0 | Configuration | YES |
X
TEST NAME AD Sites without Site Link Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
AD Sites without Domain Controller | Passed | 0 | Total AD Sites Without Domain Controllers:0 | Configuration | YES |
X
TEST NAME AD Sites without Domain Controller Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
PDC Emulator Time Source | High | Internal Source | Root PDC Time Source:Internal Source | Configuration | NO |
X
TEST NAME PDC Emulator Time Source Description If Not Addressed (Incorrect or No Time Source): -Can cause time drift across the domain, leading to Kerberos authentication failures, replication issues, and domain-wide instability. If Addressed (Correct Time Source Set on PDC Emulator): -Ensures accurate, secure, and synchronized time across all domain members, supporting reliable authentication and replication. Recommendation and Steps 1. Identify the PDC Emulator in the Forest Root Domain -netdom query fsm -Look for the server holding the PDC Emulator FSMO role. 2. Log into the PDC Emulator -This DC will act as the authoritative time source for the domain. 3. Choose a Reliable External Time Source -Examples: -- time.windows.com -- pool.ntp.org -- National Institute of Standards and Technology (NIST): time.nist.gov 4. Configure the PDC Emulator to Use the External NTP Server -w32tm /config /manualpeerlist:time.nist.gov,0x9 /syncfromflags:manual /reliable:yes /updat 5. Restart the Windows Time Service net stop w32time && net start w32time 6. Force Time Resynchronization -w32tm /resync 7. Confirm the Configuration -w32tm /query /configuration --Look for Type: NTP and correct ManualPeerList. 8. Verify Time Status -w32tm /query /status -Confirm the source and offset are correct 9. Configure Other Domain Controllers to Sync from PDC -They do so by default, but verify: -w32tm /query /source -Should show the PDC Emulator as the source. 10. Monitor Time Drift and Sync Health -Regularly check logs or use monitoring tools to ensure consistent time across all domain members. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Domain Controllers Time Source | Passed | 0 | Total DCs Not Defined With Correct Time-Source:0 | Configuration | YES |
X
TEST NAME Domain Controllers Time Source Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Domain FSMO Placement | Passed | FSMO Placement is correct. | AD FSMO Placement Status:FSMO Placement is correct. | Configuration | YES |
X
TEST NAME Domain FSMO Placement Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Domain Naming Master and Schema Master Placement | Passed | Hosted on same computer | Status:Hosted on same computer | Configuration | YES |
X
TEST NAME Domain Naming Master and Schema Master Placement Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? | |||||||
| Microsoft-Recommended
|
Unprotected OUs | Medium | 1 | Total Ous not protected:1 | MITREANSSI | NO |
X
TEST NAME Unprotected OUs Description If NOT Addressed (OUs Not Protected): Accidental deletion of entire OUs, including: Users Computers Group Policies Security groups Service disruption, user login issues, GPO loss Data recovery complexity and downtime Increased risk of human error during AD cleanup or scripting If Addressed (OUs Protected): Prevents accidental deletions of critical AD objects Protects integrity of user and computer accounts Reduces administrative risk Supports compliance and change control policies Easier recovery planning and safer AD operations Recommendation and Steps 1. Open Active Directory Users and Computers (ADUC) -Launch dsa.msc with an account that has necessary privileges. 2. Enable Advanced Features -Go to the View menu - select Advanced Features to see object properties. 3. Expand Domain and Navigate to OUs -Browse through your domain to locate all Organizational Units. 4. Right-Click Each OU and Select Properties -For each OU, open the Properties window. 5. Go to the Object Tab -This tab is visible only if Advanced Features are enabled. 6. Check the Box -rotect object from accidental deletion--Enable this setting to prevent deletion without extra confirmation steps. 7. Repeat for All Critical OUs -Prioritize OUs that contain production users, computers, GPO links, and critical resources. 8. Automate Using PowerShell (Optional) -To apply protection to all OUs:Get-ADOrganizationalUnit -Filter * | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true 9. Document Changes -Record which OUs were updated for auditing and compliance purposes. 10. Audit and Monitor Periodically -chedule regular checks to ensure OU protection remains enabled Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended | Found Orphaned Foreign Security Principals | Low | 0 | Total Orphaned FSPs:0 | Configuration | NO |
X
TEST NAME Found Orphaned Foreign Security Principals Description If Not Addressed (Orphaned FSPs Exist): -These stale objects clutter the directory and may point to deleted or unresolvable external accounts, causing access issues and security confusion. If Addressed (No Orphaned FSPs): -AD remains clean, secure, and efficient, with all group memberships referencing valid and resolvable security principals. Recommendation and Steps 1. Understand What FSPs Are
-ForeignSecurityPrincipal (FSP) objects are created when users/groups from external trusted domains are added to AD groups.
2. Open PowerShell with AD Module
-Run from a Domain Controller or admin workstation with RSAT tools.
3. List All ForeignSecurityPrincipals
Get-ADObject -Filter {ObjectClass -eq foreignSecurityPrincipal} -Properties Name, SID
4. Identify Orphaned FSPs
-Orphaned FSPs have unresolvable SIDs. Use:
Get-ADObject -Filter {ObjectClass -eq foreignSecurityPrincipal} | Where-Object { -not (New-Object System.Security.Principal.SecurityIdentifier($_.SID)).Translate([System.Security.Principal.NTAccount])}
5. Export the List for Review
... | Select Name, SID | Export-Csv OrphanedFSPs.csv -NoTypeInformation
6. Confirm with Identity or Security Teams
-Validate that the external users or groups are indeed no longer in use or needed.
7. Check Group Memberships
-For each orphaned FSP, identify groups it's a member of using:
Get-ADGroup -Filter * | Where-Object { (Get-ADGroupMember $_ | Where-Object { $_.ObjectClass -eq foreignSecurityPrincipal -and $_.SID -eq
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended | Found Orphaned Foreign Security Principals | Low | 0 | Total Orphaned FSPs:0 | Configuration | NO |
X
TEST NAME Found Orphaned Foreign Security Principals Description If Not Addressed (Orphaned FSPs Exist): -These stale objects clutter the directory and may point to deleted or unresolvable external accounts, causing access issues and security confusion. If Addressed (No Orphaned FSPs): -AD remains clean, secure, and efficient, with all group memberships referencing valid and resolvable security principals. Recommendation and Steps 1. Understand What FSPs Are
-ForeignSecurityPrincipal (FSP) objects are created when users/groups from external trusted domains are added to AD groups.
2. Open PowerShell with AD Module
-Run from a Domain Controller or admin workstation with RSAT tools.
3. List All ForeignSecurityPrincipals
Get-ADObject -Filter {ObjectClass -eq foreignSecurityPrincipal} -Properties Name, SID
4. Identify Orphaned FSPs
-Orphaned FSPs have unresolvable SIDs. Use:
Get-ADObject -Filter {ObjectClass -eq foreignSecurityPrincipal} | Where-Object { -not (New-Object System.Security.Principal.SecurityIdentifier($_.SID)).Translate([System.Security.Principal.NTAccount])}
5. Export the List for Review
... | Select Name, SID | Export-Csv OrphanedFSPs.csv -NoTypeInformation
6. Confirm with Identity or Security Teams
-Validate that the external users or groups are indeed no longer in use or needed.
7. Check Group Memberships
-For each orphaned FSP, identify groups it's a member of using:
Get-ADGroup -Filter * | Where-Object { (Get-ADGroupMember $_ | Where-Object { $_.ObjectClass -eq foreignSecurityPrincipal -and $_.SID -eq
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended | Security Groups without Objects | Low | 32 | Total Empty Security Groups In All Domains:32 | Configuration | NO |
X
TEST NAME Security Groups without Objects Description If Not Addressed (Empty Security Groups Exist): -Leads to confusion, unnecessary clutter, and potential security risks if groups are accidentally assigned permissions without members. If Addressed (No Empty Groups): -Improves security hygiene, simplifies administration, and reduces risk of privilege misuse or misconfiguration. Recommendation and Steps 1. Identify Empty Security Groups
Get-ADGroup -Filter * -Properties Members | Where-Object { -not $_.Members } | Select Name, DistinguishedName
2. Document Empty Groups for Review
3. Review Purpose of Each Empty Group--Confirm if groups are placeholders or obsolete.
4. Communicate Findings with Group Owners
5. Decide Action: Remove or Populate Groups
6. Remove Unnecessary Empty Groups
Remove-ADGroup -Identity
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended
|
Users without UPN specified | Low | 1 | Total Users with UPN Blank in all Domains:1 | Configuration | NO |
X
TEST NAME Users without UPN specified Description If Not Addressed (UPN Missing): -Users may face login issues, especially with modern authentication protocols (e.g., Office 365, Azure AD), causing authentication failures and user frustration. If Addressed (UPN Properly Set): -Enables consistent, simplified login experience across services and supports hybrid identity and SSO implementations. Recommendation and Steps 1. Audit Users Missing UPN
Get-ADUser -Filter * -Properties userPrincipalName | Where-Object { !$_.userPrincipalName }
2. Review Existing UPN Suffixes in the Forest
Get-ADForest | Select-Object -ExpandProperty UPNSuffixes
3. Add Required UPN Suffixes if Missing via Active Directory Domains and Trusts
4. Define Standard UPN Format (e.g., [email protected])
5. Plan Bulk Update for Users Without UPN
6. Backup AD or Export User List Before Changes
7. Update Users to Include Correct UPN
Set-ADUser -Identity username -UserPrincipalName [email protected]
-For bulk update, use CSV input and loop.
8. Communicate Changes to End Users
9. Test Login with Updated UPNs
10. Enforce UPN Specification for New Users via Provisioning Process or GPO
Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended | Missing Location Text in AD Sites | Low | 1 | Total AD Sites Not Defined With Location:1 | Configuration | NO |
X
TEST NAME Missing Location Text in AD Sites Description If Not Addressed (Location Field Not Set): -Makes it difficult for admins to identify physical site locations, leading to confusion during troubleshooting, audits, or incident response. If Addressed (Location Field Set Properly): -Improves visibility, administration, and supports automated tools and scripts that rely on site metadata for decisions and reporting. Recommendation and Steps 1. Open Active Directory Sites and Services -Run dssite.msc on a Domain Controller. 2. Expand the -ites-Container -Review all existing AD sites listed. 3. Right-Click Each Site - Click -roperties-4. Review the -ocation-Field -If empty, this field needs to be set to reflect the physical/geographic location (e.g., New York, London-DC1, Singapore-HQ). 5. Set a Meaningful Location -Enter a clear and consistent location name using your organization- naming standards. 6. Repeat for All Sites -Ensure every site has a location string defined. 7. Use Standard Naming Convention -Example: Country-City-SiteCode (e.g., US-Dallas-DAL1). 8. Document the Location Mapping -Keep an inventory of sites and their location values for audits and reference. 9. Inform Admin and Support Teams -Make sure everyone is aware of the location naming format for future site creation or maintenance. 10. Validate via PowerShell (Optional) -To audit all sites:Get-ADReplicationSite -Filter * | Select Name, Location Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended
|
Managed Service Accounts Not Linked | Passed | 0 | Total Managed Service Accounts are not Linked:0 | Configuration | YES |
X
TEST NAME Managed Service Accounts Not Linked Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended
|
TombstoneLifeTime Modified? | Passed | 180 | Current TombstoneLifeTime Value:180 | Configuration | YES |
X
TEST NAME TombstoneLifeTime Modified? Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended
|
Check AD Forest Functional Level | Passed | dp.net is Windows2016Forest | AD Forest Functional Level:dp.net is Windows2016Forest | Configuration | YES |
X
TEST NAME Check AD Forest Functional Level Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended
|
Check AD Domain Functional Level | Passed | Ok | Status:Ok | Configuration | YES |
X
TEST NAME Check AD Domain Functional Level Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| Microsoft-Recommended | Ogranizational Units without Objects | Passed | 0 | Total Empty Organizational Units In All Domains:0 | Configuration | YES |
X
TEST NAME Ogranizational Units without Objects Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
| ||||||
| vuln1_delegation_sourcedeleg
|
Duplicate SPNs | Passed | 0 | Total Duplicate SPNs in AD Domains:0 | MITREANSSI | YES |
X
TEST NAME Duplicate SPNs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln1_delegation_sourcedeleg
| ||||||
| vuln2_password_change_server_no_change_90
|
Unauthenticated Servers | Passed | 0 | Total Servers Not Authenticated Within 90 Days in All Domains:0 | MITREANSSI | YES |
X
TEST NAME Unauthenticated Servers Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_password_change_server_no_change_90
| ||||||
| vuln3_password_change_server_no_change_45
|
Secrets not renewed Servers | Passed | 0 | Total Servers Not Changing Password within 45 days in all Domains:0 | MITREANSSI | YES |
X
TEST NAME Secrets not renewed Servers Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln3_password_change_server_no_change_45
| ||||||
| vuln2_adupdate_bad
|
AD Forest Schema Not upto date | Passed | OK:88 | Current Forest Schema Version Status:OK:88 | MITREANSSI | YES |
X
TEST NAME AD Forest Schema Not upto date Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln2_adupdate_bad
| ||||||
| Microsoft-Recommended | Found Unused Netlogon Scripts | Passed | 0 | Total Unused Scripts In All Domains:0 | MITREANSSI | YES |
X
TEST NAME Found Unused Netlogon Scripts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
No Group Policy Objects Defining Log Size and Retention | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects Defining Log Size and Retention Description If Addressed: Ensures logs are retained Long enough and sized appropriately for incident response and auditing. If Not Addressed: Important logs may be overwritten quickly or lost, reducing visibility into attacks or misconfigurations. Recommendation and Steps Step 1: Open Group Policy Management Console (GPMC). Step 2: Create or edit an existing domain-level GPO. Step 3: Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Event Log Service. Step 4: Configure Maximum Log Size for Application, System, and Security logs. Step 5: Set Retention Method to -Overwrite events as needed- or -Do not overwrite- with archiving. Step 6: Define -Retention Days- according to your organization-s compliance needs. Step 7: Link this GPO to the domain and force a GP update or wait for refresh. Step 8: Use Event Viewer on sample machines to confirm policy application. Step 9: Document the configured settings for audit purposes. Step 10: Schedule quarterly audits to ensure retention remains sufficient. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
No Group Policy Objects to Prevent Domain Admins from logging on to Workstations or Servers Found | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects to Prevent Domain Admins from logging on to Workstations or Servers Found Description If Addressed: Implementing the GPO Restricts domain admin logons to only domain controllers, reducing exposure of privileged credentials to potentially compromised machines. If Not Addressed: domain admin credentials can be Exposed on less secure endpoints, increasing risk of credential theft and domain compromise. Recommendation and Steps Step 1: Log in to the Group Policy Management Console on a domain controller. Step 2: Right-click on the Group Policy Objects node and select New to create a new GPO (e.g., -Restrict Domain Admin Logon-). Step 3: Right-click the newly created GPO and select Edit. Step 4: Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Step 5: Find and double-click the policy Deny log on locally. Step 6: Click Add User or Group, and add Domain Admins, Enterprise Admins, or any other privileged groups you want to restrict. Step 7: Click Apply and then OK to confirm. Step 8: Repeat the same for Deny log on through Remote Desktop Services to prevent remote logons. Step 9: Link this GPO to the OU containing workstations and member servers, but exclude domain controllers. Step 10: Run gpupdate /force on target systems or wait for group policy refresh. Step 11: Verify that the restriction is working by attempting a logon with a Domain Admin account. Step 12: Document the GPO settings and monitor logs to ensure there-s no disruption in admin operations. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
No Group Policy Objects to Block ISO Execution Found | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects to Block ISO Execution Found Description If Addressed: Blocking ISO file execution Prevents Users from running potentially malicious content from ISO images, aligning with CIS security best practices. If Not Addressed: Users can mount and run ISO files, potentially launching malware, ransomware, or unauthorized software. Recommendation and Steps Step 1: Open the Group Policy Management Console on a domain controller. Step 2: Right-click Group Policy Objects, select New, and name the GPO (e.g., -Block ISO Execution-). Step 3: Right-click the newly created GPO and select Edit. Step 4: Navigate to User Configuration > Administrative Templates > Windows Components > Attachment Manager. Step 5: Double-click the policy Inclusion list for moderate risk file types. Step 6: Set the policy to Enabled, then under the Specify the list of file types, enter .iso. Step 7: Click Apply and OK. Step 8: Navigate to Computer Configuration > Administrative Templates > Windows Components > File Explorer. Step 9: Find and enable the policy Do not allow the computer to run downloaded files with the Mark of the Web if required by CIS guidelines. Step 10: Link the GPO to the appropriate Organizational Units (OUs) or domains where execution of ISO files should be restricted. Step 11: Run gpupdate /force on client systems or wait for group policy refresh. Step 12: Test by attempting to mount or run an ISO file and verify that it is blocked. Step 13: Document this GPO and regularly audit to ensure ISO file execution remains blocked across the environment. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
No Group Policy Objects to Mitigate SMBv1 Found | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects to Mitigate SMBv1 Found Description If Addressed: disabling SMBv1 via GPO protects all machines from known exploits targeting the protocol. If Not Addressed: Environments remain Exposed to ransomware like WannaCry, which exploit SMBv1 Recommendation and Steps Step 1: Open GPMC and create a new GPO named -Disable SMBv1-. Step 2: Navigate to Computer Configuration > Preferences > Windows Settings > Registry. Step 3: Add a registry item to set SMBv1: Path: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, Name: SMB1, Type: REG_DWORD, Value: 0. Step 4: Add a second item for SMBv1 client: Path: HKLM\SYSTEM\CurrentControlSet\Services\mrxsmb10, Name: Start, Type: REG_DWORD, Value: 4. Step 5: Link the GPO to relevant OUs or domain. Step 6: Ensure reboot is scheduled after GPO application for effect. Step 7: Inform teams using legacy apps of potential compatibility issues. Step 8: Validate via local registry or Group Policy Results. Step 9: Remove SMBv1 manually on systems where it still remains. Step 10: Maintain a compliance tracker for SMB hardening Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
No Group Policy Objects Enforcing UAC Prompt for Elevation Found | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects Enforcing UAC Prompt for Elevation Found Description If addressed: Enforcing UAC (User Account Control) prompts for elevation ensures that administrative actions require explicit user consent, reducing the risk of unauthorized or silent privilege escalation by malware or users. If not addressed: Without UAC elevation prompts, malicious software or users may perform administrative tasks without notification, increasing the likelihood of system compromise and unauthorized changes. Recommendation and Steps 1. Open the Group Policy Management Console (GPMC) on a domain controller or management workstation. 2. Create a new Group Policy Object (GPO) or identify an existing GPO linked to the relevant Organizational Units (OUs) where UAC needs enforcement. 3. Edit the GPO and navigate to:Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options 4. Locate the policy setting named:User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode 5. Set this policy to:-rompt for consent-or -rompt for credentials-depending on your security requirements. 6. Locate and configure other relevant UAC policies such as: -- User Account Control: Run all administrators in Admin Approval Mode (Enable) -- User Account Control: Detect application installations and prompt for elevation (Enable) 7. Ensure the GPO is linked to all applicable OUs or domains where administrative controls are required. 8. Force Group Policy update on target machines using gpupdate /force or wait for the next policy refresh cycle. 9. Verify settings are applied on client machines by running gpresult /r or checking the Local Security Policy. 10. Monitor and audit UAC prompts and administrative activity to confirm effectiveness and user compliance. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
No Group Policy Objects to Mitigate Accidental Script Execution | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects to Mitigate Accidental Script Execution Description If Addressed: Blocks unauthorized or unintentional script execution via GPO, reducing attack surface. If Not Addressed: scripts may be run by mistake or maliciously, Enabling privilege escalation or system compromise. Recommendation and Steps Step 1: Open GPMC and create a new GPO titled -Block Unauthorized Script Execution-. Step 2: Navigate to User Configuration > Administrative Templates > System. Step 3: Enable -Run only specified Windows Applications- or -Don-t run specified Windows Applications-. Step 4: Add scripting engines like wscript.exe and cscript.exe to the blocked list. Step 5: Optionally, use AppLocker policies for more granular control. Step 6: Link the GPO to relevant OUs with non-admin users. Step 7: Test policy on sample user accounts to confirm enforcement. Step 8: Audit application usage via Windows Security logs. Step 9: Review policy exclusions for legitimate scripts. Step 10: Maintain policy documentation and update as needed. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
No Group Policy Objects to Mitigate NTLMv1 Protocol | High | 1 | Total AD Domains Affected:1 | MITREANSSI | NO |
X
TEST NAME No Group Policy Objects to Mitigate NTLMv1 Protocol Description If Addressed: disabling NTLMv1 protects the environment from Weak authentication exploits. If Not Addressed: use of NTLMv1 Allows downgrade attacks, hash cracking, and man-in-the-middle exploits. Recommendation and Steps Step 1: Open GPMC and edit/create a GPO named -Disable NTLMv1-. Step 2: Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Step 3: Set -Network security: LAN Manager authentication level- to -Send NTLMv2 response only. Refuse LM & NTLM-. Step 4: Also enable -Do not store LAN Manager hash value on next password change-. Step 5: Link this GPO to all domain computers and servers. Step 6: Run gpupdate /force or wait for next refresh cycle. Step 7: Test domain services to confirm they-re not relying on NTLMv1. Step 8: Monitor Event Logs (ID 4624) to verify protocol version usage. Step 9: Remove or update legacy apps using NTLMv1. Step 10: Review this setting during each security posture assessment. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
GPOs not Linked to OUs | Medium | 4 | Total OUs without GPO Linked:4 | Configuration | NO |
X
TEST NAME GPOs not Linked to OUs Description If NOT Addressed (GPOs Not Linked to Any OU): -Group Policies do not apply to any users or computers Security, compliance, or configuration settings are unenforced. -Creates management confusion (ghost GPOs not doing anything) -Wasted administrative effort maintaining unused policies -Increased risk of misconfiguration, drift, or policy gaps If Addressed (GPOs Properly Linked to OUs): -GPO settings are enforced across targeted users and computers -Centralized configuration and security control -Ensures policy compliance and operational consistency -Cleaner GPO structure and easier troubleshooting -Improved performance by removing unnecessary/unlinked GPOs Recommendation and Steps 1. Open Group Policy Management Console (GPMC) -Run gpmc.msc on a domain-joined management workstation or DC. 2. ist All Existing GPOs -In GPMC, expand the domain and go to Group Policy Objects. -Review all GPOs in the right-hand pane. 3. Identify Unlinked GPOs -Any GPO that is not linked to a domain, site, or OU is effectively inactive. 4. Review GPO Settings -Open and review unlinked GPOs to determine their purpose and intended targets. 5. Determine Appropriate OU(s) -Based on the GPO's purpose (e.g., password policy, software restrictions), decide which OU(s) it should be linked to. 6. Link GPO to the Correct OU -Right-click the target OU - Link an Existing GPO - select the appropriate GPO. 7. Set Link Order and Enforce if Needed -Adjust link order and use Enforced only when necessary to override inheritance. 8. Use Security Filtering if Required -Narrow down GPO application to specific groups or users within the OU using Security Filtering. 9. Run gpupdate and Test -On target computers or user accounts:gpupdate /forcegpresult /r -Verify the GPO is now applying as expected. 10. Clean Up Old or Obsolete GPOs -For unused/unlinked GPOs with no valid purpose: - Back up if needed Then delete them to keep the environment clean Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | GPO Description | Low | 2 | Number of GPOs not set with Description:2 | Configuration | NO |
X
TEST NAME GPO Description Description If NOT Addressed: Unclear GPO purpose or function Increased risk of accidental deletion or misconfiguration Harder to audit or troubleshoot Slower onboarding for new admins Poor GPO lifecycle management If Addressed: Clear understanding of GPO purpose and owner Easier maintenance and auditing Improved collaboration across teams Reduced risk of mistakes Faster issue resolution Recommendation and Steps 1. List All GPOs:Use PowerShell: Get-GPO -All | Select DisplayName, Description 2. Identify GPOs with Empty Descriptions:Filter GPOs where the description is missing or generic. 3. Create a Description Standard:Example format: Owner | Purpose | Linked OUs | Change Date 4. Review GPO Settings:Open each GPO in GPMC to understand what it does. 5. Assign Owners (if unknown):Track down the team or person responsible for the GPO. 6. Write Descriptions:Add meaningful, standardized descriptions for each GPO. 7. Update via PowerShell or GPMC:Use Set-GPO -Name GPOName -Comment Owner | Purpose | etc. 8. Document Description Guidelines:Share standards in IT documentation or admin wikis. 9. Automate Future Checks:Script regular audits for missing or outdated descriptions. 10. Train and Enforce:Require descriptions when creating or modifying GPOs going forward. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Disabled GPOs | Passed | 0 | Total Disabled GPOs:0 | Configuration | YES |
X
TEST NAME Disabled GPOs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
GPOs not Applying | Passed | 0 | Total GPOs not applying correctly in All Domains:0 | Configuration | YES |
X
TEST NAME GPOs not Applying Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Orphaned GPO Containers | Passed | 0 | Total Orphaned Group Policy Objects:0 | Configuration | YES |
X
TEST NAME Orphaned GPO Containers Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Found OUs with GPOs Block Inheritance | Passed | 0 | Total GPOs with Block Inheritance Defined:0 | Configuration | YES |
X
TEST NAME Found OUs with GPOs Block Inheritance Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | GPO Naming Convention | Passed | 0 | Number Of GPOs do not follow Standard Naming Convention:0 | Configuration | YES |
X
TEST NAME GPO Naming Convention Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Found GPO with WMI Filters | Passed | 0 | Total GPO with WMI Filter:0 | Configuration | YES |
X
TEST NAME Found GPO with WMI Filters Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Domain GPO Application Status | Passed | 0 | Total GPOs Not Applied:0 | HealthCheck | YES |
X
TEST NAME Domain GPO Application Status Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | No Group Policy Objects for Preventing passwords using reversible encryption | Passed | 0 | Total AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME No Group Policy Objects for Preventing passwords using reversible encryption Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | GPO Preferences Containing Passwords | Passed | 0 | GPO Preferences Containing Password in All AD Domains:0 | MITREANSSI | YES |
X
TEST NAME GPO Preferences Containing Passwords Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Inconsistent GPOs | Passed | 0 | Total GPOs with Replication Issues:0 | Configuration | YES |
X
TEST NAME Inconsistent GPOs Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended | Too many DNS Static Records | Passed | 0 | Total Static Records:0 | Configuration | YES |
X
TEST NAME Too many DNS Static Records Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
DNS Round-Robin Not Enabled | Passed | 0 | Total DNS Servers Not Enabled With Round Robin:0 | Configuration | YES |
X
TEST NAME DNS Round-Robin Not Enabled Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Lock screen camera status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Lock screen camera status Description If addressed: Enabling this policy prevents the use of cameras on the lock screen of Domain Controllers, reducing the risk of unauthorized surveillance or data leakage through image capture. If not addressed: Allowing the lock screen camera on Domain Controllers may expose sensitive environments to privacy breaches, insider threats, or accidental data leaks via unauthorized photography. Recommendation and Steps 1. Access Group Policy Management: Open the Group Policy Management Console (GPMC) on your domain controller. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to the Policy Setting: Go to Computer Configuration > Administrative Templates > Windows Components > Camera. 4. Locate the Setting: Find the policy named -revent enabling lock screen camera- 5. Enable the Policy: Set the policy to Enabled to disable camera access on the lock screen. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked specifically to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply the new setting immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied on domain controllers. 9. Audit Camera Usage: Monitor event logs or use endpoint management tools to verify cameras are disabled on lock screens. 10. Document the Policy: Maintain clear documentation of this security setting as part of your domain controller hardening standards. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Lock screen slide show status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Lock screen slide show status Description If addressed: Enabling this policy disables the lock screen slideshow on Domain Controllers, reducing the risk of information leakage or distractions caused by unauthorized or inappropriate images. If not addressed: Allowing the lock screen slideshow can expose sensitive information through displayed images or cause unnecessary resource usage and potential security gaps on critical systems. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create/Edit GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Control Panel > Personalization. 4. Find the Setting: Locate -revent enabling lock screen slide show- 5. Enable the Policy: Set the policy to Enabled to disable lock screen slideshow functionality. 6. Link GPO to Domain Controllers OU: Ensure this GPO is linked to the Domain Controllers organizational unit for scope. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply the new settings immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the policy is applied on domain controllers. 9. Monitor and Audit: Check event logs or endpoint management systems to confirm slideshow is disabled. 10. Document the Configuration: Keep detailed records of this setting as part of your domain controller security baseline. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Passwords to be saved status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Passwords to be saved status Description If addressed: Enabling this policy on Domain Controllers prevents passwords from being cached or saved, reducing the risk of credential theft through stored passwords and enhancing overall security. If not addressed: Allowing passwords to be saved on Domain Controllers increases the risk of attackers extracting cached credentials, leading to potential privilege escalation and domain compromise. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a management workstation or domain controller. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to the Policy: Go to Computer Configuration > Administrative Templates > System > Credentials Delegation. 4. Locate the Setting: Find -o not allow passwords to be saved-policy. 5. Enable the Policy: Set the policy to Enabled to prevent saving passwords on the Domain Controllers. 6. Link GPO to Domain Controllers OU: Make sure the GPO applies to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied correctly. 9. Audit and Monitor: Check security logs and use endpoint management tools to ensure no passwords are being saved. 10. Document Configuration: Maintain thorough documentation of the policy and its enforcement for compliance and security auditing. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Always prompt for password upon connection status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Always prompt for password upon connection status Description If addressed: Enabling this policy ensures that users must enter their password every time they connect to Domain Controllers, reducing the risk of unauthorized access through cached or saved credentials. If not addressed: Without this prompt, passwords may be cached or reused automatically, increasing the risk of credential theft or unauthorized access to critical systems. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > System > Credentials Delegation. 4. Locate the Setting: Find the policy named -lways prompt for password upon connection-or similar Remote Desktop/credential related settings. 5. Enable the Policy: Set the policy to Enabled to require password entry on every connection. 6. Link GPO to Domain Controllers OU: Ensure the policy applies specifically to Domain Controllers by linking the GPO to their OU. 7. Force Policy Update: Run gpupdate /force on all Domain Controllers to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is in effect. 9. Test Connectivity: Confirm that users are prompted for passwords upon connecting to Domain Controllers. 10. Document Configuration: Keep detailed records of this security control as part of your domain controller hardening process. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Require secure RPC communication status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Require secure RPC communication status Description If addressed: Enabling secure RPC communication on Domain Controllers ensures that Remote Procedure Calls are encrypted and authenticated, protecting sensitive data and preventing man-in-the-middle attacks. If not addressed: Without secure RPC, communications to Domain Controllers can be intercepted or tampered with, exposing the network to eavesdropping, credential theft, and potential compromise Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Access GPMC on a domain controller or administrative workstation. 2. Create or Edit GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > System > Remote Procedure Call. 4. Locate Setting: Find the policy named -equire secure RPC communication-or similarly worded setting. 5. Enable the Policy: Set the policy to Enabled to enforce secure RPC on domain controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Update Group Policy: Run gpupdate /force on all domain controllers to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Test RPC Communication: Validate that RPC communication to Domain Controllers is functioning correctly and securely. 10. Document and Monitor: Record this configuration in your security baseline and monitor domain controller logs for any RPC-related issues. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Set client connection encryption level status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Set client connection encryption level status Description If addressed: Enabling and configuring the client connection encryption level on Domain Controllers ensures all Remote Desktop Protocol (RDP) sessions are encrypted, protecting data in transit from interception or tampering. If not addressed: Without enforced encryption, RDP sessions to Domain Controllers may transmit data in clear text, exposing sensitive credentials and information to attackers via network sniffing. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security. 4. Find the Setting: Locate -et client connection encryption level- 5. Enable the Policy: Set it to Enabled. 6. Configure Encryption Level: Choose the highest available encryption level, typically High Level or FIPS Compliant. 7. Link GPO to Domain Controllers OU: Ensure the GPO applies specifically to the Domain Controllers OU. 8. Force Group Policy Update: Run gpupdate /force on all Domain Controllers to apply the setting immediately. 9. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 10. Test RDP Connections: Verify that RDP sessions to Domain Controllers require encrypted connections and operate as expected. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Windows Defender SmartScreen status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Windows Defender SmartScreen status Description If addressed: Enabling Windows Defender SmartScreen on Domain Controllers helps protect against phishing and malware by warning users about potentially malicious websites and files, enhancing overall security posture. If not addressed: Without SmartScreen enabled, domain controllers are more vulnerable to users inadvertently running malicious files or visiting harmful websites, increasing the risk of compromise. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > Windows Components > File Explorer. 4. Locate the Setting: Find -onfigure Windows Defender SmartScreen-or -onfigure Windows Defender SmartScreen prompts- 5. Enable the Policy: Set the policy to Enabled. 6. Choose SmartScreen Behavior: Configure to Warn or Block based on organizational risk tolerance. 7. Link GPO to Domain Controllers OU: Make sure the GPO is linked to the Domain Controllers organizational unit. 8. Force Group Policy Update: Run gpupdate /force on domain controllers to apply the settings immediately. 9. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is enforced. 10. Monitor and Educate: Monitor SmartScreen events via event logs and educate administrators on responding to SmartScreen warnings. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
AutoPlay status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME AutoPlay status Description If addressed: Disabling AutoPlay on Domain Controllers prevents automatic execution of potentially malicious software from removable media, reducing the risk of malware infection and unauthorized access. If not addressed: Leaving AutoPlay enabled can allow malware or unauthorized programs to run automatically when removable devices are connected, posing a serious security risk to critical domain controller systems. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies. 4. Locate Setting: Find -urn off AutoPlay-policy. 5. Enable the Policy: Set it to Enabled and choose All drives in the options to disable AutoPlay on all drives. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm policy enforcement. 9. Test Removable Media: Connect removable drives to confirm AutoPlay does not start automatically. 10. Document and Monitor: Keep records of this setting and monitor endpoint security logs for any attempts to circumvent the policy Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Default behavior for AutoRun status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Default behavior for AutoRun status Description If addressed: Setting the default behavior for AutoRun to disabled on Domain Controllers prevents automatic execution of scripts or programs from removable media, significantly reducing the risk of malware infections and unauthorized code execution. If not addressed: If AutoRun is enabled or misconfigured, attackers could exploit removable media to automatically run malicious code on Domain Controllers, leading to potential system compromise and domain-wide security breaches. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies. 4. Locate the Setting: Find -efault behavior for AutoRun-policy. 5. Configure the Policy: Set it to Enabled and configure the default behavior to -o not execute any autorun commands- 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test with Removable Media: Insert removable media to confirm AutoRun does not execute automatically. 10. Document and Monitor: Maintain documentation of this configuration and monitor security logs for any unauthorized execution attempts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
UNC Paths Hardened status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME UNC Paths Hardened status Description If addressed: Hardening UNC (Universal Naming Convention) paths on Domain Controllers strengthens network file share security by enforcing strict access controls and reducing exposure to man-in-the-middle and relay attacks. If not addressed: Unsecured UNC paths can be exploited by attackers to intercept, modify, or redirect network traffic, potentially leading to credential theft, lateral movement, and domain compromise. Recommendation and Steps 1. Identify UNC Shares: List all UNC paths and network shares used by or exposed on Domain Controllers. 2. Review Permissions: Audit and tighten permissions on these shares to follow the principle of least privilege. 3. Enable SMB Signing: Configure SMB signing on Domain Controllers to ensure integrity and authenticity of SMB communication. 4. Configure SMB Encryption: Where supported, enable SMB encryption for sensitive UNC paths. 5. Disable SMBv1: Ensure SMB version 1 is disabled to prevent exploitation of known vulnerabilities. 6. Use Group Policy to Harden UNC Access: In GPMC, navigate to relevant policies to control UNC path behavior and access restrictions. 7. Implement Credential Guard / Restricted Admin Mode: Use features like Credential Guard and restricted admin mode to protect credentials during UNC access. 8. Force Group Policy Update: Run gpupdate /force on Domain Controllers to apply policy changes. 9. Monitor Access Logs: Set up auditing on UNC paths to monitor access and detect suspicious activity. 10.Document and Review: Maintain documentation of hardened UNC paths and regularly review configurations for compliance. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Insecure guest logons status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Insecure guest logons status Description If addressed: Disabling insecure guest logons on Domain Controllers prevents anonymous or unauthenticated access to network resources, reducing the risk of unauthorized access and potential lateral movement within the network. If not addressed: Allowing insecure guest logons exposes Domain Controllers to unauthorized users who can exploit this access for reconnaissance, privilege escalation, or launching attacks on the domain. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > Network > Lanman Workstation. 4. Locate the Setting: Find the policy -nable insecure guest logons- 5. Disable the Policy: Set the policy to Disabled to prevent guest logons. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU for enforcement. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Audit Network Access: Monitor event logs and network traffic to detect any unauthorized guest access attempts. 10. Document and Review: Keep records of this policy configuration and regularly review security settings for compliance. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit- Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit- Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings status Description If addressed: Enabling this setting ensures that detailed audit policy subcategories take precedence over broader category settings, providing granular and accurate auditing essential for effective security monitoring and compliance. If not addressed: Without this enabled, audit policies might be inconsistent or overly broad, leading to gaps in security logging, missed critical events, and challenges in forensic investigations. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the appropriate OU (often Domain Controllers or the entire domain). 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -udit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO: Make sure the GPO is linked to the OU containing the computers where you want this enforced (e.g., Domain Controllers). 7. Update Group Policy: Run gpupdate /force on the target machines to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or secedit /export /cfg to confirm the setting is enabled. 9. Review Audit Policies: Check the configured audit subcategories under Advanced Audit Policy Configuration to ensure detailed logging is active. 10. Document and Monitor: Maintain records of the audit policy settings and regularly review security logs for completeness and accuracy. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain controller- LDAP server signing requirements status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain controller- LDAP server signing requirements status Description If addressed: Enabling LDAP server signing on Domain Controllers enforces signing of LDAP traffic, protecting against man-in-the-middle attacks and ensuring the integrity and authenticity of LDAP communications. If not addressed: Without LDAP signing enforced, LDAP traffic can be intercepted or tampered with by attackers, leading to potential credential theft, unauthorized directory access, and domain compromise. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain controller: LDAP server signing requirements- 5. Configure the Setting: Set it to -equire signing-to enforce LDAP signing on the Domain Controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU to apply the policy. 7. Force Group Policy Update: Run gpupdate /force on all Domain Controllers to immediately apply the setting. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is active. 9. Test LDAP Connectivity: Validate LDAP client applications and services are able to connect securely with signing enforced. 10. Document and Monitor: Maintain records of this configuration and monitor security logs for LDAP-related anomalies. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain controller- Refuse machine account password changes status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain controller- Refuse machine account password changes status Description If addressed: Enabling this setting prevents domain controllers from automatically changing their machine account passwords, ensuring stability and avoiding potential authentication issues in the domain. If not addressed: If this setting is disabled, domain controllers might attempt to change their machine account passwords, which can lead to replication errors, trust relationship failures, and authentication problems within the domain. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain controller: Refuse machine account password changes- 5. Enable the Setting: Set it to Enabled to refuse machine account password changes on domain controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied. 9. Monitor Domain Controller Health: Check event logs and replication status to ensure domain controllers are functioning correctly. 10. Document and Review: Keep records of this configuration and periodically review domain controller account status and policies. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Digitally encrypt secure channel data (when possible) status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain member- Digitally encrypt secure channel data (when possible) status Description If addressed: Enabling this setting allows domain member machines to encrypt secure channel data when supported, enhancing the confidentiality and integrity of communications with domain controllers. If not addressed: If not enabled, secure channel data might be transmitted without encryption when possible, increasing the risk of interception and potential credential exposure during network communication. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Digitally encrypt secure channel data (when possible)- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units containing the domain member computers. 7. Force Group Policy Update: Run gpupdate /force on domain member machines to apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is active. 9. Test Secure Channel Encryption: Use network monitoring tools or commands like nltest /sc_query to check encryption status. 10. Document and Monitor: Maintain documentation of this configuration and regularly review event logs for secure channel issues. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Digitally sign secure channel data (when possible) status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain member- Digitally sign secure channel data (when possible) status Description If addressed: Enabling this setting allows domain member machines to digitally sign secure channel data when supported, ensuring data integrity and authenticity in communications with domain controllers. If not addressed: Without this enabled, secure channel data may be unsigned when possible, increasing the risk of data tampering or man-in-the-middle attacks that compromise authentication security. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Digitally sign secure channel data (when possible)- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with domain member machines. 7. Force Group Policy Update: Run gpupdate /force on affected domain members to apply the setting immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied. 9. Test Secure Channel Signature: Use tools like nltest /sc_query: Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Disable machine account password changes status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain member- Disable machine account password changes status Description If addressed (setting disabled): Allowing domain member machines to change their machine account passwords regularly enhances security by preventing stale or compromised credentials, maintaining trust with domain controllers. If not addressed (setting enabled): If machine account password changes are disabled, domain members won- update their passwords, which can lead to trust relationship failures and authentication problems over time. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Disable machine account password changes- 5. Set to Disabled: Ensure this policy is set to Disabled to allow automatic machine account password changes. 6. Link GPO to Target OU: Confirm the GPO is linked to the organizational units containing domain members. 7. Force Group Policy Update: Run gpupdate /force on domain member computers to apply the setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Monitor Machine Account Password Changes: Check event logs (Security event ID 4742) to verify regular password changes. 10. Document and Review: Keep records of this configuration and periodically audit machine account trust status. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Maximum machine account password age status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain member- Maximum machine account password age status Description If addressed: Setting a maximum machine account password age enforces regular password changes for domain member computer accounts, which helps prevent long-term credential exposure and maintains secure trust relationships with domain controllers. If not addressed: Without a defined maximum password age, machine account passwords may never change or change infrequently, increasing the risk of compromised credentials and domain trust failures. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Maximum machine account password age- 5. Set the Value: Define the maximum password age (e.g., 30 or 45 days) based on your organization- security policy. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units containing domain member machines. 7. Force Group Policy Update: Run gpupdate /force on domain member computers to apply the updated setting. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Monitor Password Changes: Check event logs (Security event IDs like 4742) to ensure machine account passwords are rotating within the defined period. 10. Document and Review: Keep records of the configured maximum password age and periodically audit machine account password status and trust relationships. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Require strong (Windows 2000 or later) session key status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Domain member- Require strong (Windows 2000 or later) session key status Description If addressed: Enabling this setting enforces the use of strong session keys for secure channel communications, enhancing cryptographic strength and protecting data integrity and confidentiality between domain members and domain controllers. If not addressed: Without this enforcement, weaker session keys may be used, increasing the risk of cryptographic attacks such as session hijacking or data tampering during authentication and communication. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Require strong (Windows 2000 or later) session key- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Make sure the GPO is linked to the organizational units that include domain member machines. 7. Force Group Policy Update: Run gpupdate /force on domain members to immediately apply the setting. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Secure Channel Communication: Use tools like nltest /sc_verify to verify secure channel integrity with strong session keys. 10. Document and Monitor: Record the configuration and monitor event logs for related errors or warnings on secure channel security. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Interactive logon- Machine inactivity limit status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Interactive logon- Machine inactivity limit status Description If addressed: Setting a machine inactivity limit ensures that inactive sessions automatically lock after a specified time, reducing the risk of unauthorized access from unattended logged-in computers. If not addressed: Without an inactivity timeout, machines remain accessible even when left unattended, increasing the chances of unauthorized use or data exposure. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU with the target computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -nteractive logon: Machine inactivity limit- 5. Set the Limit: Define the inactivity timeout in seconds (e.g., 300 seconds for 5 minutes). 6. Link GPO to Target OU: Ensure the GPO is linked to OUs containing target computers. 7. Force Group Policy Update: Run gpupdate /force on target machines to apply the setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test the Timeout: Leave a test machine idle and verify that it locks automatically after the defined period. 10. Document and Monitor: Record the configuration and monitor helpdesk or security logs for any related incidents or user feedback. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Microsoft network client- Digitally sign communications (always) status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Microsoft network client- Digitally sign communications (always) status Description If addressed: Enabling this setting ensures that all SMB communications from the client to servers are digitally signed, protecting data integrity and preventing man-in-the-middle attacks during file and resource sharing. If not addressed: Without mandatory digital signing, SMB traffic can be intercepted or tampered with, leading to potential data breaches or unauthorized access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing the target client computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -icrosoft network client: Digitally sign communications (always)- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with the client computers. 7. Force Group Policy Update: Run gpupdate /force on client machines to apply the change immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Test SMB Communication: Monitor SMB sessions or use network capture tools to verify digital signing. 10. Document and Monitor: Keep records of this configuration and regularly review security logs for any related SMB communication issues. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Microsoft network client- Send unencrypted password to third-party SMB servers status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Microsoft network client- Send unencrypted password to third-party SMB servers status Description If addressed: Disabling the sending of unencrypted passwords prevents sensitive credentials from being transmitted in clear text to third-party SMB servers, significantly reducing the risk of credential theft and man-in-the-middle attacks. If not addressed: Allowing unencrypted password transmission exposes user credentials to interception and compromise, increasing the risk of unauthorized access and lateral movement within the network. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing the target client computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -icrosoft network client: Send unencrypted password to third-party SMB servers- 5. Set to Disabled: Configure the policy to Disabled to block unencrypted password transmissions. 6. Link GPO to Target OU: Ensure the GPO is linked to OUs with the client computers. 7. Force Group Policy Update: Run gpupdate /force on affected machines to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is in effect. 9. Test SMB Connections: Monitor SMB authentication attempts and verify no unencrypted passwords are sent. 10. Document and Monitor: Keep documentation of this setting and regularly review security logs for authentication anomalies. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network access- Do not allow anonymous enumeration of SAM accounts status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network access- Do not allow anonymous enumeration of SAM accounts status Description If addressed: Enabling this setting prevents anonymous users from listing user accounts in the Security Accounts Manager (SAM), reducing information disclosure risks and protecting against reconnaissance attacks by unauthorized parties. If not addressed: Allowing anonymous enumeration exposes account details that attackers can use to plan targeted attacks such as password guessing or privilege escalation. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the target OU(s). 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork access: Do not allow anonymous enumeration of SAM accounts- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to OUs containing domain controllers or servers. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting. 9. Test Enumeration Attempts: Attempt anonymous enumeration (with tools or scripts) to verify it is blocked. 10. Document and Monitor: Keep records of the configuration and review security logs for any failed enumeration attempts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network access- Do not allow anonymous enumeration of SAM accounts and shares status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network access- Do not allow anonymous enumeration of SAM accounts and shares status Description If addressed: Enabling this setting prevents anonymous users from enumerating both SAM accounts and network shares, protecting sensitive account information and shared resources from unauthorized discovery and potential exploitation. If not addressed: Allowing anonymous enumeration exposes user account details and shared folders to attackers, increasing the risk of reconnaissance activities that could lead to targeted attacks or unauthorized access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain controllers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork access: Do not allow anonymous enumeration of SAM accounts and shares- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with the affected servers. 7. Force Group Policy Update: Run gpupdate /force on all affected machines to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Enumeration: Attempt anonymous enumeration of SAM accounts and shares to verify it is blocked. 10. Document and Monitor: Document the implementation and monitor security logs for unauthorized access or enumeration attempts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- Allow LocalSystem NULL session fallback status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- Allow LocalSystem NULL session fallback status Description If addressed (enabled): Allowing LocalSystem NULL session fallback can provide backward compatibility for legacy applications but significantly increases the risk of anonymous access to system resources, making the system vulnerable to unauthorized access and potential attacks. If not addressed (disabled): Disabling this setting enhances security by preventing the system from accepting NULL session fallback connections, reducing the attack surface and mitigating risks associated with anonymous access exploits. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the OU with the target computers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Allow LocalSystem NULL session fallback- 5. Set to Disabled: Configure the policy to Disabled to prevent fallback to NULL sessions. 6. Link GPO to Target OU: Ensure the GPO is linked to the relevant OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test Connectivity: Ensure legacy applications are tested to confirm they do not rely on NULL session fallback, or plan mitigation if necessary. 10.Document and Monitor: Document the change and monitor security logs for any unauthorized access attempts or issues related to authentication. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- Allow LocalSystem NULL session fallback status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- Allow LocalSystem NULL session fallback status Description If addressed (enabled): Allowing LocalSystem NULL session fallback can provide backward compatibility for legacy applications but significantly increases the risk of anonymous access to system resources, making the system vulnerable to unauthorized access and potential attacks. If not addressed (disabled): Disabling this setting enhances security by preventing the system from accepting NULL session fallback connections, reducing the attack surface and mitigating risks associated with anonymous access exploits. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the OU with the target computers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Allow LocalSystem NULL session fallback- 5. Set to Disabled: Configure the policy to Disabled to prevent fallback to NULL sessions. 6. Link GPO to Target OU: Ensure the GPO is linked to the relevant OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test Connectivity: Ensure legacy applications are tested to confirm they do not rely on NULL session fallback, or plan mitigation if necessary. 10.Document and Monitor: Document the change and monitor security logs for any unauthorized access attempts or issues related to authentication. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- LAN Manager authentication level status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- LAN Manager authentication level status Description If addressed (properly configured): Configuring the LAN Manager authentication level enforces stronger authentication protocols, reducing vulnerabilities to downgrade attacks and ensuring only secure authentication methods are used. If not addressed (misconfigured or left default): Weak or default LAN Manager authentication settings allow fallback to insecure authentication methods, exposing systems to credential theft and man-in-the-middle attacks. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create or modify a GPO linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: LAN Manager authentication level- 5. Configure the Setting: Set it to Send NTLMv2 response only. Refuse LM & NTLM (recommended for highest security). 6. Link GPO to Target OU: Link the GPO to OUs containing domain controllers and member servers. 7. Force Group Policy Update: Run gpupdate /force on all targeted machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting. 9. Test Authentication: Ensure legacy applications or systems are compatible or updated, as they might not support NTLMv2 only. 10.Document and Monitor: Document the change and monitor authentication logs for failed logins or fallback attempts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- LDAP client signing requirements | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- LDAP client signing requirements Description If addressed (enabled): Enforcing LDAP client signing ensures that LDAP communication between clients and domain controllers is signed, protecting against man-in-the-middle attacks and data tampering. If not addressed (disabled): Lack of LDAP signing leaves LDAP traffic vulnerable to interception and modification, potentially exposing sensitive information and enabling credential theft or unauthorized access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OUs or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: LDAP client signing requirements- 5. Set the Policy: Configure it to Require signing to enforce LDAP signing. 6. Link GPO to Target OU: Ensure the GPO is linked to organizational units with client machines. 7. Force Group Policy Update: Run gpupdate /force on affected clients to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is active. 9. Test LDAP Connectivity: Verify that clients can still communicate with domain controllers without errors. 10. Document and Monitor: Document the implementation and monitor security logs for LDAP-related errors or authentication issues. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status Description If addressed (properly configured): Configuring minimum session security enforces encryption and signing for NTLM SSP communication, protecting data integrity and confidentiality during authentication and RPC sessions. If not addressed (not configured or disabled): Lack of minimum session security leaves NTLM SSP communications vulnerable to interception, replay, and man-in-the-middle attacks, compromising sensitive authentication data. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target OUs or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Minimum session security for NTLM SSP based (including secure RPC) clients- 5. Configure the Setting: Enable options for Require NTLMv2 session security, Require 128-bit encryption, and Require session signing to enforce strong security. 6. Link GPO to Target OU: Ensure the GPO applies to the relevant client computers. 7. Force Group Policy Update: Run gpupdate /force on client machines to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Connectivity: Validate that NTLM authentication and RPC communication works correctly with the enforced session security. 10. Document and Monitor: Record the changes and monitor authentication and RPC logs for errors or potential issues. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status Description If addressed (properly configured): Enforcing minimum session security on NTLM SSP servers ensures that all incoming NTLM authentication and secure RPC sessions require encryption and signing, reducing the risk of man-in-the-middle attacks and data tampering. If not addressed (not configured or disabled): Without this enforcement, NTLM authentication and RPC sessions can occur without adequate protection, making servers vulnerable to interception, replay attacks, and unauthorized access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OU or domain containing servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Minimum session security for NTLM SSP based (including secure RPC) servers- 5. Configure the Setting: Enable options to Require NTLMv2 session security, Require 128-bit encryption, and Require session signing to enforce strong session security on servers. 6. Link GPO to Target OU: Link the GPO to the OUs containing server computers. 7. Force Group Policy Update: Run gpupdate /force on the target servers to apply the new settings immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard on servers to confirm the policy is applied. 9. Test Authentication and RPC: Validate that server services relying on NTLM SSP and RPC continue functioning with the enforced session security. 10. Document and Monitor: Record the change and monitor security and system logs for any authentication or RPC errors. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
System objects- Strengthen default permissions of internal system objects status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME System objects- Strengthen default permissions of internal system objects status Description If addressed (enabled): Strengthening default permissions on internal system objects prevents unauthorized users or processes from modifying critical system objects, enhancing overall system security and stability. If not addressed (disabled or not configured): Weak default permissions can allow malicious actors or software to alter or exploit system objects, potentially leading to privilege escalation, system compromise, or denial of service. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target domain or OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ystem objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)- 5. Enable the Setting: Set this policy to Enabled to strengthen default permissions. 6. Link the GPO: Apply the GPO to the appropriate domain, sites, or OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected systems to apply the change immediately. 8. Verify the Setting: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Audit System Object Permissions: Optionally review permissions on internal system objects to ensure they reflect strengthened defaults. 10. Document and Monitor: Record the implementation and monitor event logs for unusual activity related to system object permissions. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Admin Approval Mode for the Built-in Administrator account status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Admin Approval Mode for the Built-in Administrator account status Description If addressed (enabled): Enabling Admin Approval Mode for the built-in Administrator account enforces User Account Control (UAC) prompts for administrative actions, reducing the risk of unauthorized or accidental changes and limiting malware impact. If not addressed (disabled): Without Admin Approval Mode, the built-in Administrator account runs with full privileges all the time, increasing the risk of unmonitored administrative actions, privilege escalation, and malware persistence. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ser Account Control: Admin Approval Mode for the Built-in Administrator account- 5. Enable the Setting: Set it to Enabled. 6. Link the GPO: Ensure the GPO is linked to the domain or OU containing the systems where the built-in Administrator account is used. 7. Force Group Policy Update: Run gpupdate /force on affected systems to apply the new setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test UAC Behavior: Log in as the built-in Administrator and verify that UAC prompts appear for administrative tasks. 10. Document and Monitor: Document the change and monitor for any administrative or system errors that may indicate policy conflicts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status Description If addressed (properly defined): Defining the elevation prompt behavior ensures that administrators receive consistent, secure prompts before performing tasks requiring elevated privileges, reducing the risk of accidental or unauthorized elevation. If not addressed (undefined or misconfigured): Undefined or insecure prompt behavior can lead to silent elevation, increasing the risk of unauthorized system changes, privilege escalation, and malware exploiting elevated privileges without user awareness. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ser Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode- 5. Configure the Setting: Set the prompt behavior to a secure option such as Prompt for consent or Prompt for credentials, depending on your security requirements. 6. Link the GPO: Apply the GPO to the relevant OUs or domains containing administrator accounts. 7. Force Group Policy Update: Run gpupdate /force on target computers to immediately enforce the new policy. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to ensure the setting is active. 9. Test Elevation Prompts: Log in as an administrator and perform tasks requiring elevation to confirm the prompt behaves as configured. 10. Document and Monitor: Record the configuration change and monitor logs or user feedback for any issues with elevation prompts. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Behavior of the elevation prompt for standard users status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Behavior of the elevation prompt for standard users status Description If addressed (properly defined): Defining the elevation prompt behavior for standard users ensures that administrative tasks require explicit credentials, preventing unauthorized privilege escalation and reinforcing least privilege principles. If not addressed (undefined or misconfigured): If this setting is not defined, standard users may be allowed to bypass elevation prompts or receive inconsistent behavior, increasing the risk of security breaches and malware executing with elevated privileges. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC from a domain controller or an admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the appropriate OU or domain. 3. Navigate to the Setting Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find: -ser Account Control: Behavior of the elevation prompt for standard users- 5. Set the Policy:Configure the setting to Automatically deny elevation requests (recommended for most secure environments) or Prompt for credentials on the secure desktop if users should be allowed to elevate with credentials. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link GPO to Target OU or Domain: Attach the GPO to the organizational unit(s) that contain the target standard user computers. 8. Force Group Policy Update: Run gpupdate /force on client machines or wait for the next policy refresh cycle. 9. Verify the Policy: Use gpresult /r or the Group Policy Results Wizard to confirm the policy has applied correctly. 10. Document and Monitor: Log the policy change, and monitor audit and security logs for any denied elevation attempts or unexpected behavior. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Detect application installations and prompt for elevation status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Detect application installations and prompt for elevation status Description If addressed (enabled): Enabling this setting ensures that application installation attempts are automatically detected and trigger an elevation prompt, helping prevent unauthorized or silent installations by non-admin users or malware. If not addressed (disabled or undefined): If this setting is not defined, standard users may install applications without administrative approval, increasing the risk of malware infections, software conflicts, or system instability. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one applied to the relevant domain or OU. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Detect application installations and prompt for elevation- 5. Enable the Setting:Set this policy to Enabled to ensure elevation prompts appear for app installs. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link the GPO to Target OU/Domain: Attach the GPO to the appropriate OU(s) where user workstations reside. 8. Force Group Policy Update: Run gpupdate /force on affected machines or allow automatic policy refresh. 9. Test Behavior: Attempt a non-admin software installation on a standard user account to ensure it prompts for admin credentials. 10. Document and Monitor: Record the change and review application logs for any unauthorized installation attempts or elevation denials. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Only elevate UIAccess applications that are installed in secure locations status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Only elevate UIAccess applications that are installed in secure locations status Description If addressed (enabled): Enabling this setting ensures that only UIAccess applications installed in secure directories (e.g., Program Files or Windows\System32) can be elevated, preventing unauthorized or malicious UIAccess apps from gaining elevated privileges. If not addressed (disabled or not configured): If this setting is not enabled, attackers could place UIAccess applications in non-secure locations (like temp folders or user profiles) to exploit UAC and gain elevated access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch the GPMC from a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to user computers or the domain. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Only elevate UIAccess applications that are installed in secure locations- 5. Enable the Setting:Set it to Enabled to enforce secure location requirements for UIAccess apps. 6. Apply the Setting: Click Apply and then OK to confirm. 7. Link the GPO to the Correct Scope: Attach the GPO to the organizational unit (OU) or domain containing the applicable machines. 8. Force Group Policy Update: Run gpupdate /force on target systems to apply the new policy immediately. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active on client systems. 10. Audit UIAccess Usage: Review systems to ensure UIAccess applications are only installed in secure paths, and adjust deployments if necessary. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Run all administrators in Admin Approval Mode status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Run all administrators in Admin Approval Mode status Description If addressed (enabled): Enabling this setting ensures that only UIAccess applications installed in secure directories (e.g., Program Files or Windows\System32) can be elevated, preventing unauthorized or malicious UIAccess apps from gaining elevated privileges. If not addressed (disabled or not configured): If this setting is not enabled, attackers could place UIAccess applications in non-secure locations (like temp folders or user profiles) to exploit UAC and gain elevated access. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch the GPMC from a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to user computers or the domain. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Only elevate UIAccess applications that are installed in secure locations- 5. Enable the Setting:Set it to Enabled to enforce secure location requirements for UIAccess apps. 6. Apply the Setting: Click Apply and then OK to confirm. 7. Link the GPO to the Correct Scope: Attach the GPO to the organizational unit (OU) or domain containing the applicable machines. 8. Force Group Policy Update: Run gpupdate /force on target systems to apply the new policy immediately. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active on client systems. 10. Audit UIAccess Usage: Review systems to ensure UIAccess applications are only installed in secure paths, and adjust deployments if necessary. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
User Account Control- Virtualize file and registry write failures to per-user locations status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME User Account Control- Virtualize file and registry write failures to per-user locations status Description If addressed (enabled): Enabling this setting ensures that legacy applications that try to write to protected system locations (like Program Files or HKLM) are redirected (virtualized) to per-user locations, allowing them to function without compromising system security. If not addressed (disabled): Disabling this setting can cause legacy or poorly written applications to fail when attempting restricted writes, potentially leading to application crashes or user complaints, or worse-ncouraging users to run apps with full admin rights, increasing security risk. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC from a domain controller or an administrative machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the appropriate OU or domain. 3. Navigate to Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options 4. Find the Setting:Locate -ser Account Control: Virtualize file and registry write failures to per-user locations-5. Enable the Setting:Set the policy to Enabled. 6. Click Apply and OK: Save the configuration changes. 7. Link the GPO: Attach the GPO to the OU or domain where target systems reside. 8. Force Group Policy Update: On target machines, run gpupdate /force or wait for the next refresh cycle. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 10. Test with Legacy Applications: Run older applications to ensure they operate correctly without requiring elevated privileges, confirming virtualization is functioning. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Credential Validation status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Credential Validation status Description If addressed (configured): Configuring audit for Credential Validation allows security teams to monitor and detect credential-based attacks (e.g., brute force, pass-the-hash, or account lockouts) through detailed logon event records. If not addressed (not configured): Without this audit, malicious authentication attempts may go unnoticed, making it difficult to identify or respond to credential misuse, compromise, or policy violations. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the domain or OU where systems reside. 3. Navigate to the Audit Policy Location:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Find the Setting:Locate -udit Credential Validation- 5. Configure the Setting:Set the policy to Success and Failure to log both successful and failed credential validations. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link the GPO to the Correct Scope: Attach the GPO to the appropriate domain or organizational unit (OU). 8. Force Group Policy Update: Run gpupdate /force on the target systems or allow the policy to refresh naturally. 9. Verify via Event Viewer:After policy application, confirm the setting is active by checking for Event ID 4776 in the Security Log on the system under Event Viewer > Windows Logs > Security. 10. Monitor and Alert:Configure your SIEM or log management system to alert on suspicious patterns in credential validation events (e.g., repeated failures or unusual account activity). Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Computer Account Management status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Computer Account Management status Description If addressed (configured): Enabling auditing for Computer Account Management ensures that creation, deletion, modification, or renaming of computer accounts in Active Directory is logged, supporting security auditing, incident response, and change tracking. If not addressed (not configured): Without this audit policy, changes to computer accounts may go undetected, increasing the risk of unauthorized device registrations or malicious tampering within AD. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Open GPMC from a domain controller or admin system. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the domain or appropriate OU. 3. Navigate to Audit Policy Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Setting:Locate -udit Computer Account Management- 5. Enable the Setting:Set it to Success and Failure to capture both successful and failed attempts to manage computer accounts. 6. Apply the Setting: Click Apply and OK. 7. Link the GPO Appropriately: Attach the GPO to OUs or domains that contain systems and administrative workstations managing AD accounts. 8. Force Group Policy Update: On client systems, run gpupdate /force or allow policies to refresh on schedule. 9. Verify with Event Viewer:After changes, open Event Viewer and look for logs under Security with: -- Event ID 4741: A computer account was created -- Event ID 4742: A computer account was changed -- Event ID 4743: A computer account was deleted 10. Integrate with Monitoring Tools: Configure your SIEM or log management tool to alert on these event IDs for better oversight and incident response. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Other Account Management Events status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Other Account Management Events status Description If addressed (configured): Enabling Audit Other Account Management Events ensures actions such as password resets, user account disablement, or changes to user group memberships are logged, which is critical for tracking administrative changes and detecting insider threats. If not addressed (not configured): Without this auditing, important account changes could go unnoticed, reducing visibility into potential misuse of privileges and hampering forensic investigations. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to the relevant OU or domain. 3. Navigate to the Audit Settings Path:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Setting:Locate -udit Other Account Management Events- 5. Enable the Setting:Set it to Success and Failure to log both successful and failed attempts. 6. Apply the Setting: Click Apply and OK to save. 7. Link the GPO to Target Systems: Attach the GPO to the OU or domain containing the systems where auditing is required. 8. Update Group Policy on Clients: Run gpupdate /force on affected machines or allow the policy to apply at the next refresh cycle. 9. Verify via Event Viewer:Look for relevant events in Event Viewer under Security, such as: -1. Event ID 4724: Password reset -2. Event ID 4725: User account disabled -3. Event ID 4726: User account deleted -4. Event ID 4738: User account changed 10. Integrate with SIEM or Alerts: Set up log monitoring and alerting in your SIEM solution for these events to detect abnormal or unauthorized account activity Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Security Group Management status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Security Group Management status Description If addressed (configured): Enabling Audit Security Group Management ensures all changes to security groups (creation, deletion, membership changes) are logged, which is essential for detecting privilege escalation, unauthorized access, and compliance tracking. If not addressed (not configured): Without this audit, malicious or accidental changes to security groups (e.g., adding a user to Domain Admins) may go unnoticed, leading to potential data breaches or administrative misuse. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Open GPMC on a domain controller or a system with RSAT tools installed. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the relevant OU or domain. 3. Navigate to Audit Policy Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Locate the Setting:Find -udit Security Group Management- 5. Enable the Setting:Set it to Success and Failure to capture both successful and failed group management events. 6. Apply the Policy: Click Apply and OK to save your changes. 7. Link the GPO: Attach the GPO to the domain or OU where the target systems reside. 8. Force a Group Policy Update: Run gpupdate /force on affected systems or wait for the next policy refresh cycle. 9. Verify via Event Viewer:On a domain controller or relevant system, check Event Viewer > Security Logs for: -1. Event ID 4731: Security group created -2. Event ID 4732: Member added to a security group -3. Event ID 4733: Member removed from a security group -4. Event ID 4735/4734/4737/4755 for other related changes 10. Enable Monitoring or Alerting: Configure your SIEM or monitoring tools to trigger alerts on group changes-specially to privileged groups like Domain Admins or Enterprise Admins. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit User Account Management status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit User Account Management status Description If addressed (configured): Enabling Audit User Account Management ensures that key changes to user accounts-uch as creation, deletion, password resets, and account disables-re logged for accountability, forensic investigations, and compliance. If not addressed (not configured): Without this setting, unauthorized or accidental modifications to user accounts may go undetected, increasing the risk of privilege misuse, insider threats, or audit failures. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or admin workstation, open GPMC. 2. Create or Edit a GPO: Either create a new Group Policy Object or edit an existing one linked to the relevant OU or domain. 3. Navigate to Audit Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Policy Setting:Locate -udit User Account Management-in the right pane. 5. Configure the Setting:Set it to Success and Failure to audit both successful and failed attempts. 6. Apply the Setting: Click Apply and then OK to save your changes. 7. Link the GPO: Attach the GPO to the domain or OU where the target systems (e.g., domain controllers) reside. 8. Update Group Policy: Run gpupdate /force on affected systems to apply the changes immediately, or wait for the standard refresh cycle. 9. Verify in Event Viewer:On domain controllers, check Event Viewer > Security Logs for the following IDs: -1. 4720: A user account was created -2. 4722: A user account was enabled -3. 4723/4724: Password change/reset -4. 4725: A user account was disabled -5. 4726: A user account was deleted -6. 4738: A user account was changed 10. Enable Log Monitoring: Use your SIEM or log monitoring tool to trigger alerts for high-impact changes Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit PNP Activity status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit PNP Activity status Description If addressed (configured): Enabling Audit PnP (Plug and Play) Activity helps track device installations and removals on systems, allowing detection of unauthorized or suspicious hardware changes that could indicate security breaches or policy violations. If not addressed (not configured): Without auditing PnP activity, unauthorized devices might be connected without detection, increasing the risk of data exfiltration, malware introduction, or hardware-based attacks. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Choose an existing Group Policy Object linked to relevant systems or create a new one. 3. Navigate to Audit Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking 4. Locate the Setting: Find -udit PNP Activity- 5. Configure Audit PNP Activity: Set this policy to Success and Failure to capture all Plug and Play device events. 6. Apply and Save: Click Apply and OK to save the configuration. 7. Link the GPO: Ensure the GPO is linked to the appropriate organizational units or domain containing target machines. 8. Force Group Policy Update: Run gpupdate /force on client systems or wait for the automatic policy refresh. 9. Verify Audit Logs: On audited systems, check Event Viewer > Security Logs for events related to device installation/removal, typically Event IDs like 20001 (PnP Device Install). 10. Monitor and Alert: Configure your SIEM or monitoring tool to flag unusual or unauthorized device activity for timely investigation. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Process Creation status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Process Creation status Description If addressed (configured): Enabling Audit Process Creation provides detailed logging of every process started on a system, which is crucial for detecting malicious activities, forensic analysis, and understanding system behavior. If not addressed (not configured): Without auditing process creation, attackers could execute malicious programs undetected, making it difficult to investigate security incidents or identify unauthorized software execution. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or admin workstation, launch GPMC. 2. Create or Edit a GPO: Select an existing Group Policy Object linked to the target systems or create a new one. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking 4. Find Audit Process Creation: Locate the policy named -udit Process Creation- 5. Enable Auditing: Set the policy to Success (and optionally Failure) to log when processes start. 6. Apply and Save: Click Apply and then OK. 7. Link the GPO: Ensure the GPO is linked to the relevant OUs or domain to apply to intended machines. 8. Force Policy Update: Run gpupdate /force on target machines or wait for the next group policy refresh. 9. Verify Event Logs: On systems, check Event Viewer > Security Logs for Event ID 4688, which records process creation details. 10. Set Up Monitoring: Configure your SIEM or security monitoring tool to alert on suspicious or unexpected process executions. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Directory Service Access status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Directory Service Access status Description If addressed (configured): Enabling Audit Directory Service Access allows monitoring and logging of access to Active Directory objects, which helps detect unauthorized changes or access attempts to sensitive directory data. If not addressed (not configured): Without auditing Directory Service access, malicious or accidental changes to AD objects could go unnoticed, increasing the risk of privilege escalation, data compromise, and compliance violations. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Directory Service Access: Set -udit Directory Service Access-to Success and Failure to log all access attempts. 5. Apply and Save: Click Apply and OK. 6. Enable Object Access Auditing: Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policyand ensure -udit Object Access-is enabled. 7. Configure Auditing on AD Objects: Using Active Directory Users and Computers (ADUC), enable auditing on sensitive AD objects by setting their Auditing tab permissions (Advanced Security Settings). 8. Link the GPO: Ensure the GPO is linked to the OU containing your domain controllers. 9. Force Policy Update: Run gpupdate /force on domain controllers or wait for automatic refresh. 10. Review Logs: Check Event Viewer > Security Logs on domain controllers for Event IDs like 4662 that indicate directory service object access. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Directory Service Changes status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Directory Service Changes status Description If addressed (configured): Enabling Audit Directory Service Changes ensures that all modifications to Active Directory objects (such as user accounts, groups, and policies) are logged, helping detect unauthorized or accidental changes that could compromise security. If not addressed (not configured): Without auditing directory service changes, malicious modifications could occur without detection, increasing the risk of privilege escalation, data breaches, and compliance failures. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Directory Service Changes: Set -udit Directory Service Changes-to Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Enable Audit Object Access: Ensure that Audit Object Access is enabled under:Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy 7. Configure Auditing on AD Objects: Using Active Directory Users and Computers (ADUC), enable auditing on the directory objects where changes must be tracked by modifying the Auditing tab in the object- properties. 8. Link the GPO: Link the GPO to the Organizational Units containing domain controllers. 9. Force Group Policy Update: Run gpupdate /force on domain controllers or wait for the next automatic refresh cycle. 10. Review Event Logs: Monitor the Security event logs on domain controllers for event IDs like 5136 which capture directory service changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Group Membership status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Group Membership status Description If addressed (configured): Enabling Audit Group Membership provides detailed logging of changes to group memberships, which helps detect unauthorized privilege escalations and maintain the integrity of access controls. If not addressed (not configured): Without auditing group membership changes, malicious additions or removals of users from sensitive groups can go unnoticed, increasing risk of insider threats and security breaches. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Group Membership: Set -udit Group Membership-to Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Enable Audit Directory Service Access: Confirm that Audit Directory Service Access is enabled to capture detailed changes. 7. Configure Object-level Auditing: Use Active Directory Users and Computers (ADUC) to enable auditing on critical groups by configuring the Auditing tab on group objects. 8. Link the GPO: Ensure the GPO is linked to the OU containing the domain controllers. 9. Force Group Policy Update: Run gpupdate /force on domain controllers or wait for the next policy refresh. 10. Review Event Logs: Monitor Security logs for event IDs such as 4728, 4729, 4732, and 4733 which indicate changes in group memberships. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Logon status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Logon status Description If addressed (configured): Enabling Audit Logon provides visibility into all user logon and logoff activities, enabling detection of unauthorized access attempts and forensic investigations. If not addressed (not configured): Without auditing logon events, suspicious or malicious login attempts may go unnoticed, increasing the risk of undetected breaches and insider threats. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or an administrative machine. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Logon: Configure -udit Logon-for both Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Verify Related Audit Policies: Ensure Audit Account Logon and Audit Logon/Logoff policies are also enabled for comprehensive tracking. 7. Link the GPO: Ensure the GPO is linked to the OU that contains the relevant systems (especially domain controllers). 8. Force Group Policy Update: Run gpupdate /force on affected machines or wait for the automatic update. 9. Monitor Event Logs: Check the Security event log for event IDs such as 4624 (successful logon) and 4625 (failed logon). 10. Configure Alerting and Reporting: Set up SIEM or monitoring tools to alert on unusual logon activity patterns, like multiple failed logins or logins outside business hours. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Other Logon/Logoff Events status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Other Logon/Logoff Events status Description If addressed (configured): Enabling Audit Other Logon and Logoff Events provides comprehensive logging of additional logon and logoff activities such as network connections, remote desktop sessions, and special system logons, improving detection of suspicious or unauthorized access. If not addressed (not configured): Without auditing these events, certain types of access may not be tracked, creating blind spots that attackers could exploit to move laterally or maintain persistence unnoticed. Recommendation and Steps orkstation, launch GPMC. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the relevant Organizational Unit (OU), especially where domain controllers or critical servers reside. 3. Navigate to Audit Policies:Path:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Other Logon/Logoff Events: Set this policy to audit Success and Failure. 5. Apply and Save: Click Apply and OK to save the settings. 6. Verify Related Audit Policies: Confirm Audit Logon and Audit Account Logon policies are also configured for full coverage. 7. Link the GPO: Ensure the policy is linked to OUs containing domain controllers and servers where auditing is critical. 8. Force Group Policy Update: Execute gpupdate /force on target machines to immediately apply changes. 9. Review Event Logs: Monitor Security logs for event IDs like 4647 (user initiated logoff), 4634 (logoff), and other relevant logon/logoff events. 10. Configure Alerts: Integrate with SIEM solutions or monitoring tools to alert on unusual or suspicious logon/logoff behaviors for timely incident response. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Special Logon status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Special Logon status Description If addressed (configured): Enabling Audit Special Logon captures important events such as logons by users with elevated privileges (e.g., administrators) or service accounts, helping detect unauthorized privilege escalation or suspicious activities. If not addressed (not configured): Without auditing special logons, malicious use of privileged accounts or service accounts can go unnoticed, increasing the risk of undetected attacks and privilege misuse. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Choose an existing Group Policy Object linked to domain controllers or create a new one. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Special Logon: Set the policy to audit both Success and Failure events. 5. Apply and Save: Confirm changes by clicking Apply and OK. 6. Link GPO Appropriately: Make sure this GPO is linked to the OU containing your domain controllers and critical servers. 7. Force Group Policy Update: Run gpupdate /force on affected machines to apply immediately. 8. Verify Event Log Entries: Look for Security event ID 4672, which indicates special logon events. 9. Configure Monitoring: Set up alerts in your SIEM to flag unusual or unexpected special logons for further investigation. Review Regularly: Periodically audit and review special logon events to detect possible unauthorized privileged access. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Detailed File Share status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Detailed File Share status Description If addressed (configured): Enabling detailed file share auditing provides visibility into access and changes to shared files and folders, helping detect unauthorized or malicious activity on critical data. If not addressed (not configured): Lack of detailed auditing on file shares can lead to undetected unauthorized access or data leakage, increasing the risk of data breaches and non-compliance with security policies. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Access GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Select an existing GPO linked to file servers or create a new one. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Enable Audit Detailed File Share: Configure Audit File Share for both Success and Failure. 5. Apply and Save: Click Apply and OK to save the settings. 6. Enable Auditing on Shared Folders: On each file server, right-click the shared folder > Properties > Security tab > Advanced > Auditing tab. 7. Add Auditing Entries: Add the users or groups to audit (e.g., Everyone), and select successful and failed accesses like read, write, delete, etc. 8. Force Group Policy Update: Run gpupdate /force on the file servers to enforce the policy immediately. 9. Verify Event Logs: Check the Security logs for event IDs such as 5140 (a network share object was accessed). 10. Set up Monitoring: Configure SIEM or alerting tools to monitor suspicious or unauthorized file share activity. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit File Share status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit File Share status Description If addressed: Enabling Audit File Share allows organizations to track access to shared folders and files, which helps detect unauthorized access, data exfiltration attempts, and supports compliance requirements. If not addressed: Without auditing, malicious or accidental access to sensitive shared data may go unnoticed, increasing the risk of data breaches and non-compliance with security standards. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Log in to a domain controller or management workstation. 2. Create or edit a Group Policy Object (GPO): Target the policy to computers hosting file shares. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Enable -udit File Share-policy: Configure it for Success and Failure to capture all access attempts. 5. Apply and close the GPO editor: Save the settings. 6. Force a Group Policy update: Run gpupdate /force on affected file servers. 7. Enable auditing on specific shared folders: Right-click the folder > Properties > Security tab > Advanced > Auditing tab. 8. Add auditing entries: Add relevant users/groups (e.g., Everyone or specific groups) and select the types of access to audit (e.g., Read, Write). 9. Verify audit logs: Use Event Viewer on file servers to review Security logs for event ID 5140 (network share object access). 10. Integrate with monitoring tools: Set up alerts in your SIEM or security monitoring platform to detect suspicious or unauthorized access events. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Other Object Access Events status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Other Object Access Events status Description If addressed: Configuring audit for other object access events ensures that access and modifications to system objects like registry keys, printers, or kernel objects are logged, improving visibility into potentially malicious or unauthorized activities. If not addressed: Lack of auditing for these object types can result in blind spots where critical system changes go unnoticed, increasing the risk of undetected compromises or policy violations. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or management workstation. 2. Create or edit a Group Policy Object (GPO): Target it to relevant computers (e.g., domain controllers, servers). 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Locate -udit Other Object Access Events- This policy controls auditing for object types not covered by other audit policies. 5. Enable this policy: Configure for Success and Failure to capture all relevant events. 6. Apply and close the GPO editor: Save the settings. 7. Force Group Policy update: Run gpupdate /force on target systems. 8. Verify local security policy: Check under Local Security Policy > Advanced Audit Policy Configuration to confirm the setting is applied. 9. Review Event Viewer logs: Look for relevant event IDs (e.g., 4656, 4663) related to object access under the Security log. 10. Integrate with monitoring systems: Configure alerts or dashboards in SIEM tools to detect suspicious object access or changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Removable Storage status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Removable Storage status Description If addressed: Enabling audit for removable storage devices helps track usage of USB drives, external hard disks, and other removable media, providing visibility into potential data exfiltration or malware introduction vectors. If not addressed: Without auditing removable storage, organizations risk undetected unauthorized data transfers or malware infections via external devices, leading to data breaches or system compromises. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or management machine. 2. Create or edit a Group Policy Object (GPO): Target the computers or organizational units where you want to enforce the setting. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Find and select -udit Removable Storage- This policy audits events related to removable storage device access. 5. Enable the policy: Set to audit Success and Failure events to capture all access attempts. 6. Apply and close the Group Policy editor. 7. Force Group Policy update: Run gpupdate /force on the targeted systems to apply changes immediately. 8. Verify the setting on target machines: Use auditpol /get /subcategory:Removable Storage in Command Prompt to confirm. 9. Monitor Security Event Logs: Look for event IDs like 4663, which indicate access to removable storage devices. 10.Integrate logs with SIEM or monitoring tools: Set up alerts for suspicious removable media usage to detect potential data leaks or malware introduction. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Audit Policy Change status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Audit Policy Change status Description If addressed: Configuring audit for policy changes ensures that any modifications to audit policies are logged, providing visibility into potential tampering or unauthorized changes that could hide malicious activity. If not addressed: Without auditing audit policy changes, attackers or insiders can alter or disable audit settings to avoid detection, increasing the risk of undetected security breaches. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): Access this on a domain controller or management workstation. 2. Create or edit an existing Group Policy Object (GPO): Target the domain or organizational units as needed. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Locate -udit Audit Policy Change- This controls logging of changes to audit policies. 5. Enable auditing: Configure both Success and Failure audit settings to log all changes. 6. Apply and save the GPO. 7. Force update Group Policy: Run gpupdate /force on affected computers. 8. Verify the policy application: Use auditpol /get /category:Policy Change to confirm settings on target machines. 9. Monitor Security Event Logs: Check for event ID 4719 which logs audit policy changes. 10.Set up alerts: Integrate with SIEM or monitoring tools to notify admins of any changes to audit policies. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Authentication Policy Change status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Authentication Policy Change status Description If addressed: Enabling auditing for authentication policy changes provides visibility into modifications of authentication methods, helping detect unauthorized or malicious alterations that could weaken security. If not addressed: Without this audit, attackers may change authentication policies undetected, potentially allowing easier unauthorized access and increasing risk of credential compromise. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or administrative workstation. 2. Create or edit a Group Policy Object (GPO): Apply it to the domain or specific OUs as needed. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Find -udit Authentication Policy Change- This setting controls auditing of authentication policy changes. 5. Enable auditing for both Success and Failure events: This ensures all changes are logged. 6. Apply and save the GPO. 7. Force Group Policy update: Run gpupdate /force on target computers. 8. Verify policy settings: Use the command auditpol /get /subcategory:Authentication Policy Change to confirm the audit is enabled. 9. Monitor Security Event Logs: Look for Event ID 4704, which records changes to authentication policies. 10. Implement alerting: Set up alerts in SIEM or monitoring tools for immediate notification on authentication policy changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit MPSSVC Rule-Level Policy Change status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit MPSSVC Rule-Level Policy Change status Description If addressed: Enabling audit for MPSSVC (Microsoft Protection Service) rule-level policy changes ensures that any modifications to Windows Firewall rules are logged, helping detect unauthorized or accidental security changes. If not addressed: Without auditing, changes to firewall rules may go unnoticed, potentially exposing systems to attacks or allowing malicious traffic through, increasing the risk of breaches. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or admin machine. 2. Create or edit a Group Policy Object (GPO): Target it to the relevant organizational units or computers. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Locate -udit MPSSVC Rule-Level Policy Change- This controls auditing for Windows Firewall rule changes. 5. Enable auditing for both Success and Failure events: To track all changes effectively. 6. Save and apply the GPO. 7. Force Group Policy update: Run gpupdate /force on the target computers. 8. Verify the audit setting: Use the command auditpol /get /subcategory:MPSSVC Rule-Level Policy Change to confirm it is enabled. 9. Monitor Security Event Logs: Watch for Event ID 4946 and related events indicating rule-level changes. 10. Set up alerts or automated notifications: Use SIEM tools to get immediate alerts on policy changes for faster incident response. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Other Policy Change Events status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Other Policy Change Events status Description If addressed: Configuring audit for Other Policy Change Events ensures that any modifications to security or system policies not covered by other audit categories are logged, providing comprehensive visibility into policy changes. If not addressed: Lack of auditing may allow unauthorized or accidental policy changes to go undetected, increasing the risk of security misconfigurations and potential breaches. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO): Target the appropriate OU or domain. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Find and select -udit Other Policy Change Events- This setting covers policy changes not included in other categories. 5. Enable auditing for Success and Failure: Ensuring all policy change attempts are logged. 6. Apply and save the GPO. 7. Force Group Policy update on target systems: Run gpupdate /force. 8. Verify audit settings: Use auditpol /get /subcategory:Other Policy Change Events to confirm it- enabled. 9. Review Security Event Logs regularly: Look for event IDs related to policy changes (e.g., 4739 or similar). 10. Implement monitoring and alerting: Use SIEM or Windows Event Forwarding to detect and respond to suspicious policy changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Sensitive Privilege Use status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Sensitive Privilege Use status Description If addressed: Enabling auditing for sensitive privilege use allows organizations to monitor and log whenever critical privileges (like SeDebugPrivilege, SeTakeOwnershipPrivilege) are used, enhancing detection of potential privilege abuse or malicious activity. If not addressed: Without auditing, unauthorized or malicious use of sensitive privileges may go unnoticed, increasing the risk of privilege escalation attacks and insider threats. Recommendation and Steps 1. Open Group Policy Management Console (GPMC): On a domain controller or an administrative workstation. 2. Create or edit a Group Policy Object (GPO): Apply it to the desired domain, site, or OU. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Privilege Use 4. Locate Audit Sensitive Privilege Use: This controls logging of usage of sensitive privileges. 5. Enable auditing for both Success and Failure events: To log both successful and failed attempts. 6. Apply and save the GPO changes. 7. Force policy update on target machines: Run gpupdate /force from command prompt. 8. Verify auditing is enabled: Use the commandauditpol /get /subcategory:Sensitive Privilege Useto confirm. 9. Regularly monitor Security Event Logs: Look for event ID 4674 which logs sensitive privilege usage. 10. Implement alerts and integrate with SIEM: Set up monitoring tools to notify administrators of suspicious privilege use for rapid response. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Other System Events status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Other System Events status Description If addressed: Configuring auditing for other system events ensures that important but less common system activities (like system shutdowns, driver installations, or changes in system state) are logged, aiding in comprehensive security monitoring and forensic investigations. If not addressed: Failure to audit these events can result in missing critical indicators of system compromise or improper changes, weakening overall security posture and incident detection. Recommendation and Steps 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit a Group Policy Object (GPO) linked to the relevant OU, domain, or site. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Find and select Audit Other System Events. 5. Enable auditing for both Success and Failure events to capture all relevant activity. 6. Apply and save the GPO changes. 7. On target systems, run gpupdate /force in Command Prompt to enforce the policy immediately. 8. Verify auditing status using the command:auditpol /get /subcategory:Other System Events 9. Review Security Event Logs regularly for event IDs related to system events (e.g., event IDs 4608, 4609, 4616). 10. Integrate logs with a SIEM or monitoring tool to alert on suspicious or unusual system event activity promptly. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Security State Change status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Security State Change status Description If addressed: Enabling auditing for Security State Changes provides visibility into critical changes to the security subsystem, such as security policy modifications or security system shutdowns, which helps detect unauthorized or malicious activity. If not addressed: Without auditing Security State Changes, important security modifications may go unnoticed, increasing the risk of undetected breaches or policy tampering that could compromise system integrity. Recommendation and Steps 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO) linked to the domain, OU, or site where target systems reside. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Locate Audit Security State Change subcategory. 5. Enable auditing for both Success and Failure events to capture all security state changes. 6. Apply and save the GPO. 7. On target systems, run gpupdate /force to immediately enforce the new audit settings. 8. Verify the audit policy is applied by running:auditpol /get /subcategory:Security State Change 9. Regularly monitor the Security Event Logs for relevant event IDs such as 5038, which indicates security state changes. 10. ntegrate logs into a Security Information and Event Management (SIEM) tool to generate alerts for suspicious or unauthorized security state changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit Security System Extension status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit Security System Extension status Description If addressed: Enabling auditing for Security System Extensions helps track the loading and unloading of security-related system extensions, aiding in detecting unauthorized or malicious components that could compromise system security. If not addressed: Without this auditing, malicious or unauthorized security extensions might be installed or removed without detection, increasing the risk of persistent threats or system compromise. Recommendation and Steps 1. Open the Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO) linked to the relevant domain, OU, or site. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Find the subcategory Audit Security System Extension. 5. Set auditing to Success and Failure to capture all relevant events. 6. Click Apply and OK to save the settings. 7. On target machines, run gpupdate /force to immediately apply the updated policy. 8. Confirm the setting by running:auditpol /get /subcategory:Security System Extension 9. Monitor Security Event Logs for event IDs related to security system extension loading/unloading. 10.Use a SIEM solution to analyze these logs and alert on any suspicious or unauthorized activity. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Audit System Integrity status | High | Missing | Setting Status:Missing | MITREANSSI | NO |
X
TEST NAME Audit System Integrity status Description If addressed: Enabling Audit System Integrity helps detect and log attempts to violate system integrity, such as kernel code injections, unauthorized driver loads, or other tampering activities, improving early detection of attacks on core system components. If not addressed: Without this auditing, critical system integrity violations may go unnoticed, allowing attackers to compromise system trustworthiness and persist undetected. Recommendation and Steps 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative system. 2. Create a new or edit an existing Group Policy Object (GPO) linked to the appropriate domain or OU. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Locate the subcategory Audit System Integrity. 5. Configure it to audit Success and Failure events. 6. Apply and save the changes. 7. On target machines, run gpupdate /force to immediately update the policy. 8. Verify the audit policy by running:auditpol /get /subcategory:System Integrity 9. Review Windows Security Event Logs for events related to system integrity violations (e.g., Event ID 4611, 4612). 10. Implement monitoring and alerting via SIEM tools to detect and respond to integrity violations promptly. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Domain member- Digitally encrypt or sign secure channel data (always) status | Passed | Found | Setting Status:Found | MITREANSSI | YES |
X
TEST NAME Domain member- Digitally encrypt or sign secure channel data (always) status Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Microsoft network server- Digitally sign communications (always) status | Passed | Found | Setting Status:Found | MITREANSSI | YES |
X
TEST NAME Microsoft network server- Digitally sign communications (always) status Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Network security- Do not store LAN Manager hash value on next password change status | Passed | Found | Setting Status:Found | MITREANSSI | YES |
X
TEST NAME Network security- Do not store LAN Manager hash value on next password change status Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
Locked Out Accounts Found | Passed | 0 | Total Accounts Locked Out in All Domains:0 | MITREANSSI | YES |
X
TEST NAME Locked Out Accounts Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
| Microsoft-Recommended
|
Accounts with Extended Rights to Read LAPS Passwords Found | Critical | 1 | Illegal Accounts Found to read LAPS in AD Domains:1 | MITREANSSI | NO |
X
TEST NAME Accounts with Extended Rights to Read LAPS Passwords Found Description If Addressed: Ensures only authorized Users/groups can retrieve LAPS-managed local admin Passwords, protecting against privilege escalation. If Not Addressed: unauthorized Users may read local Administrator Passwords from AD and gain control over machines across the environment.J341 Recommendation and Steps Step 1: Confirm whether Local Administrator Password Solution (LAPS) is installed in the environment. Step 2: If LAPS is not installed, download the latest Microsoft LAPS installer from the official Microsoft website. Step 3: Install LAPS on management systems and extend the Active Directory schema using AdmPwd.PS PowerShell module (optional but recommended for better management). Step 4: After installation, ensure that the ms-Mcs-AdmPwd attribute exists in AD schema under computer objects. Step 5: Review Extended Rights permissions on the OU where computer accounts are located. Step 6: Open Active Directory Users and Computers (ADUC) with Advanced Features enabled. Step 7: Right-click the affected Organizational Unit (OU) and choose Properties > Security > Advanced. Step 8: Look for any accounts/groups that have -All Extended Rights- or -Read ms-Mcs-AdmPwd- permissions. Step 9: Remove these permissions from unauthorized accounts/groups (unless explicitly allowed like Helpdesk or Admins). Step 10: Retain permissions only for legitimate roles or groups designated to read local admin passwords. Step 11: Apply changes and ensure inheritance settings are properly configured. Step 12: Document the updated permissions and monitor regularly for any unauthorized changes. Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended
|
High Value Targets Found | High | 2 | Total High Value Targets Found:2 | MITREANSSI | NO |
X
TEST NAME High Value Targets Found Description If Addressed: Allows you to monitor and apply stricter policies to critical objects (admins, DCs, VIPs). If Not Addressed: High-value assets may remain unprotected, increasing risk of targeted attacks or data breaches. Recommendation and Steps Step 1: Identify all flagged High Value Targets (HVTs) such as Domain Admins, Enterprise Admins, etc. Step 2: Review group memberships and permissions assigned to each. Step 3: Ensure MFA is enforced on all HVT accounts. Step 4: Enable login auditing and alerting for all HVTs. Step 5: Prohibit HVTs from logging in to workstations or internet-facing systems. Step 6: Use tiered administrative model to segregate access levels. Step 7: Document ownership and business justification for each HVT. Step 8: Implement just-in-time access wherever possible. Step 9: Rotate passwords regularly or use passwordless options. Step 10: Review and revalidate HVTs quarterly. Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Group Policy Objects with Improper Permissions Found | Passed | 0 | Abusable GPO Permissions found in Total AD Domains:0 | MITREANSSI | YES |
X
TEST NAME Group Policy Objects with Improper Permissions Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended
|
Group Policy Object Assignments with Improper Permissions Found | Passed | 0 | Total Abusable GPO Permissions in AD Domains:0 | MITREANSSI | YES |
X
TEST NAME Group Policy Object Assignments with Improper Permissions Found Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| vuln_permissions_msdns
|
Dangerous Permissions Found on MicrosoftDNS Container | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Dangerous Permissions Found on MicrosoftDNS Container Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_permissions_msdns
|
| vuln_permissions_naming_context
|
Dangerous Permissions Found on Naming Contexts | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Dangerous Permissions Found on Naming Contexts Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_permissions_naming_context
|
| vuln_compatible_2000_anonymous
|
Pre-Windows 2000 Compatible Access Group is not empty | Passed | 0 | Number of AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Pre-Windows 2000 Compatible Access Group is not empty Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_compatible_2000_anonymous
|
| vuln_sidhistory_present
|
Found Groups with SID history Set | Passed | 0 | Total Groups With sIDHistory Affected domains:0 | MITREANSSI | YES |
X
TEST NAME Found Groups with SID history Set Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDvuln_sidhistory_present
|
| Microsoft-Recommended | Abusable Permissions Found on SYSVOL and NETLOGON | Passed | Ok | Abusable Permissions Found on SYSVOL and Netlogon Shares:Ok | MITREANSSI | YES |
X
TEST NAME Abusable Permissions Found on SYSVOL and NETLOGON Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
More Information TEST IDMS-RECOMMENDED
|
| Microsoft-Recommended | LAPS SearchFlag modified | Passed | Not Modified | LAPS SearchFlags Modified:Not Modified | MITREANSSI | YES |
| Microsoft-Recommended | Unauthorized Users having GPLink Rights on Domain NC | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Unauthorized Users having GPLink Rights on Domain NC Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Unauthorized Users having GPLink Rights on Domain Controllers OU | Passed | 0 | AD Domains Affected:0 | MITREANSSI | YES |
X
TEST NAME Unauthorized Users having GPLink Rights on Domain Controllers OU Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Microsoft-Recommended | Unauthorized Users having GPLink Rights on AD Sites | Passed | 0 | AD Sites Affected:0 | MITREANSSI | YES |
X
TEST NAME Unauthorized Users having GPLink Rights on AD Sites Description Test has passed. Recommendation and Steps NA Associated Objects Per Domain/AD Forest
Affected Objects
|
| Security Framework & Link | Test | Severity | Items | Affected Objects | Control Type | Configured Correctly? |
#TABLE_AD-FEATURES1#TABLE_RISKY-ITEMS2#TABLE_AD-SECURITY-RISKS-USERS3#TABLE_AD-SECURITY-RISKS-COMPUTERS4#TABLE_AD-SECURITY-RISKS-ADMINS5#TABLE_AD-SECURITY-RISKS-OBJECTS-OWNERSHIP6#TABLE_SENSITIVE-CHANGES7#TABLE_CRITICAL-ACCOUNTS-STATUS8#TABLE_PRIVILEGED-ACCOUNTS9#TABLE_DOMAIN-POLICIES10#TABLE_DC-SECURITY11#TABLE_DC-CONFIGURATION12#TABLE_DC-ROLES/SERVICEs13#TABLE_AD-SITES14#TABLE_TIME-SYNC-AND-FSMO15#TABLE_AD-OBJECTS16#TABLE_AD-GPO17#TABLE_AD-DNS18#TABLE_DC-HARDERNING-SETTINGS19#TABLE_AD-PERMISSIONS20#TABLE_Azure-Infra21
| Item | Value |
| Number of AD Sites | 1 |
| Number of Application Partitions | 2 |
| Number of Global Catalogs | 1 |
| Forest UPN Suffixes | |
| Forest Schema Master | WIN-R21FG8USEKP.dp.net |
| Forest Domain Naming Master | WIN-R21FG8USEKP.dp.net |
| Forest Root Domain | dp.net |
| Forest Domains | dp.net |
| Forest Functional Level | Windows2016Forest |
| AD Forest Name | dp.net |
| HostName | Domain | IPv4Address | IPv6Address | IsGlobalCatalog | IsReadOnly | OperatingSystem | OperatingSystemServicePack | Site | SslPort |
| WIN-R21FG8USEKP.dp.net | dp.net | 5.178.98.71 | True | False | Windows Server 2022 Standard Evaluation | Default-First-Site-Name | 636 |
| Domain | NetBIOS Name | Functional Level | Forest | PDC Emulator | RID Master | Infrastructure Master |
| dp.net | DP | Windows2016Domain | dp.net | WIN-R21FG8USEKP.dp.net | WIN-R21FG8USEKP.dp.net | WIN-R21FG8USEKP.dp.net |
| AD Site | Location | Site Option | Current ISTG | Subnets | Servers | In Site Links | Bridgehead Servers |
| Default-First-Site-Name | WIN-R21FG8USEKP.dp.net | 0 | 1 | 1 | 0 |
| AD Site Link | Total AD Sites | AD Sites |
| DEFAULTIPSITELINK | 1 | CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dp,DC=net |
| DomainName | MinPwdAge | MaxPwdAge | MinPwdLength | LockoutThreshold | LockoutDuration | ComplexityEnabled | ReversibleEncryption | PasswordHistoryCount |
| dp.net | 1 Day(s) | 42 Day(s) | 7 | 0 | 00:30:00 | True | False | 24 |
| AD Domain | Users | Groups | Computers | Organizational Units | Group Policy Objects |
| dp.net | 15151 | 48 | 1 | 6 | 2 |
| Test | Severity | Items | Affected Objects | IOC/IOE |
| AD Domain | Blank Password | LastPassword Unset | Stale | Disabled | Pass Never Expires | Expired | Reversible Enc | DES Enc | PrimaryGroupID Modified | PWDLastSet Unset | Kerberos Pre-Auth | With SPNs | Sending Bad Logons | Password Not Required | Unconstrained Delegation |
| dp.net | 15136 | 15136 | 15136 | 9 | 1 | 0 | 0 | 0 | 0 | 15136 | 0 | 0 | 1 | 15151 | NOT FOUND |
| AD Domain | Disabled | Stale | With SPNs | Sending Bad Logons | PrimaryGroupID Modified | Unmanaged | Unconstrained Delegation |
| dp.net | 0 | 0 | 0 | 0 | NOT FOUND | 0 | 0 |
| DisabledAdmins | DisabledMembers | DomainName | EnabledMembers | GroupName | InactiveMembers | PasswordNeverExpires | TotalMembers |
0 | 0 | dp.net | 0 | Enterprise Key Admins | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Key Admins | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | DNSAdmins | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Domain Controllers | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Enterprise Read-only Domain Controllers | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Print Operators | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Server Operators | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Backup Operators | 0 | 0 | 0 |
0 | 0 | dp.net | 0 | Account Operators | 0 | 0 | 0 |
0 | 0 | dp.net | 1 | Administrators | 0 | 1 | 1 |
0 | 0 | dp.net | 1 | Schema Admins | 0 | 1 | 1 |
0 | 0 | dp.net | 1 | Enterprise Admins | 0 | 1 | 1 |
0 | 0 | dp.net | 1 | Domain Admins | 0 | 1 | 1 |
| ComplexityEnabled | DomainName | LockoutDuration | LockoutThreshold | MaxPwdAge | MinPwdAge | MinPwdLength | PasswordHistoryCount | ReversibleEncryption |
True | dp.net | 00:30:00 | 0 | 42 Day(s) | 1 Day(s) | 7 | 24 | False |
| AD_Domain | Count | Disabled | Enabled | Inactive | OperatingSystem |
| dp.net | 1 | 0 | 1 | 0 | Windows Server 2022 Standard Evaluation |
| HostName | Domain | IPv4Address | IPv6Address | IsGlobalCatalog | IsReadOnly | OperatingSystem | OperatingSystemServicePack | Site | SslPort |
| WIN-R21FG8USEKP.dp.net | dp.net | 5.178.98.71 | True | False | Windows Server 2022 Standard Evaluation | Default-First-Site-Name | 636 |
| Domain | NumberOfGPOs | TotalComputerSettingsDisabled | TotalDisabledGPOs | TotalUserSettingsDisabled |
dp.net | 2 | 0 | 0 | 0 |
| TotalUserSettingsDisabled | Domain | NumberOfGPOs | TotalComputerSettingsDisabled | TotalDisabledGPOs |
| 0 | dp.net | 2 | 0 | 0 |
Total Known config
| Test | Severity | Items | Affected Objects | ANSSI ID | IOC/IOE |
| Anonymous or EVERYONE in Pre-Windows 2000 Group | Critical | Number of Domains Affected:1 | 1 | vuln2_compatible_2000_anonymous | IOE IOC |
| Admins Sending Bad Logons | Critical | Total Privileged Users With Bad Logon Attempts:1 | 1 | MS-RECOMMENDED | IOC |
| Misconfigured Administrative Accounts Found | Critical | Total Admins Misconfigured:4 | 4 | MS-RECOMMENDED | IOE IOC |
| Weak Password Policies Affected Admins | Critical | Total Privileged Account using Weak Password Policy:2 | 2 | vuln2_privileged_members_password | IOE IOC |
| TLS 1.1 Enabled DCs | Critical | Total Domain Controllers with TLS 1.1 Protocol Enabled:1 | 1 | MS-RECOMMENDED | IOE |
| NTLM Authentication Enabled DCs | Critical | Total Domain Controllers with NTLM Enabled:1 | 1 | MS-RECOMMENDED | IOE |
| Missing DNS Scavenging DCs | Critical | Total DNS Servers Not Enabled with Server Level Scavenging:1 | 1 | MS-RECOMMENDED | IOE |
| Print Spooler Service Running DCs | Critical | Total Domain Controllers with Print Spooler Service running:1 | 1 | MS-RECOMMENDED | IOE |
| Accounts with Extended Rights to Read LAPS Passwords Found | Critical | Illegal Accounts Found to read LAPS in AD Domains:1 | 1 | MS-RECOMMENDED | IOE IOC |
| Protected Users Group Status | High | Total Domains Not Using Protected Users Group:1 | 1 | vuln3_protected_users | |
| Missing Microsoft LAPS in AD Forest | High | Microsoft LAPS Status:Not Deployed | Not Deployed | MS-RECOMMENDED | |
| Anyone can Join Computers to Domain | High | Total Domains Allowing Normal Users to Join Computers to domain:1 | 1 | MS-RECOMMENDED | IOE |
| Service Accounts Supported Encryption Algorithms | High | Service account encryption types summary:1 | 1 | MS-RECOMMENDED | IOE |
| Found Smart Card Authentication Not Enforced for AD Users | High | Users without smart card enforcement:15137 | 15137 | MS-RECOMMENDED | IOE |
| Found Servers with Microsoft Defender Antivirus SmartScreen Disabled | High | Servers with SmartScreen disabled:1 | 1 | MS-RECOMMENDED | IOE |
| Found Servers with Secure Boot Disabled | High | Servers with Secure Boot Disabled:1 | 1 | MS-RECOMMENDED | IOE |
| Found Users With Empty Passwords | High | Users With No Password Required:15151 | 15151 | MS-RECOMMENDED | IOE |
| Found Non-DC Servers with Unconstrained Delegation | High | Non-DC Servers with Unconstrained Delegation:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure GPO Setting Network security-Restrict NTLM-Outgoing NTLM traffic to remote servers is configured to DCs | High | Restrict NTLM Outgoing Traffic DC Setting:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure GPO Setting compound authentication and Kerberos armoring is enabled for DCs | High | Kerberos Armoring for DCs:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure No vulnerabilities because of 2016-AD Prep | High | Enterprise Key Admins FullControl ACE:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure Domain Controllers have Auditing Policies configured | High | Domain Controllers Auditing Policies:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure RODCs have read-only access to SYSVOL folder | High | RODC access to SYSVOL checked:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure Recovery console-Allow automatic administrative logon GPO setting is turned off | High | Recovery Console Admin Logon Setting:2 | 2 | MS-RECOMMENDED | IOE |
| Ensure Denied RODC Password Replication Group includes default members | High | Denied RODC PRG missing members:8 | 8 | MS-RECOMMENDED | IOE |
| Ensure RIGHT_DS_LIST_OBJECT is correctly configured to enforce isolation between OUs | High | DS List Object Mode Enforcement:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure Admin Accounts have Emails configured | High | Admin Accounts Missing Email:1 | 1 | MS-RECOMMENDED | IOE |
| Ensure GPO Setting Turn off multicast name resolution is enabled to prevent LLMNR | High | Turn Off Multicast Name Resolution Setting:2 | 2 | MS-RECOMMENDED | IOE |
| Found Computers with Unconstrained Delegation | High | Computers with Unconstrained Delegation:1 | 1 | MS-RECOMMENDED | IOE |
| Computers Without PowerShell Logging Enabled | High | Computers Without PowerShell Logging Enabled:1 | 1 | MS-RECOMMENDED | IOE |
| DC Computer Accounts with Unprivileged Owners | High | DC Computer Accounts with Unprivileged Owners:1 | 1 | MS-RECOMMENDED | IOE |
| Domain Controllers vulnerable to MS17-010-Patch Status | High | Domain Controllers without MS17-010 patch:1 | 1 | MS-RECOMMENDED | IOE |
| Domain Controllers vulnerable to MS14-068 | High | Domain Controllers without MS14-068 patch (KB3011780):1 | 1 | MS-RECOMMENDED | IOE |
| Denied RODC Password Replication Group missing Privileged Accounts | High | Total Missing Privileged Groups in Denied RODC Password Replication Group:8 | 8 | vuln3_rodc_denied_group | IOE |
| Schema Admin Group members | High | Schema Admins Group contains members:1 | 1 | MS-RECOMMENDED | IOE |
| Missing Domain Zones Scavenging | High | Total Domain Zones Not Enabled with Scavenging:1 | 1 | MS-RECOMMENDED | IOC |
| AD Partitions Backup Status | High | Total AD Partitions not backed up since last 7 days:5 | 5 | MS-RECOMMENDED | |
| Users with LastPasswordSet was never Set | High | Total Users with LastPasswordSet was never set in all Domains:15136 | 15136 | vuln2_dont_expire | IOE |
| Users with PWDLastSet to ZERO | High | Total Users with PWDLastSet to ZERO in all Domains:15136 | 15136 | vuln1_user_accounts_dormant | IOE |
| Stale User Accounts | High | Total Stale User Accounts in all Domains:15136 | 15136 | vuln1_user_accounts_dormant | IOC |
| User Accounts Pass Never Expires | High | Total Users with Password Never Expires in all Domains:1 | 1 | vuln2_dont_expire | IOC |
| Built-In Admin Account Not protected | High | Default Administrator Account not protected in all domains:1 | 1 | MS-RECOMMENDED | IOE IOC |
| Built-In Admin Account Not Disabled | High | Default Admin Account not disabled in Total Domains:1 | 1 | MS-RECOMMENDED | IOE IOC |
| Built-In Admin Account Not Renamed | High | Default Admin Account not renamed in Total Domains:1 | 1 | MS-RECOMMENDED | IOE |
| Built-In Admin Account Password Not Changed in 90 days | High | Total Domains in which Default Administrator password not changed since last 90 days:1 | 1 | MS-RECOMMENDED | IOE |
| Built-In Admin Account was used in last 10 days | High | Total Domains in which Default Administrator account was used in last 10 days:1 | 1 | MS-RECOMMENDED | IOC |
| Guest Account is not renamed | High | Guest Account not renamed in Total Domains:1 | 1 | MS-RECOMMENDED | IOE |
| Missing Privileged Groups in Protected Users Group | High | Total Missing Privileged Groups in Protected Users Group:Not In Use | Not In Use | vuln3_protected_users | IOE IOC |
| Too Many Privileged Accounts | High | Affected AD Domains:1 | 1 | vuln_privileged_members | IOC |
| Passwords Not Changed within 90 days | High | Total Admin Accounts Did Not Change Their Passwords Since Last 90 Days:4 | 4 | vuln1_password_change_priv | IOE |
| Password Do Not Expire | High | Total Admin Accounts set to PasswordNeverExpires:4 | 4 | vuln1_dont_expire_priv | IOE |
| Default Domain Policy-Minimum Password Length | High | Account Policies Not Configured correctly in Total Domains:1 | 1 | vuln2_privileged_members_password | IOE |
| FGPP Policies-Minimum Password Length | High | FGPP Not Configured Correctly In Domains:Not Created | Not Created | vuln2_privileged_members_password | IOE |
| FGPP Policies Not Applying | High | Total FGPP Not Applying in All Domains:Not Created | Not Created | MS-RECOMMENDED | IOE |
| AllowNT4Crypto DCs | High | Total DCs with AllowNT4Crypto Enabled:1 | 1 | MS-RECOMMENDED | IOE |
| RC4 Encryption Enabled DCs | High | Total Domain Controllers With RC4 Encryption Enabled:1 | 1 | MS-RECOMMENDED | IOE |
| Missing Updates DCs | High | Total DCs Not Updated Since Last 45 Days:1 | 1 | MS-RECOMMENDED | IOE |
| Scheduled Tasks found on Domain Controllers | High | Total Scheduled Tasks on DCs:168 | 168 | MS-RECOMMENDED | IOC |
| Sites without Subnets Association | High | Total AD Sites Without Subnets:1 | 1 | MS-RECOMMENDED | |
| PDC Emulator Time Source | High | Root PDC Time Source:Internal Source | Internal Source | MS-RECOMMENDED | |
| No Group Policy Objects Defining Log Size and Retention | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects to Prevent Domain Admins from logging on to Workstations or Servers Found | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects to Block ISO Execution Found | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects to Mitigate SMBv1 Found | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects Enforcing UAC Prompt for Elevation Found | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects to Mitigate Accidental Script Execution | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| No Group Policy Objects to Mitigate NTLMv1 Protocol | High | Total AD Domains Affected:1 | 1 | MS-RECOMMENDED | |
| Lock screen camera status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Lock screen slide show status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Passwords to be saved status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Always prompt for password upon connection status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Require secure RPC communication status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Set client connection encryption level status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Windows Defender SmartScreen status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| AutoPlay status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Default behavior for AutoRun status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| UNC Paths Hardened status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Insecure guest logons status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit- Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain controller- LDAP server signing requirements status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain controller- Refuse machine account password changes status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain member- Digitally encrypt secure channel data (when possible) status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain member- Digitally sign secure channel data (when possible) status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain member- Disable machine account password changes status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain member- Maximum machine account password age status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Domain member- Require strong (Windows 2000 or later) session key status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Interactive logon- Machine inactivity limit status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Microsoft network client- Digitally sign communications (always) status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Microsoft network client- Send unencrypted password to third-party SMB servers status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network access- Do not allow anonymous enumeration of SAM accounts status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network access- Do not allow anonymous enumeration of SAM accounts and shares status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- Allow LocalSystem NULL session fallback status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- Allow LocalSystem NULL session fallback status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- LAN Manager authentication level status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- LDAP client signing requirements | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| System objects- Strengthen default permissions of internal system objects status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Admin Approval Mode for the Built-in Administrator account status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Behavior of the elevation prompt for standard users status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Detect application installations and prompt for elevation status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Only elevate UIAccess applications that are installed in secure locations status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Run all administrators in Admin Approval Mode status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| User Account Control- Virtualize file and registry write failures to per-user locations status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Credential Validation status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Computer Account Management status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Other Account Management Events status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Security Group Management status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit User Account Management status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit PNP Activity status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Process Creation status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Directory Service Access status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Directory Service Changes status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Group Membership status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Logon status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Other Logon/Logoff Events status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Special Logon status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Detailed File Share status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit File Share status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Other Object Access Events status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Removable Storage status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Audit Policy Change status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Authentication Policy Change status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit MPSSVC Rule-Level Policy Change status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Other Policy Change Events status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Sensitive Privilege Use status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Other System Events status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Security State Change status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit Security System Extension status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| Audit System Integrity status | High | Setting Status:Missing | Missing | MS-RECOMMENDED | |
| High Value Targets Found | High | Total High Value Targets Found:2 | 2 | MS-RECOMMENDED | IOE IOC |
| AD Recycle Bin Status | Medium | AD Recycle Bin Status:Disabled | Disabled | MS-RECOMMENDED | |
| Managed Service Accounts Status | Medium | Managed Service Accounts Status:Are not in use | Are not in use | MS-RECOMMENDED | |
| Users Sending Bad Logons | Medium | Total Users sending Bad Logons in all Domains:1 | 1 | MS-RECOMMENDED | IOC |
| Users Disabled | Medium | Total Disabled Users in all Domains:9 | 9 | vuln_user_accounts_dormant | IOC |
| Missing SSL Authentication DCs | Medium | Total DCs without SSL:1 | 1 | MS-RECOMMENDED | IOE |
| Missing Enough DNS Servers in NIC DCs | Medium | Total DCs With inadequate Number Of DNS Servers in NIC Property:1 | 1 | MS-RECOMMENDED | |
| Not Enough Local Disks DCs | Medium | Total DCs Not Configured With Recommended Disk Configuration:1 | 1 | MS-RECOMMENDED | |
| Missing AD Sites Coverage | Medium | Total AD Sites Not Covered:1 | 1 | MS-RECOMMENDED | |
| Sites Missing Bridgehead Server | Medium | Number Of AD Sites Without Bridgehead Servers:1 | 1 | MS-RECOMMENDED | |
| AD Sites Redundancy | Medium | Total AD Sites with Only One Domain Controller:1 | 1 | MS-RECOMMENDED | |
| Unprotected OUs | Medium | Total Ous not protected:1 | 1 | MS-RECOMMENDED | |
| GPOs not Linked to OUs | Medium | Total OUs without GPO Linked:4 | 4 | MS-RECOMMENDED | IOE |
| gMSA Accounts Status | Low | Total Domains With gMSA Accounts:0 | 0 | MS-RECOMMENDED | |
| Replication Interval Not Optimized Sites | Low | Replication Interval is not optimized for Site Links:1 | 1 | MS-RECOMMENDED | |
| Found Orphaned Foreign Security Principals | Low | Total Orphaned FSPs:0 | 0 | MS-RECOMMENDED | IOE |
| Found Orphaned Foreign Security Principals | Low | Total Orphaned FSPs:0 | 0 | MS-RECOMMENDED | |
| Security Groups without Objects | Low | Total Empty Security Groups In All Domains:32 | 32 | MS-RECOMMENDED | |
| Users without UPN specified | Low | Total Users with UPN Blank in all Domains:1 | 1 | MS-RECOMMENDED | |
| Missing Location Text in AD Sites | Low | Total AD Sites Not Defined With Location:1 | 1 | MS-RECOMMENDED | |
| GPO Description | Low | Number of GPOs not set with Description:2 | 2 | MS-RECOMMENDED | |
| Orphaned Admins on AdminSDHolder | Passed | Total Possible Orphaned Admins in all Domains on AdminSDHolder object:0 | 0 | vuln1_permissions_adminsdholder | IOC |
| Dangerous Permissions on AdminSDHolder | Passed | AD Domains Affected:0 | 0 | vuln1_privileged_members_perm vuln2_privileged_members_perm | IOC |
| AdminSDHolder was Modified in last 30 days | Passed | AdminSDHolder Object was modified in total domains:0 | 0 | vuln1_permissions_adminsdholder | IOC |
| Constrained delegation to domain controller service | Passed | Total Computers with Constrained Delegation in all Domains:0 | 0 | vuln1_delegation_a2d2 | IOC |
| Resource-based constrained delegation on domain controllers | Passed | Total Computers with Resource-Based Delegation in all Domains:0 | 0 | vuln1_delegation_sourcedeleg | IOC |
| Anonymous Access to Active Directory | Passed | Anonymous Access To Active Directory:0 | 0 | vuln1_dsheuristics_bad | IOE |
| Found Hidden Domain Controllers | Passed | Total Hidden Domain Controllers:0 | 0 | MS-RECOMMENDED | IOE |
| Successful Exploit Machine Accounts Found | Passed | Total Exploit Machine Accounts:0 | 0 | MS-RECOMMENDED | IOE |
| Possible User-based Service Accounts found | Passed | Total Possible User-Based Service Accounts:0 | 0 | MS-RECOMMENDED | IOC |
| Domain Trusts Found | Passed | Domain Trusts Status:Not Found | Not Found | MS-RECOMMENDED | IOE IOC |
| Found Bitlocker Disabled Computers | Passed | Computers missing BitLocker Recovery Info in AD:0 | 0 | MS-RECOMMENDED | IOE |
| Found Computers Running Obsolete OS Versions | Passed | Computers running obsolete OS versions:0 | 0 | MS-RECOMMENDED | IOE |
| Found Service Accounts With Unchanged Passwords | Passed | Service accounts with unchanged passwords:0 | 0 | MS-RECOMMENDED | IOE |
| Found Inactive Service Accounts | Passed | Inactive service accounts (>90 days):0 | 0 | MS-RECOMMENDED | IOE |
| Found Computers With Anomalous Primary Group ID | Passed | Computers with incorrect PrimaryGroupID:0 | 0 | MS-RECOMMENDED | IOE |
| Found Computers With Unreadable Primary Group ID | Passed | Computers with unreadable or missing PrimaryGroupID:0 | 0 | MS-RECOMMENDED | IOE |
| Found Large Groups | Passed | AD Groups with >600 Members:0 | 0 | MS-RECOMMENDED | IOE |
| Found Shadow Admins | Passed | Accounts with powerful delegated rights:0 | 0 | MS-RECOMMENDED | IOE |
| Found Dangerous dsHeuristics Settings | Passed | Domains with dangerous dsHeuristics settings:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Remote Desktop Drive Redirection Enabled | Passed | Servers with RDP Drive Redirection Enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Remote Desktop Connections Allowed Without Password Prompt | Passed | Servers allowing RDP without password prompt:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Automatic Sign-in After Restart Enabled | Passed | Servers with Automatic Sign-in enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Backup Rights Assigned to Non-Administrators | Passed | Backup rights assigned to non-admin accounts:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Remote Desktop Client Saving Passwords | Passed | Remote Desktop Client Saving Passwords:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Print Driver Packages Downloaded Over HTTP | Passed | Print Driver Packages Downloaded Over HTTP:0 | 0 | MS-RECOMMENDED | IOE |
| Found Servers with Internet Printing Enabled | Passed | Servers with Internet Printing Enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Found Duplicate SamAccountNames | Passed | Duplicate SamAccountNames:0 | 0 | MS-RECOMMENDED | IOE |
| Found Duplicate UPNs | Passed | Duplicate UserPrincipalNames:0 | 0 | MS-RECOMMENDED | IOE |
| Found Duplicate Emails | Passed | Duplicate Email Addresses:0 | 0 | MS-RECOMMENDED | IOE |
| Found Authenticated Users can create DNS records | Passed | Authenticated Users Can Create DNS Records:0 | 0 | MS-RECOMMENDED | IOE |
| Found Historical SIDs on User Accounts | Passed | User Accounts with Historical SIDs:0 | 0 | MS-RECOMMENDED | IOE |
| Found Sensitive Group Members with Oldest Password Age | Passed | Sensitive Group Members With Old Passwords:0 | 0 | MS-RECOMMENDED | IOE |
| Found Admin Accounts with Unprivileged Owners | Passed | Admin Accounts With Unprivileged Owners:0 | 0 | MS-RECOMMENDED | IOE |
| Found gMSAs With Passwords Older Than 60 Days | Passed | gMSAs With Passwords Older Than 60 Days:0 | 0 | MS-RECOMMENDED | IOE |
| Found Users With Passwords Older Than a Year | Passed | Users With Passwords Older Than One Year:0 | 0 | MS-RECOMMENDED | IOE |
| Found users with Unconstrained Delegation | Passed | Users with Unconstrained Delegation:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Well Known Groups are not assigned Dangerious Privileges in GPOs. | Passed | Well Known Groups Dangerous Privileges:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure no GPO is assigning Well Known Groups to Local Groups | Passed | Well-Known Groups assigned to Local Groups:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure No GPOs are configured to allow LM Hash | Passed | LM Hash storage allowed:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Limit local account use of blank passwords to console logon only GPO Setting is enabled | Passed | LimitBlankPasswordUse Setting:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure wellKnownObjects has not been modified | Passed | Modified wellKnownObjects Locations:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure SIDHistory is enabled for trusts | Passed | SIDHistory enabled trusts:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Membership in Allowed RODC Password Replication Group is limited | Passed | Allowed RODC PRG unauthorized members:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Dangerous Rights are detected on OUs and removed | Passed | Exploitable Delegation Rights on OUs:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Well Known Groups are not granted Dangerous Delegation on OUs | Passed | Well Known Groups granted Dangerous Delegation on OUs:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Do not require Kerberos preauthentication is unchecked for Admin Accounts | Passed | Admin Accounts with 'Do not require Kerberos preauthentication' enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure unixUserPassword and userPassword attributes are not set for user accounts | Passed | Users with unixUserPassword or userPassword attributes set:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Computers have changed their password in last 90 days | Passed | Computers with password older than 90 days:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure DCs have no constrained Delegation | Passed | DCs with Constrained Delegation Configured:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure DCs have no constrained Delegation with Protocol Transition | Passed | DCs with Constrained Delegation & Protocol Transition:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Stale users have no permissions to modify Group Memberships | Passed | Stale Users Group Modify Permissions:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Non-Default Principals do not have DCShadow rights | Passed | Non-Default Principals With DCShadow Rights:0 | 0 | MS-RECOMMENDED | IOE |
| Misconfigured CA Certificates Found | Passed | CA Signing Certificate Misconfiguration:0 | 0 | MS-RECOMMENDED | IOE |
| Dangerous Certificate Authority ACLs Found | Passed | Dangerous CA ACLs:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure Admin Accounts do not have Unprivileged Owners | Passed | Admin Accounts With Unprivileged Owners:0 | 0 | MS-RECOMMENDED | IOE |
| Found Computers with Resource-Based Constrained Delegation | Passed | Computers with Resource-Based Constrained Delegation:0 | 0 | MS-RECOMMENDED | IOE |
| Found Service Accounts Configured with Constrained Delegation | Passed | Service Accounts with Constrained Delegation:0 | 0 | MS-RECOMMENDED | IOE |
| Found Objects with msds-AllowedToDelegateTo Attribute Populated | Passed | Objects with msds-AllowedToDelegateTo attribute populated:0 | 0 | MS-RECOMMENDED | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs | Passed | Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs:0 | 0 | MS-RECOMMENDED | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt | Passed | Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt account:0 | 0 | MS-RECOMMENDED | IOE |
| Resource-Based Constrained Delegation Enabled for KRBTGT | Passed | Resource-Based Constrained Delegation on KRBTGT Account:0 | 0 | MS-RECOMMENDED | IOE |
| NSPI Access Enabled | Passed | NSPI Access Enabled on Domain Controllers:0 | 0 | MS-RECOMMENDED | IOE |
| Foreign Security Principals in Administrative Groups | Passed | Foreign Security Principals in Administrative Groups:0 | 0 | MS-RECOMMENDED | IOE |
| Outbound Trust with SID History Enabled | Passed | Outbound trusts with SID History enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure SDProp Process is Enabled for Critical Groups | Passed | SDProp Protection on Critical Groups:2 | 2 | MS-RECOMMENDED | IOE |
| Found Users using smart card with unchanged password for a long time | Passed | Smart Card Users with Old Passwords:0 | 0 | MS-RECOMMENDED | IOE |
| Users with AD Replication Permissions | Passed | Accounts with AD Replication Permissions:0 | 0 | MS-RECOMMENDED | IOE |
| Domain Controllers vulnerable to MS17-010 | Passed | Domain Controllers with SMBv1 Enabled:0 | 0 | MS-RECOMMENDED | IOE |
| Certificate Templates Editable by Everyone | Passed | Templates with Insecure Permissions:0 | 0 | MS-RECOMMENDED | IOE |
| Trusts SID Filtering Check | Passed | Trusts with SID Filtering Disabled:0 | 0 | MS-RECOMMENDED | IOE |
| Replication Errors DCs | Passed | Total DCS in Replication Errors:0 | 0 | MS-RECOMMENDED | IOE |
| Allowed RODC Password Replication Group is not empty | Passed | Total Members in RODC Replication Group:0 | 0 | vuln3_rodc_allowed_group | IOE |
| Managed service accounts with passwords unchanged for more than 90 days | Passed | Total Managed Service Accounts Password Unchanged Since last 90 days:0 | 0 | vuln_password_change_msa_no_change_90 | IOE |
| msDS-NeverRevealGroupattribute RODC missing Privileged Accounts | Passed | Total Privileged Groups Not in PRP Denied List:0 | 0 | vuln3_rodc_never_reveal | IOE |
| Unsecure Updates Zones | Passed | Total DNS Zones accepting non-secure updates:0 | 0 | vuln1_dnszone_bad_prop vuln3_dnszone_bad_prop | IOE IOC |
| Users with SPNs Configured | Passed | Total Users with SPN defined in all Domains:0 | 0 | vuln1_spn_priv | IOE |
| Password Expiration is missing for smart card users | Passed | AD Domains Affected:0 | 0 | vuln_smartcard_expire_passwords | IOE |
| Accounts vulnerable to Kerberoasting Found | Passed | Total Kerberoasting Accounts Found:0 | 0 | MS-RECOMMENDED | IOE |
| Users With DES encryption | Passed | Total Users with DES Encryption in all Domains:0 | 0 | vuln2_kerberos_properties_deskey | IOE |
| Users With Reversible Encryption | Passed | Total Users with Reversible Encryption set in all Domains:0 | 0 | vuln3_reversible_password | IOE |
| Users With Kerberos Pre-Authentication | Passed | Total Pre-Authentication Users in all domains:0 | 0 | vuln1_kerberos_properties_preauth_priv vuln2_kerberos_properties_preauth | IOE |
| Users Modified with PrimaryGroupID | Passed | Total Users with PrimaryGroupID Modified in all Domains:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| Users Expired | Passed | Total Expired Users in all Domains:0 | 0 | MS-RECOMMENDED | IOC |
| User Accounts Pass Not Required | Passed | Total Users with Password Not Required set in all Domains:0 | 0 | vuln2_dont_expire | IOC |
| Computers with SPNs Configured | Passed | Total Computers using ServicePrincipalNames in all Domains:0 | 0 | vuln1_spn_priv | IOE |
| Computers With Unconstrained Delegation | Passed | Total Computers with Unconstrained Delegation in all Domains:0 | 0 | vuln2_delegation_t4d | IOE |
| Computers Modified with PrimaryGroupID | Passed | Total Computers modified with PrimaryGroupID:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| Computers Sending Bad Logons | Passed | Total Computers sending Bad Logon Attempts in all Domains:0 | 0 | MS-RECOMMENDED | IOC |
| Computers Disabled | Passed | Total Disabled Computer Accounts in all Domains:0 | 0 | vuln_user_accounts_dormant | IOC |
| Stale Computer Accounts | Passed | Total Stale Computer Accounts in all Domains:0 | 0 | vuln1_user_accounts_dormant | IOC |
| Unsupported Operating Systems | Passed | Total End Of Life-Unsupported Operating Systems:0 | 0 | MS-RECOMMENDED | IOE |
| Admins with SPNs Configured | Passed | Total Admin Accounts With ServicePrincipalName Identified:0 | 0 | vuln1_spn_priv | IOE |
| Domain Controllers not owned by Admins | Passed | Total Domain Controllers owned by non-privileged accounts:0 | 0 | vuln1_permissions_dc | IOC |
| Computer Objects not managed by Admins | Passed | Total Computers Not Managed By Admins in all Domains:0 | 0 | vuln3_owner | IOC |
| Organizational Units not managed by Admins | Passed | Total Organizational Units Not Managed By Admins:0 | 0 | vuln3_owner | IOC |
| Sensitive GPOs Modified | Passed | Sensitive GPOs Status in Last 10 Days:Not Modified | Not Modified | MS-RECOMMENDED | IOC |
| Recently Created Privileged Admins | Passed | Total Privileged Accounts created in last 10 days in all domains:0 | 0 | MS-RECOMMENDED | IOC |
| Changes to Privileged Groups in Last 15 days | Passed | Total Privileged Groups Modified in Last 15 Days in All Domains:0 | 0 | MS-RECOMMENDED | IOC |
| Users Identified with Privileged SIDs in sIDHistory | Passed | Total Users containing Admin Accounts in sIDHistory in all Domains:0 | 0 | MS-RECOMMENDED | IOC |
| Computers Identified with Privileged SIDs in sIDHistory | Passed | Total Computers containing Admin Accounts in sIDHistory in all Domains:0 | 0 | MS-RECOMMENDED | IOC |
| Found Excluded Groups by AdminSDHolder and SDProp | Passed | Total Excluded Groups by SDProp Process:0 | 0 | MS-RECOMMENDED | IOC |
| krbtgt Account with Resource-Based Constrained Delegation | Passed | Affected number of Domains:0 | 0 | MS-RECOMMENDED | IOC |
| KRBTGT Account Password Not Changed | Passed | Total Domains Using KRBTGT Old Password:0 | 0 | vuln2_krbtgt | IOE |
| Guest Account is enabled | Passed | Total Guest Accounts Enabled in All Domains:0 | 0 | MS-RECOMMENDED | IOE |
| Administrator Account ServicePrincipalNames Found | Passed | Total AD Domains Affected:0 | 0 | MS-RECOMMENDED | IOE |
| Privileged Accounts Pass Never Expires | Passed | Total Privileged Accounts set to Password Never Expire in all Domains:0 | 0 | vuln2_dont_expire | IOE IOC |
| Inactive Admins | Passed | Total Enabled Admin Accounts Not In Use Since Last 30 Days:0 | 0 | vuln1_user_accounts_dormant | IOE |
| Privileged Groups Contain more than 20 members | Passed | Privileged Groups Contain More than 20 members:0 | 0 | vuln1_privileged_members | IOE |
| Kerberos Pre-authentication Disabled | Passed | Total Pre-Authentication Admins in all domains:0 | 0 | vuln1_kerberos_properties_preauth_priv | IOE IOC |
| Disabled Admins part of Privileged Groups | Passed | Total Disabled Admins In Privileged Groups:0 | 0 | MS-RECOMMENDED | IOE |
| DNSAdmins Group has members | Passed | Total Members In DNSAdmins Group In All Domains:0 | 0 | vuln1_dnsadmins and vuln1_permissions_msdn | IOE IOC |
| Privileged Groups Contained Computer Accounts | Passed | Total computer accounts part of privileged groups:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Privileged Admins missing AdminCount=1 Flag | Passed | Total Admins not set with AdminCount=1 flag in all domains:0 | 0 | MS-RECOMMENDED | IOC |
| ForeignSecurityPrincipals In Privileged Groups | Passed | Total ForeignSecurityPrincipal in Privileged Groups:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Operators Groups are not empty | Passed | Operators Groups containing total members in all domains:0 | 0 | MS-RECOMMENDED | IOE IOC |
| AdminsCount Flag set users not acting as Admins | Passed | Total Unknown Admins Found:0 | 0 | MS-RECOMMENDED | IOC |
| Domain Controllers Modified with PrimaryGroupID | Passed | Total Domain Controllers modified with PrimaryGroupID:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| SMB 1 Protocol Enabled DCs | Passed | Total Domain Controllers with SMB1 Server Protocol Enabled:0 | 0 | MS-RECOMMENDED | IOE |
| SMB 1 Client Protocol Enabled DCs | Passed | Total Domain Controllers with SMB1 Client Service Enabled:0 | 0 | MS-RECOMMENDED | IOE |
| LAN Manager password hashes Enabled DCs | Passed | Total DCs with LAN Manager Password Hashes:0 | 0 | MS-RECOMMENDED | IOE |
| SMB Signing Disabled DCs | Passed | Total Domains Controller Without SMB Signing:0 | 0 | MS-RECOMMENDED | IOE |
| LDAP Signing Disabled DCs | Passed | Total Domain Controllers Without LDAP Signing:0 | 0 | MS-RECOMMENDED | IOE |
| Inconsistent DCs | Passed | Total Domain Controllers in Inconsistent State:0 | 0 | vuln1_dc_inconsistent_uac | IOE |
| Unauthenticated DCs since last 45 Days | Passed | Total Domain Controllers Not Authenticated Within 45 days In All Domains:0 | 0 | vuln1_password_change_inactive_dc | IOE |
| Secrets not renewed DCs | Passed | Total Domain Controllers Not Changed Password Within 45 Days In All Domains:0 | 0 | vuln1_password_change_dc_no_change | IOE |
| Missed Reboot Cycles DCs | Passed | Total DCs Not Rebooted Since Last 30 Days:0 | 0 | MS-RECOMMENDED | IOE |
| No Contacts with Domain Controllers in Last Three Months | Passed | Total Domain Controllers not contacted since last three months:0 | 0 | MS-RECOMMENDED | IOE |
| Ensure UNC Paths for SYSVOL and NETLOGON are harderend | Passed | SYSVOL and Netlogon Hardening Missing on Total DCs:0 | 0 | MS-RECOMMENDED | IOE |
| Orphaned DCs | Passed | Total Orphaned Domain Controllers:0 | 0 | vuln1_dc_inconsistent_uac | IOE |
| Missing DNS Forwarders DCs | Passed | Total DNS Servers Do Not Have Forwarders Configured:0 | 0 | MS-RECOMMENDED | IOE |
| Missing Root Hints DCs | Passed | Total DNS Servers Do Not Have Root Hints Configured:0 | 0 | MS-RECOMMENDED | IOE |
| Missing Host Records DCs | Passed | Total DCs Missing Host Records in DNS:0 | 0 | MS-RECOMMENDED | IOE |
| Not Enough Free Space DCs | Passed | Total DCs with Low Disk Space:0 | 0 | MS-RECOMMENDED | IOE |
| Loopback Address Missing DCs | Passed | Total DCs not configured with Loopback Address:0 | 0 | MS-RECOMMENDED | IOE |
| Multihomed DCs | Passed | Total DCS in Multihomed State:0 | 0 | MS-RECOMMENDED | IOE |
| NTFS Replication DCs | Passed | Total Domain Controllers utilizing NTFRS for AD Replication:0 | 0 | vuln2_sysvol_ntfrs | IOE |
| Strict Replication Disabled DCs | Passed | Total DCs with Strict Replication Consistency not enabled:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Out Of Default OUs DCs | Passed | Total DCs outside of it's Default OU:0 | 0 | MS-RECOMMENDED | |
| Unsupported OS DCs | Passed | Total DCs running Unsupported Operating Systems:0 | 0 | MS-RECOMMENDED | IOE |
| Missing DNS Dynmaic Registration on NIC DCs | Passed | Total DCS NIC Dynamic Updates Not Enabled:0 | 0 | MS-RECOMMENDED | |
| Missing _msdcs Zone DCs | Passed | Total DNS Servers Missing _msdcs Zone:0 | 0 | MS-RECOMMENDED | |
| Event Log Config Not Correct DCs | Passed | Total DCs with Event Log misconfiguration:0 | 0 | MS-RECOMMENDED | |
| Event Log Size Not Optimized DCs | Passed | Total DCs with Event Log Size not optimal:0 | 0 | MS-RECOMMENDED | |
| Fax Server role installed DCs | Passed | Total Domain Controllers have Fax Server Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Microsoft FTP service installed DCs | Passed | Total Domain Controllers have FTP Server Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Peer Name Resolution Protocol installed DCs | Passed | Total Domain Controllers have Peer Name Resolution Protocol Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Simple TCP-IP Services installed DCs | Passed | Total Domain Controllers have Simple TCP/IP Services Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Telnet Client installed DCs | Passed | Total Domain Controllers have Telnet Client Installed::0 | 0 | MS-RECOMMENDED | IOE |
| TFTP Client installed DCs | Passed | Total Domain Controllers have TFTP Client Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Server Message Block (SMB) v1 protocol Installed DCs | Passed | Total Domain Controllers have SMB 1.0/CIFS File Sharing Support Installed::0 | 0 | MS-RECOMMENDED | IOE |
| Windows PowerShell 2.0 installed DCs | Passed | Total Domain Controllers have Windows PowerShell 2.0 Engine Installed::0 | 0 | MS-RECOMMENDED | IOE |
| ADWS Service Set to Manual DCs | Passed | Total DCs ADWS Not Set to Start Automatic:0 | 0 | MS-RECOMMENDED | IOE |
| DHCP Service Running DCs | Passed | Total Domain Controllers with DHCP Server running:0 | 0 | MS-RECOMMENDED | IOE |
| Additional Roles and Features DCs | Passed | Total Domain Controllers with Roles Processed:1 | 1 | MS-RECOMMENDED | IOE |
| AD Services not running DCs | Passed | Total DCs with Services Not Running:0 | 0 | MS-RECOMMENDED | IOE |
| Total Undefined Subnets | Passed | Total Undefined Subnets in AD Forest:0 | 0 | MS-RECOMMENDED | |
| Sites without ISTG Role | Passed | Total AD Sites Do Not Have ISTG Defined:0 | 0 | MS-RECOMMENDED | |
| Manual Replication Connection Objects | Passed | Total Manual Replication Connection Objects:0 | 0 | MS-RECOMMENDED | |
| Missing Global Catalog Sites | Passed | Total AD Sites Without Global Catalog Servers or No Universal Group Caching Enabled:0 | 0 | MS-RECOMMENDED | |
| Duplicate Site Links | Passed | Total Duplicate Site Links:0 | 0 | MS-RECOMMENDED | |
| Sites With Manual Bridgehead Server | Passed | Number Of AD Sites With Manual Bridgehead Servers:0 | 0 | MS-RECOMMENDED | |
| Sites creating Mesh Topology | Passed | Total AD Site Links Containing More than Two AD Sites:0 | 0 | MS-RECOMMENDED | |
| AD Sites without Site Link | Passed | Total AD Sites Not In Site Links:0 | 0 | MS-RECOMMENDED | |
| AD Sites without Domain Controller | Passed | Total AD Sites Without Domain Controllers:0 | 0 | MS-RECOMMENDED | |
| Domain Controllers Time Source | Passed | Total DCs Not Defined With Correct Time-Source:0 | 0 | MS-RECOMMENDED | |
| Domain FSMO Placement | Passed | AD FSMO Placement Status:FSMO Placement is correct. | FSMO Placement is correct. | MS-RECOMMENDED | |
| Domain Naming Master and Schema Master Placement | Passed | Status:Hosted on same computer | Hosted on same computer | MS-RECOMMENDED | |
| Managed Service Accounts Not Linked | Passed | Total Managed Service Accounts are not Linked:0 | 0 | MS-RECOMMENDED | IOE |
| TombstoneLifeTime Modified? | Passed | Current TombstoneLifeTime Value:180 | 180 | MS-RECOMMENDED | |
| Check AD Forest Functional Level | Passed | AD Forest Functional Level:dp.net is Windows2016Forest | dp.net is Windows2016Forest | MS-RECOMMENDED | |
| Check AD Domain Functional Level | Passed | Status:Ok | Ok | MS-RECOMMENDED | |
| Ogranizational Units without Objects | Passed | Total Empty Organizational Units In All Domains:0 | 0 | MS-RECOMMENDED | |
| Duplicate SPNs | Passed | Total Duplicate SPNs in AD Domains:0 | 0 | vuln1_delegation_sourcedeleg | |
| Unauthenticated Servers | Passed | Total Servers Not Authenticated Within 90 Days in All Domains:0 | 0 | vuln2_password_change_server_no_change_90 | IOE IOC |
| Secrets not renewed Servers | Passed | Total Servers Not Changing Password within 45 days in all Domains:0 | 0 | vuln3_password_change_server_no_change_45 | IOE IOC |
| AD Forest Schema Not upto date | Passed | Current Forest Schema Version Status:OK:88 | OK:88 | vuln2_adupdate_bad | IOE |
| Found Unused Netlogon Scripts | Passed | Total Unused Scripts In All Domains:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Disabled GPOs | Passed | Total Disabled GPOs:0 | 0 | MS-RECOMMENDED | |
| GPOs not Applying | Passed | Total GPOs not applying correctly in All Domains:0 | 0 | MS-RECOMMENDED | |
| Orphaned GPO Containers | Passed | Total Orphaned Group Policy Objects:0 | 0 | MS-RECOMMENDED | |
| Found OUs with GPOs Block Inheritance | Passed | Total GPOs with Block Inheritance Defined:0 | 0 | MS-RECOMMENDED | |
| GPO Naming Convention | Passed | Number Of GPOs do not follow Standard Naming Convention:0 | 0 | MS-RECOMMENDED | |
| Found GPO with WMI Filters | Passed | Total GPO with WMI Filter:0 | 0 | MS-RECOMMENDED | |
| Domain GPO Application Status | Passed | Total GPOs Not Applied:0 | 0 | MS-RECOMMENDED | |
| No Group Policy Objects for Preventing passwords using reversible encryption | Passed | Total AD Domains Affected:0 | 0 | MS-RECOMMENDED | |
| GPO Preferences Containing Passwords | Passed | GPO Preferences Containing Password in All AD Domains:0 | 0 | MS-RECOMMENDED | |
| Inconsistent GPOs | Passed | Total GPOs with Replication Issues:0 | 0 | MS-RECOMMENDED | |
| Too many DNS Static Records | Passed | Total Static Records:0 | 0 | MS-RECOMMENDED | IOC |
| DNS Round-Robin Not Enabled | Passed | Total DNS Servers Not Enabled With Round Robin:0 | 0 | MS-RECOMMENDED | |
| Domain member- Digitally encrypt or sign secure channel data (always) status | Passed | Setting Status:Found | Found | MS-RECOMMENDED | |
| Microsoft network server- Digitally sign communications (always) status | Passed | Setting Status:Found | Found | MS-RECOMMENDED | |
| Network security- Do not store LAN Manager hash value on next password change status | Passed | Setting Status:Found | Found | MS-RECOMMENDED | |
| Locked Out Accounts Found | Passed | Total Accounts Locked Out in All Domains:0 | 0 | MS-RECOMMENDED | |
| Group Policy Objects with Improper Permissions Found | Passed | Abusable GPO Permissions found in Total AD Domains:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Group Policy Object Assignments with Improper Permissions Found | Passed | Total Abusable GPO Permissions in AD Domains:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Dangerous Permissions Found on MicrosoftDNS Container | Passed | AD Domains Affected:0 | 0 | vuln_permissions_msdns | IOE IOC |
| Dangerous Permissions Found on Naming Contexts | Passed | AD Domains Affected:0 | 0 | vuln_permissions_naming_context | IOE IOC |
| Pre-Windows 2000 Compatible Access Group is not empty | Passed | Number of AD Domains Affected:0 | 0 | vuln_compatible_2000_anonymous | IOE IOC |
| Found Groups with SID history Set | Passed | Total Groups With sIDHistory Affected domains:0 | 0 | vuln_sidhistory_present | IOE IOC |
| Abusable Permissions Found on SYSVOL and NETLOGON | Passed | Abusable Permissions Found on SYSVOL and Netlogon Shares:Ok | Ok | MS-RECOMMENDED | IOE IOC |
| LAPS SearchFlag modified | Passed | LAPS SearchFlags Modified:Not Modified | Not Modified | MS-RECOMMENDED | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain NC | Passed | AD Domains Affected:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain Controllers OU | Passed | AD Domains Affected:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Unauthorized Users having GPLink Rights on AD Sites | Passed | AD Sites Affected:0 | 0 | MS-RECOMMENDED | IOE IOC |
| Test | Severity | Items | Affected Objects | ID-Technique | IOC/IOE |
| Anonymous or EVERYONE in Pre-Windows 2000 Group | |
Number of Domains Affected:1 | 1 | vuln2_compatible_2000_anonymous | IOE IOC |
| Weak Password Policies Affected Admins | |
Total Privileged Account using Weak Password Policy:2 | 2 | vuln2_privileged_members_password | IOE IOC |
| Protected Users Group Status | |
Total Domains Not Using Protected Users Group:1 | 1 | vuln3_protected_users | |
| Denied RODC Password Replication Group missing Privileged Accounts | |
Total Missing Privileged Groups in Denied RODC Password Replication Group:8 | 8 | vuln3_rodc_denied_group | IOE |
| Users with LastPasswordSet was never Set | |
Total Users with LastPasswordSet was never set in all Domains:15136 | 15136 | vuln2_dont_expire | IOE |
| Users with PWDLastSet to ZERO | |
Total Users with PWDLastSet to ZERO in all Domains:15136 | 15136 | vuln1_user_accounts_dormant | IOE |
| Stale User Accounts | |
Total Stale User Accounts in all Domains:15136 | 15136 | vuln1_user_accounts_dormant | IOC |
| User Accounts Pass Never Expires | |
Total Users with Password Never Expires in all Domains:1 | 1 | vuln2_dont_expire | IOC |
| Missing Privileged Groups in Protected Users Group | |
Total Missing Privileged Groups in Protected Users Group:Not In Use | Not In Use | vuln3_protected_users | IOE IOC |
| Too Many Privileged Accounts | |
Affected AD Domains:1 | 1 | vuln_privileged_members | IOC |
| Passwords Not Changed within 90 days | |
Total Admin Accounts Did Not Change Their Passwords Since Last 90 Days:4 | 4 | vuln1_password_change_priv | IOE |
| Password Do Not Expire | |
Total Admin Accounts set to PasswordNeverExpires:4 | 4 | vuln1_dont_expire_priv | IOE |
| Default Domain Policy-Minimum Password Length | |
Account Policies Not Configured correctly in Total Domains:1 | 1 | vuln2_privileged_members_password | IOE |
| FGPP Policies-Minimum Password Length | |
FGPP Not Configured Correctly In Domains:Not Created | Not Created | vuln2_privileged_members_password | IOE |
| Users Disabled | |
Total Disabled Users in all Domains:9 | 9 | vuln_user_accounts_dormant | IOC |
| Orphaned Admins on AdminSDHolder | |
Total Possible Orphaned Admins in all Domains on AdminSDHolder object:0 | 0 | vuln1_permissions_adminsdholder | IOC |
| Dangerous Permissions on AdminSDHolder | |
AD Domains Affected:0 | 0 | vuln1_privileged_members_perm vuln2_privileged_members_perm | IOC |
| AdminSDHolder was Modified in last 30 days | |
AdminSDHolder Object was modified in total domains:0 | 0 | vuln1_permissions_adminsdholder | IOC |
| Constrained delegation to domain controller service | |
Total Computers with Constrained Delegation in all Domains:0 | 0 | vuln1_delegation_a2d2 | IOC |
| Resource-based constrained delegation on domain controllers | |
Total Computers with Resource-Based Delegation in all Domains:0 | 0 | vuln1_delegation_sourcedeleg | IOC |
| Anonymous Access to Active Directory | |
Anonymous Access To Active Directory:0 | 0 | vuln1_dsheuristics_bad | IOE |
| Allowed RODC Password Replication Group is not empty | |
Total Members in RODC Replication Group:0 | 0 | vuln3_rodc_allowed_group | IOE |
| Managed service accounts with passwords unchanged for more than 90 days | |
Total Managed Service Accounts Password Unchanged Since last 90 days:0 | 0 | vuln_password_change_msa_no_change_90 | IOE |
| msDS-NeverRevealGroupattribute RODC missing Privileged Accounts | |
Total Privileged Groups Not in PRP Denied List:0 | 0 | vuln3_rodc_never_reveal | IOE |
| Unsecure Updates Zones | |
Total DNS Zones accepting non-secure updates:0 | 0 | vuln1_dnszone_bad_prop vuln3_dnszone_bad_prop | IOE IOC |
| Users with SPNs Configured | |
Total Users with SPN defined in all Domains:0 | 0 | vuln1_spn_priv | IOE |
| Password Expiration is missing for smart card users | |
AD Domains Affected:0 | 0 | vuln_smartcard_expire_passwords | IOE |
| Users With DES encryption | |
Total Users with DES Encryption in all Domains:0 | 0 | vuln2_kerberos_properties_deskey | IOE |
| Users With Reversible Encryption | |
Total Users with Reversible Encryption set in all Domains:0 | 0 | vuln3_reversible_password | IOE |
| Users With Kerberos Pre-Authentication | |
Total Pre-Authentication Users in all domains:0 | 0 | vuln1_kerberos_properties_preauth_priv vuln2_kerberos_properties_preauth | IOE |
| Users Modified with PrimaryGroupID | |
Total Users with PrimaryGroupID Modified in all Domains:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| User Accounts Pass Not Required | |
Total Users with Password Not Required set in all Domains:0 | 0 | vuln2_dont_expire | IOC |
| Computers with SPNs Configured | |
Total Computers using ServicePrincipalNames in all Domains:0 | 0 | vuln1_spn_priv | IOE |
| Computers With Unconstrained Delegation | |
Total Computers with Unconstrained Delegation in all Domains:0 | 0 | vuln2_delegation_t4d | IOE |
| Computers Modified with PrimaryGroupID | |
Total Computers modified with PrimaryGroupID:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| Computers Disabled | |
Total Disabled Computer Accounts in all Domains:0 | 0 | vuln_user_accounts_dormant | IOC |
| Stale Computer Accounts | |
Total Stale Computer Accounts in all Domains:0 | 0 | vuln1_user_accounts_dormant | IOC |
| Admins with SPNs Configured | |
Total Admin Accounts With ServicePrincipalName Identified:0 | 0 | vuln1_spn_priv | IOE |
| Domain Controllers not owned by Admins | |
Total Domain Controllers owned by non-privileged accounts:0 | 0 | vuln1_permissions_dc | IOC |
| Computer Objects not managed by Admins | |
Total Computers Not Managed By Admins in all Domains:0 | 0 | vuln3_owner | IOC |
| Organizational Units not managed by Admins | |
Total Organizational Units Not Managed By Admins:0 | 0 | vuln3_owner | IOC |
| KRBTGT Account Password Not Changed | |
Total Domains Using KRBTGT Old Password:0 | 0 | vuln2_krbtgt | IOE |
| Privileged Accounts Pass Never Expires | |
Total Privileged Accounts set to Password Never Expire in all Domains:0 | 0 | vuln2_dont_expire | IOE IOC |
| Inactive Admins | |
Total Enabled Admin Accounts Not In Use Since Last 30 Days:0 | 0 | vuln1_user_accounts_dormant | IOE |
| Privileged Groups Contain more than 20 members | |
Privileged Groups Contain More than 20 members:0 | 0 | vuln1_privileged_members | IOE |
| Kerberos Pre-authentication Disabled | |
Total Pre-Authentication Admins in all domains:0 | 0 | vuln1_kerberos_properties_preauth_priv | IOE IOC |
| DNSAdmins Group has members | |
Total Members In DNSAdmins Group In All Domains:0 | 0 | vuln1_dnsadmins and vuln1_permissions_msdn | IOE IOC |
| Domain Controllers Modified with PrimaryGroupID | |
Total Domain Controllers modified with PrimaryGroupID:0 | 0 | vuln3_primary_group_id_nochange vuln1_primary_group_id_1000 | IOC |
| Inconsistent DCs | |
Total Domain Controllers in Inconsistent State:0 | 0 | vuln1_dc_inconsistent_uac | IOE |
| Unauthenticated DCs since last 45 Days | |
Total Domain Controllers Not Authenticated Within 45 days In All Domains:0 | 0 | vuln1_password_change_inactive_dc | IOE |
| Secrets not renewed DCs | |
Total Domain Controllers Not Changed Password Within 45 Days In All Domains:0 | 0 | vuln1_password_change_dc_no_change | IOE |
| Orphaned DCs | |
Total Orphaned Domain Controllers:0 | 0 | vuln1_dc_inconsistent_uac | IOE |
| NTFS Replication DCs | |
Total Domain Controllers utilizing NTFRS for AD Replication:0 | 0 | vuln2_sysvol_ntfrs | IOE |
| Duplicate SPNs | |
Total Duplicate SPNs in AD Domains:0 | 0 | vuln1_delegation_sourcedeleg | |
| Unauthenticated Servers | |
Total Servers Not Authenticated Within 90 Days in All Domains:0 | 0 | vuln2_password_change_server_no_change_90 | IOE IOC |
| Secrets not renewed Servers | |
Total Servers Not Changing Password within 45 days in all Domains:0 | 0 | vuln3_password_change_server_no_change_45 | IOE IOC |
| AD Forest Schema Not upto date | |
Current Forest Schema Version Status:OK:88 | OK:88 | vuln2_adupdate_bad | IOE |
| Dangerous Permissions Found on MicrosoftDNS Container | |
AD Domains Affected:0 | 0 | vuln_permissions_msdns | IOE IOC |
| Dangerous Permissions Found on Naming Contexts | |
AD Domains Affected:0 | 0 | vuln_permissions_naming_context | IOE IOC |
| Pre-Windows 2000 Compatible Access Group is not empty | |
Number of AD Domains Affected:0 | 0 | vuln_compatible_2000_anonymous | IOE IOC |
| Found Groups with SID history Set | |
Total Groups With sIDHistory Affected domains:0 | 0 | vuln_sidhistory_present | IOE IOC |
| Test | Severity | Items | Affected Objects | ID-Technique | IOC/IOE |
| Anonymous or EVERYONE in Pre-Windows 2000 Group | |
Number of Domains Affected:1 | 1 | Account Discovery T1087 | IOE IOC |
| Admins Sending Bad Logons | |
Total Privileged Users With Bad Logon Attempts:1 | 1 | Brute Force T1110 | IOC |
| Misconfigured Administrative Accounts Found | |
Total Admins Misconfigured:4 | 4 | Privilege Escalation;Account Manipulation T1098 | IOE IOC |
| Weak Password Policies Affected Admins | |
Total Privileged Account using Weak Password Policy:2 | 2 | Valid Accounts T1078 | IOE IOC |
| TLS 1.1 Enabled DCs | |
Total Domain Controllers with TLS 1.1 Protocol Enabled:1 | 1 | Modify Authentication Process T1556 | IOE |
| NTLM Authentication Enabled DCs | |
Total Domain Controllers with NTLM Enabled:1 | 1 | Use Alternate Authentication Material T1550 | IOE |
| Print Spooler Service Running DCs | |
Total Domain Controllers with Print Spooler Service running:1 | 1 | Lateral Movement T1021 | IOE |
| Accounts with Extended Rights to Read LAPS Passwords Found | |
Illegal Accounts Found to read LAPS in AD Domains:1 | 1 | Credential Access;OS Credential Dumping T1003 | IOE IOC |
| Protected Users Group Status | |
Total Domains Not Using Protected Users Group:1 | 1 | Valid Accounts T1078 | |
| Missing Microsoft LAPS in AD Forest | |
Microsoft LAPS Status:Not Deployed | Not Deployed | Credential Access T1003 | |
| Anyone can Join Computers to Domain | |
Total Domains Allowing Normal Users to Join Computers to domain:1 | 1 | Privilege Escalation T1068 | IOE |
| Service Accounts Supported Encryption Algorithms | |
Service account encryption types summary:1 | 1 | Credential Access;Kerberoasting T1558.003 | IOE |
| Found Smart Card Authentication Not Enforced for AD Users | |
Users without smart card enforcement:15137 | 15137 | Credential Access;Valid Accounts T1078 | IOE |
| Found Servers with Microsoft Defender Antivirus SmartScreen Disabled | |
Servers with SmartScreen disabled:1 | 1 | Defense Evasion;Impair Defenses T1562 | IOE |
| Found Servers with Secure Boot Disabled | |
Servers with Secure Boot Disabled:1 | 1 | Defense Evasion;Boot or Logon Autostart Execution T1547 | IOE |
| Found Users With Empty Passwords | |
Users With No Password Required:15151 | 15151 | Credential Access;Valid Accounts T1078 | IOE |
| Found Non-DC Servers with Unconstrained Delegation | |
Non-DC Servers with Unconstrained Delegation:1 | 1 | Credential Access;Unconstrained Delegation T1558 | IOE |
| Ensure GPO Setting Network security-Restrict NTLM-Outgoing NTLM traffic to remote servers is configured to DCs | |
Restrict NTLM Outgoing Traffic DC Setting:1 | 1 | Credential Access;NTLM Hash Theft T1550.002 | IOE |
| Ensure GPO Setting compound authentication and Kerberos armoring is enabled for DCs | |
Kerberos Armoring for DCs:1 | 1 | Credential Access;Kerberos Ticket Protection T1558 | IOE |
| Ensure RODCs have read-only access to SYSVOL folder | |
RODC access to SYSVOL checked:1 | 1 | Defense Evasion;Domain Policy Modification T1484 | IOE |
| Ensure Recovery console-Allow automatic administrative logon GPO setting is turned off | |
Recovery Console Admin Logon Setting:2 | 2 | Credential Access;Valid Accounts T1078 | IOE |
| Ensure Denied RODC Password Replication Group includes default members | |
Denied RODC PRG missing members:8 | 8 | Credential Access;OS Credential Dumping T1003 | IOE |
| Ensure RIGHT_DS_LIST_OBJECT is correctly configured to enforce isolation between OUs | |
DS List Object Mode Enforcement:1 | 1 | Privilege Escalation;Permission Groups Discovery T1069 | IOE |
| Ensure GPO Setting Turn off multicast name resolution is enabled to prevent LLMNR | |
Turn Off Multicast Name Resolution Setting:2 | 2 | Credential Access;Man-in-the-Middle T1557 | IOE |
| Found Computers with Unconstrained Delegation | |
Computers with Unconstrained Delegation:1 | 1 | Credential Access;Unconstrained Delegation T1558 | IOE |
| Computers Without PowerShell Logging Enabled | |
Computers Without PowerShell Logging Enabled:1 | 1 | Defense Evasion;Obfuscated Files or Information T1027 | IOE |
| DC Computer Accounts with Unprivileged Owners | |
DC Computer Accounts with Unprivileged Owners:1 | 1 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Domain Controllers vulnerable to MS17-010-Patch Status | |
Domain Controllers without MS17-010 patch:1 | 1 | Lateral Movement;Exploitation of Remote Services T1210 | IOE |
| Domain Controllers vulnerable to MS14-068 | |
Domain Controllers without MS14-068 patch (KB3011780):1 | 1 | Privilege Escalation;Exploitation for Privilege Escalation T1068 | IOE |
| Denied RODC Password Replication Group missing Privileged Accounts | |
Total Missing Privileged Groups in Denied RODC Password Replication Group:8 | 8 | Credential Access T1003 | IOE |
| Schema Admin Group members | |
Schema Admins Group contains members:1 | 1 | Privilege Escalation T1068 | IOE |
| Users with LastPasswordSet was never Set | |
Total Users with LastPasswordSet was never set in all Domains:15136 | 15136 | Valid Accounts T1078 | IOE |
| Users with PWDLastSet to ZERO | |
Total Users with PWDLastSet to ZERO in all Domains:15136 | 15136 | Valid Accounts T1078 | IOE |
| Stale User Accounts | |
Total Stale User Accounts in all Domains:15136 | 15136 | Account Discovery T1087 | IOC |
| User Accounts Pass Never Expires | |
Total Users with Password Never Expires in all Domains:1 | 1 | Valid Accounts T1078 | IOC |
| Built-In Admin Account Not protected | |
Default Administrator Account not protected in all domains:1 | 1 | Valid Accounts T1078 | IOE IOC |
| Built-In Admin Account Not Disabled | |
Default Admin Account not disabled in Total Domains:1 | 1 | Valid Accounts T1078 | IOE IOC |
| Built-In Admin Account Not Renamed | |
Default Admin Account not renamed in Total Domains:1 | 1 | Valid Accounts T1078 | IOE |
| Built-In Admin Account Password Not Changed in 90 days | |
Total Domains in which Default Administrator password not changed since last 90 days:1 | 1 | Valid Accounts T1078 | IOE |
| Built-In Admin Account was used in last 10 days | |
Total Domains in which Default Administrator account was used in last 10 days:1 | 1 | Valid Accounts T1078 | IOC |
| Guest Account is not renamed | |
Guest Account not renamed in Total Domains:1 | 1 | Valid Accounts T1078 | IOE |
| Missing Privileged Groups in Protected Users Group | |
Total Missing Privileged Groups in Protected Users Group:Not In Use | Not In Use | Valid Accounts T1078 | IOE IOC |
| Too Many Privileged Accounts | |
Affected AD Domains:1 | 1 | Privilege Escalation;Account Manipulation T1098 | IOC |
| Passwords Not Changed within 90 days | |
Total Admin Accounts Did Not Change Their Passwords Since Last 90 Days:4 | 4 | Valid Accounts T1078 | IOE |
| Password Do Not Expire | |
Total Admin Accounts set to PasswordNeverExpires:4 | 4 | Valid Accounts T1078 | IOE |
| Default Domain Policy-Minimum Password Length | |
Account Policies Not Configured correctly in Total Domains:1 | 1 | Modify Authentication Process T1556 | IOE |
| FGPP Policies-Minimum Password Length | |
FGPP Not Configured Correctly In Domains:Not Created | Not Created | Modify Authentication Process T1556 | IOE |
| FGPP Policies Not Applying | |
Total FGPP Not Applying in All Domains:Not Created | Not Created | Modify Authentication Process T1556 | IOE |
| AllowNT4Crypto DCs | |
Total DCs with AllowNT4Crypto Enabled:1 | 1 | Use Alternate Authentication Material T1550 | IOE |
| RC4 Encryption Enabled DCs | |
Total Domain Controllers With RC4 Encryption Enabled:1 | 1 | Use Alternate Authentication Material T1550 | IOE |
| Missing Updates DCs | |
Total DCs Not Updated Since Last 45 Days:1 | 1 | Exploitation for Privilege Escalation T1068 | IOE |
| Scheduled Tasks found on Domain Controllers | |
Total Scheduled Tasks on DCs:168 | 168 | Persistence;Scheduled Task/Job T1053 | IOC |
| No Group Policy Objects Defining Log Size and Retention | |
Total AD Domains Affected:1 | 1 | Defense Evasion;Indicator Removal T1070 | |
| No Group Policy Objects to Prevent Domain Admins from logging on to Workstations or Servers Found | |
Total AD Domains Affected:1 | 1 | Lateral Movement;Remote Services T1021 | |
| No Group Policy Objects to Block ISO Execution Found | |
Total AD Domains Affected:1 | 1 | Initial Access;User Execution T1204 | |
| No Group Policy Objects to Mitigate SMBv1 Found | |
Total AD Domains Affected:1 | 1 | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| No Group Policy Objects Enforcing UAC Prompt for Elevation Found | |
Total AD Domains Affected:1 | 1 | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| No Group Policy Objects to Mitigate Accidental Script Execution | |
Total AD Domains Affected:1 | 1 | Initial Access;User Execution T1204 | |
| No Group Policy Objects to Mitigate NTLMv1 Protocol | |
Total AD Domains Affected:1 | 1 | Credential Access;NTLM Hash Theft T1550.002 | |
| Passwords to be saved status | |
Setting Status:Missing | Missing | Credential Access;Credentials in Registry T1552.002 | |
| Always prompt for password upon connection status | |
Setting Status:Missing | Missing | Credential Access;Brute Force T1110 | |
| Require secure RPC communication status | |
Setting Status:Missing | Missing | Lateral Movement;Remote Services T1021 | |
| Set client connection encryption level status | |
Setting Status:Missing | Missing | Lateral Movement;Remote Services T1021 | |
| Windows Defender SmartScreen status | |
Setting Status:Missing | Missing | Defense Evasion;Exploitation for Privilege Escalation T1068 | |
| AutoPlay status | |
Setting Status:Missing | Missing | Initial Access;User Execution T1204 | |
| Default behavior for AutoRun status | |
Setting Status:Missing | Missing | Initial Access;User Execution T1204 | |
| UNC Paths Hardened status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Insecure guest logons status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Domain controller- LDAP server signing requirements status | |
Setting Status:Missing | Missing | Credential Access;Man-in-the-Middle T1557 | |
| Domain controller- Refuse machine account password changes status | |
Setting Status:Missing | Missing | Persistence;Modify Authentication Process T1556 | |
| Domain member- Digitally encrypt secure channel data (when possible) status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Domain member- Digitally sign secure channel data (when possible) status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Domain member- Disable machine account password changes status | |
Setting Status:Missing | Missing | Persistence;Account Manipulation T1098 | |
| Domain member- Maximum machine account password age status | |
Setting Status:Missing | Missing | Credential Access;Brute Force T1110 | |
| Domain member- Require strong (Windows 2000 or later) session key status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Interactive logon- Machine inactivity limit status | |
Setting Status:Missing | Missing | Credential Access;Brute Force T1110 | |
| Microsoft network client- Digitally sign communications (always) status | |
Setting Status:Missing | Missing | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Microsoft network client- Send unencrypted password to third-party SMB servers status | |
Setting Status:Missing | Missing | Credential Access;Man-in-the-Middle T1557 | |
| Network access- Do not allow anonymous enumeration of SAM accounts status | |
Setting Status:Missing | Missing | Discovery;Account Discovery T1087 | |
| Network access- Do not allow anonymous enumeration of SAM accounts and shares status | |
Setting Status:Missing | Missing | Discovery;Network Share Discovery T1135 | |
| Network security- Allow LocalSystem NULL session fallback status | |
Setting Status:Missing | Missing | Credential Access;Man-in-the-Middle T1557 | |
| Network security- Allow LocalSystem NULL session fallback status | |
Setting Status:Missing | Missing | Credential Access;Man-in-the-Middle T1557 | |
| Network security- LAN Manager authentication level status | |
Setting Status:Missing | Missing | Credential Access;NTLM Hash Theft T1550.002 | |
| Network security- LDAP client signing requirements | |
Setting Status:Missing | Missing | Credential Access;Man-in-the-Middle T1557 | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status | |
Setting Status:Missing | Missing | Credential Access;NTLM Hash Theft T1550.002 | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status | |
Setting Status:Missing | Missing | Credential Access;NTLM Hash Theft T1550.002 | |
| System objects- Strengthen default permissions of internal system objects status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Admin Approval Mode for the Built-in Administrator account status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Behavior of the elevation prompt for standard users status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Detect application installations and prompt for elevation status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Only elevate UIAccess applications that are installed in secure locations status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Run all administrators in Admin Approval Mode status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| User Account Control- Virtualize file and registry write failures to per-user locations status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| Audit Process Creation status | |
Setting Status:Missing | Missing | Defense Evasion;Process Injection T1055 | |
| Audit Directory Service Access status | |
Setting Status:Missing | Missing | Discovery;Permission Groups Discovery T1069 | |
| Audit Directory Service Changes status | |
Setting Status:Missing | Missing | Persistence;Account Manipulation T1098 | |
| Audit Group Membership status | |
Setting Status:Missing | Missing | Privilege Escalation;Account Manipulation T1098 | |
| Audit Logon status | |
Setting Status:Missing | Missing | Credential Access;Valid Accounts T1078 | |
| Audit Other Logon/Logoff Events status | |
Setting Status:Missing | Missing | Credential Access;Valid Accounts T1078 | |
| Audit Special Logon status | |
Setting Status:Missing | Missing | Credential Access;Valid Accounts T1078 | |
| Audit Detailed File Share status | |
Setting Status:Missing | Missing | Collection;Data from Network Shared Drive T1039 | |
| Audit File Share status | |
Setting Status:Missing | Missing | Collection;Data from Network Shared Drive T1039 | |
| Audit Other Object Access Events status | |
Setting Status:Missing | Missing | Collection;Data from Local System T1005 | |
| Audit Removable Storage status | |
Setting Status:Missing | Missing | Collection;Data from Removable Media T1025 | |
| Audit Audit Policy Change status | |
Setting Status:Missing | Missing | Defense Evasion;Modify Security Tools T1562 | |
| Audit Authentication Policy Change status | |
Setting Status:Missing | Missing | Defense Evasion;Modify Authentication Process T1556 | |
| Audit MPSSVC Rule-Level Policy Change status | |
Setting Status:Missing | Missing | Defense Evasion;Modify Security Tools T1562 | |
| Audit Other Policy Change Events status | |
Setting Status:Missing | Missing | Defense Evasion;Modify Security Tools T1562 | |
| Audit Sensitive Privilege Use status | |
Setting Status:Missing | Missing | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | |
| Audit System Integrity status | |
Setting Status:Missing | Missing | Defense Evasion;Modify Security Tools T1562 | |
| High Value Targets Found | |
Total High Value Targets Found:2 | 2 | Discovery;Account Discovery T1087 | IOE IOC |
| Managed Service Accounts Status | |
Managed Service Accounts Status:Are not in use | Are not in use | Valid Accounts T1078 | |
| Users Sending Bad Logons | |
Total Users sending Bad Logons in all Domains:1 | 1 | Brute Force T1110 | IOC |
| Users Disabled | |
Total Disabled Users in all Domains:9 | 9 | Account Manipulation T1098 | IOC |
| Missing SSL Authentication DCs | |
Total DCs without SSL:1 | 1 | Modify Authentication Process T1556 | IOE |
| Unprotected OUs | |
Total Ous not protected:1 | 1 | Account Manipulation T1098 | |
| gMSA Accounts Status | |
Total Domains With gMSA Accounts:0 | 0 | Valid Accounts T1078 | |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | Account Manipulation T1098 | IOE |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | Account Manipulation T1098 | |
| Users without UPN specified | |
Total Users with UPN Blank in all Domains:1 | 1 | Account Discovery T1087 | |
| Orphaned Admins on AdminSDHolder | |
Total Possible Orphaned Admins in all Domains on AdminSDHolder object:0 | 0 | Privilege Escalation T1068 | IOC |
| Dangerous Permissions on AdminSDHolder | |
AD Domains Affected:0 | 0 | Privilege Escalation T1068 | IOC |
| AdminSDHolder was Modified in last 30 days | |
AdminSDHolder Object was modified in total domains:0 | 0 | Defense Evasion T1562 | IOC |
| Constrained delegation to domain controller service | |
Total Computers with Constrained Delegation in all Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Resource-based constrained delegation on domain controllers | |
Total Computers with Resource-Based Delegation in all Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Anonymous Access to Active Directory | |
Anonymous Access To Active Directory:0 | 0 | Account Discovery T1087 | IOE |
| Found Hidden Domain Controllers | |
Total Hidden Domain Controllers:0 | 0 | Discovery;Domain Trust Discovery T1482 | IOE |
| Successful Exploit Machine Accounts Found | |
Total Exploit Machine Accounts:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Possible User-based Service Accounts found | |
Total Possible User-Based Service Accounts:0 | 0 | Credential Access;Valid Accounts T1078 | IOC |
| Domain Trusts Found | |
Domain Trusts Status:Not Found | Not Found | Discovery;Domain Trust Discovery T1482 | IOE IOC |
| Found Bitlocker Disabled Computers | |
Computers missing BitLocker Recovery Info in AD:0 | 0 | Defense Evasion;Impair Defenses T1562 | IOE |
| Found Computers Running Obsolete OS Versions | |
Computers running obsolete OS versions:0 | 0 | Initial Access;Exploit Public-Facing Application T1190 | IOE |
| Found Service Accounts With Unchanged Passwords | |
Service accounts with unchanged passwords:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| Found Inactive Service Accounts | |
Inactive service accounts (>90 days):0 | 0 | Persistence;Valid Accounts T1078 | IOE |
| Found Computers With Anomalous Primary Group ID | |
Computers with incorrect PrimaryGroupID:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Computers With Unreadable Primary Group ID | |
Computers with unreadable or missing PrimaryGroupID:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Large Groups | |
AD Groups with >600 Members:0 | 0 | Discovery;Permission Groups Discovery T1069 | IOE |
| Found Shadow Admins | |
Accounts with powerful delegated rights:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Dangerous dsHeuristics Settings | |
Domains with dangerous dsHeuristics settings:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Servers with Remote Desktop Drive Redirection Enabled | |
Servers with RDP Drive Redirection Enabled:0 | 0 | Collection;Data from Network Shared Drive T1039 | IOE |
| Found Servers with Remote Desktop Connections Allowed Without Password Prompt | |
Servers allowing RDP without password prompt:0 | 0 | Lateral Movement;Remote Services T1021 | IOE |
| Found Servers with Automatic Sign-in After Restart Enabled | |
Servers with Automatic Sign-in enabled:0 | 0 | Credential Access;Credentials in Registry T1552.002 | IOE |
| Found Servers with Backup Rights Assigned to Non-Administrators | |
Backup rights assigned to non-admin accounts:0 | 0 | Privilege Escalation;Abuse Elevation Control Mechanism T1548 | IOE |
| Found Servers with Remote Desktop Client Saving Passwords | |
Remote Desktop Client Saving Passwords:0 | 0 | Credential Access;Credentials in Registry T1552.002 | IOE |
| Found Servers with Print Driver Packages Downloaded Over HTTP | |
Print Driver Packages Downloaded Over HTTP:0 | 0 | Initial Access;Supply Chain Compromise T1195 | IOE |
| Found Servers with Internet Printing Enabled | |
Servers with Internet Printing Enabled:0 | 0 | Lateral Movement;Remote Services T1021 | IOE |
| Found Duplicate SamAccountNames | |
Duplicate SamAccountNames:0 | 0 | Defense Evasion;Masquerading T1036 | IOE |
| Found Duplicate UPNs | |
Duplicate UserPrincipalNames:0 | 0 | Defense Evasion;Masquerading T1036 | IOE |
| Found Duplicate Emails | |
Duplicate Email Addresses:0 | 0 | Defense Evasion;Masquerading T1036 | IOE |
| Found Authenticated Users can create DNS records | |
Authenticated Users Can Create DNS Records:0 | 0 | Persistence;Domain Policy Modification T1484 | IOE |
| Found Historical SIDs on User Accounts | |
User Accounts with Historical SIDs:0 | 0 | Privilege Escalation;SID-History Injection T1134.005 | IOE |
| Found Sensitive Group Members with Oldest Password Age | |
Sensitive Group Members With Old Passwords:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| Found Admin Accounts with Unprivileged Owners | |
Admin Accounts With Unprivileged Owners:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found gMSAs With Passwords Older Than 60 Days | |
gMSAs With Passwords Older Than 60 Days:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| Found Users With Passwords Older Than a Year | |
Users With Passwords Older Than One Year:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| Found users with Unconstrained Delegation | |
Users with Unconstrained Delegation:0 | 0 | Credential Access;Unconstrained Delegation T1558 | IOE |
| Ensure Well Known Groups are not assigned Dangerious Privileges in GPOs. | |
Well Known Groups Dangerous Privileges:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE |
| Ensure no GPO is assigning Well Known Groups to Local Groups | |
Well-Known Groups assigned to Local Groups:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure No GPOs are configured to allow LM Hash | |
LM Hash storage allowed:0 | 0 | Credential Access;OS Credential Dumping T1003 | IOE |
| Ensure Limit local account use of blank passwords to console logon only GPO Setting is enabled | |
LimitBlankPasswordUse Setting:0 | 0 | Credential Access;Valid Accounts T1078 | IOE |
| Ensure wellKnownObjects has not been modified | |
Modified wellKnownObjects Locations:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure SIDHistory is enabled for trusts | |
SIDHistory enabled trusts:0 | 0 | Privilege Escalation;SID-History Injection T1134.005 | IOE |
| Ensure Membership in Allowed RODC Password Replication Group is limited | |
Allowed RODC PRG unauthorized members:0 | 0 | Credential Access;OS Credential Dumping T1003 | IOE |
| Ensure Dangerous Rights are detected on OUs and removed | |
Exploitable Delegation Rights on OUs:0 | 0 | Privilege Escalation;Permission Groups Discovery T1069 | IOE |
| Ensure Well Known Groups are not granted Dangerous Delegation on OUs | |
Well Known Groups granted Dangerous Delegation on OUs:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure Do not require Kerberos preauthentication is unchecked for Admin Accounts | |
Admin Accounts with 'Do not require Kerberos preauthentication' enabled:0 | 0 | Credential Access;AS-REP Roasting T1558.004 | IOE |
| Ensure unixUserPassword and userPassword attributes are not set for user accounts | |
Users with unixUserPassword or userPassword attributes set:0 | 0 | Credential Access;OS Credential Dumping T1003 | IOE |
| Ensure Computers have changed their password in last 90 days | |
Computers with password older than 90 days:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| Ensure DCs have no constrained Delegation | |
DCs with Constrained Delegation Configured:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure DCs have no constrained Delegation with Protocol Transition | |
DCs with Constrained Delegation & Protocol Transition:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure Stale users have no permissions to modify Group Memberships | |
Stale Users Group Modify Permissions:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure Non-Default Principals do not have DCShadow rights | |
Non-Default Principals With DCShadow Rights:0 | 0 | Privilege Escalation;DCShadow T1207 | IOE |
| Misconfigured CA Certificates Found | |
CA Signing Certificate Misconfiguration:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Dangerous Certificate Authority ACLs Found | |
Dangerous CA ACLs:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Ensure Admin Accounts do not have Unprivileged Owners | |
Admin Accounts With Unprivileged Owners:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Computers with Resource-Based Constrained Delegation | |
Computers with Resource-Based Constrained Delegation:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Service Accounts Configured with Constrained Delegation | |
Service Accounts with Constrained Delegation:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Found Objects with msds-AllowedToDelegateTo Attribute Populated | |
Objects with msds-AllowedToDelegateTo attribute populated:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs | |
Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt | |
Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt account:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Resource-Based Constrained Delegation Enabled for KRBTGT | |
Resource-Based Constrained Delegation on KRBTGT Account:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| NSPI Access Enabled | |
NSPI Access Enabled on Domain Controllers:0 | 0 | Credential Access;Directory Services Data T1003.003 | IOE |
| Foreign Security Principals in Administrative Groups | |
Foreign Security Principals in Administrative Groups:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOE |
| Outbound Trust with SID History Enabled | |
Outbound trusts with SID History enabled:0 | 0 | Privilege Escalation;SID-History Injection T1134.005 | IOE |
| Found Users using smart card with unchanged password for a long time | |
Smart Card Users with Old Passwords:0 | 0 | Credential Access;Valid Accounts T1078 | IOE |
| Users with AD Replication Permissions | |
Accounts with AD Replication Permissions:0 | 0 | Credential Access;DCSync T1003.006 | IOE |
| Domain Controllers vulnerable to MS17-010 | |
Domain Controllers with SMBv1 Enabled:0 | 0 | Lateral Movement;Exploitation of Remote Services T1210 | IOE |
| Certificate Templates Editable by Everyone | |
Templates with Insecure Permissions:0 | 0 | Privilege Escalation;Certificate Services Abuse T1649 | IOE |
| Trusts SID Filtering Check | |
Trusts with SID Filtering Disabled:0 | 0 | Privilege Escalation;SID-History Injection T1134.005 | IOE |
| Allowed RODC Password Replication Group is not empty | |
Total Members in RODC Replication Group:0 | 0 | Credential Access T1003 | IOE |
| Managed service accounts with passwords unchanged for more than 90 days | |
Total Managed Service Accounts Password Unchanged Since last 90 days:0 | 0 | Credential Access;Brute Force T1110 | IOE |
| msDS-NeverRevealGroupattribute RODC missing Privileged Accounts | |
Total Privileged Groups Not in PRP Denied List:0 | 0 | Credential Access T1003 | IOE |
| Unsecure Updates Zones | |
Total DNS Zones accepting non-secure updates:0 | 0 | Modify Authentication Process T1556 | IOE IOC |
| Users with SPNs Configured | |
Total Users with SPN defined in all Domains:0 | 0 | Kerberoasting T1558.003 | IOE |
| Password Expiration is missing for smart card users | |
AD Domains Affected:0 | 0 | Credential Access;Valid Accounts T1078 | IOE |
| Accounts vulnerable to Kerberoasting Found | |
Total Kerberoasting Accounts Found:0 | 0 | Credential Access;Kerberoasting T1558.003 | IOE |
| Users With DES encryption | |
Total Users with DES Encryption in all Domains:0 | 0 | Use Alternate Authentication Material T1550 | IOE |
| Users With Reversible Encryption | |
Total Users with Reversible Encryption set in all Domains:0 | 0 | Unsecured Credentials T1552 | IOE |
| Users With Kerberos Pre-Authentication | |
Total Pre-Authentication Users in all domains:0 | 0 | Use Alternate Authentication Material T1550 | IOE |
| Users Modified with PrimaryGroupID | |
Total Users with PrimaryGroupID Modified in all Domains:0 | 0 | Account Manipulation T1098 | IOC |
| Users Expired | |
Total Expired Users in all Domains:0 | 0 | Valid Accounts T1078 | IOC |
| User Accounts Pass Not Required | |
Total Users with Password Not Required set in all Domains:0 | 0 | Valid Accounts T1078 | IOC |
| Computers with SPNs Configured | |
Total Computers using ServicePrincipalNames in all Domains:0 | 0 | Kerberoasting T1558.003 | IOE |
| Computers With Unconstrained Delegation | |
Total Computers with Unconstrained Delegation in all Domains:0 | 0 | Privilege Escalation T1068 | IOE |
| Computers Modified with PrimaryGroupID | |
Total Computers modified with PrimaryGroupID:0 | 0 | Account Manipulation T1098 | IOC |
| Computers Sending Bad Logons | |
Total Computers sending Bad Logon Attempts in all Domains:0 | 0 | Brute Force T1110 | IOC |
| Computers Disabled | |
Total Disabled Computer Accounts in all Domains:0 | 0 | Account Manipulation T1098 | IOC |
| Stale Computer Accounts | |
Total Stale Computer Accounts in all Domains:0 | 0 | Account Discovery T1087 | IOC |
| Unsupported Operating Systems | |
Total End Of Life-Unsupported Operating Systems:0 | 0 | Exploitation for Privilege Escalation T1068 | IOE |
| Admins with SPNs Configured | |
Total Admin Accounts With ServicePrincipalName Identified:0 | 0 | Kerberoasting T1558.003 | IOE |
| Domain Controllers not owned by Admins | |
Total Domain Controllers owned by non-privileged accounts:0 | 0 | Account Manipulation T1098 | IOC |
| Computer Objects not managed by Admins | |
Total Computers Not Managed By Admins in all Domains:0 | 0 | Account Manipulation T1098 | IOC |
| Organizational Units not managed by Admins | |
Total Organizational Units Not Managed By Admins:0 | 0 | Account Manipulation T1098 | IOC |
| Sensitive GPOs Modified | |
Sensitive GPOs Status in Last 10 Days:Not Modified | Not Modified | Defense Evasion T1562 | IOC |
| Recently Created Privileged Admins | |
Total Privileged Accounts created in last 10 days in all domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Changes to Privileged Groups in Last 15 days | |
Total Privileged Groups Modified in Last 15 Days in All Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Users Identified with Privileged SIDs in sIDHistory | |
Total Users containing Admin Accounts in sIDHistory in all Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Computers Identified with Privileged SIDs in sIDHistory | |
Total Computers containing Admin Accounts in sIDHistory in all Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| Found Excluded Groups by AdminSDHolder and SDProp | |
Total Excluded Groups by SDProp Process:0 | 0 | Privilege Escalation T1068 | IOC |
| krbtgt Account with Resource-Based Constrained Delegation | |
Affected number of Domains:0 | 0 | Privilege Escalation T1068 | IOC |
| KRBTGT Account Password Not Changed | |
Total Domains Using KRBTGT Old Password:0 | 0 | Kerberos Ticket Forging T1558 | IOE |
| Guest Account is enabled | |
Total Guest Accounts Enabled in All Domains:0 | 0 | Valid Accounts T1078 | IOE |
| Administrator Account ServicePrincipalNames Found | |
Total AD Domains Affected:0 | 0 | Credential Access;Kerberoasting T1558.003 | IOE |
| Privileged Accounts Pass Never Expires | |
Total Privileged Accounts set to Password Never Expire in all Domains:0 | 0 | Valid Accounts T1078 | IOE IOC |
| Inactive Admins | |
Total Enabled Admin Accounts Not In Use Since Last 30 Days:0 | 0 | Valid Accounts T1078 | IOE |
| Privileged Groups Contain more than 20 members | |
Privileged Groups Contain More than 20 members:0 | 0 | Privilege Escalation T1068 | IOE |
| Kerberos Pre-authentication Disabled | |
Total Pre-Authentication Admins in all domains:0 | 0 | Use Alternate Authentication Material T1550 | IOE IOC |
| Disabled Admins part of Privileged Groups | |
Total Disabled Admins In Privileged Groups:0 | 0 | Privilege Escalation T1068 | IOE |
| DNSAdmins Group has members | |
Total Members In DNSAdmins Group In All Domains:0 | 0 | Privilege Escalation T1068 | IOE IOC |
| Privileged Groups Contained Computer Accounts | |
Total computer accounts part of privileged groups:0 | 0 | Privilege Escalation T1068 | IOE IOC |
| Privileged Admins missing AdminCount=1 Flag | |
Total Admins not set with AdminCount=1 flag in all domains:0 | 0 | Privilege Escalation T1068 | IOC |
| ForeignSecurityPrincipals In Privileged Groups | |
Total ForeignSecurityPrincipal in Privileged Groups:0 | 0 | Privilege Escalation T1068 | IOE IOC |
| Operators Groups are not empty | |
Operators Groups containing total members in all domains:0 | 0 | Privilege Escalation T1068 | IOE IOC |
| AdminsCount Flag set users not acting as Admins | |
Total Unknown Admins Found:0 | 0 | Privilege Escalation;Account Manipulation T1098 | IOC |
| Domain Controllers Modified with PrimaryGroupID | |
Total Domain Controllers modified with PrimaryGroupID:0 | 0 | Account Manipulation T1098 | IOC |
| SMB 1 Protocol Enabled DCs | |
Total Domain Controllers with SMB1 Server Protocol Enabled:0 | 0 | Lateral Movement T1021 | IOE |
| SMB 1 Client Protocol Enabled DCs | |
Total Domain Controllers with SMB1 Client Service Enabled:0 | 0 | Lateral Movement T1021 | IOE |
| LAN Manager password hashes Enabled DCs | |
Total DCs with LAN Manager Password Hashes:0 | 0 | Unsecured Credentials T1552 | IOE |
| SMB Signing Disabled DCs | |
Total Domains Controller Without SMB Signing:0 | 0 | Lateral Movement T1021 | IOE |
| LDAP Signing Disabled DCs | |
Total Domain Controllers Without LDAP Signing:0 | 0 | Modify Authentication Process T1556 | IOE |
| Unauthenticated DCs since last 45 Days | |
Total Domain Controllers Not Authenticated Within 45 days In All Domains:0 | 0 | Valid Accounts T1078 | IOE |
| Secrets not renewed DCs | |
Total Domain Controllers Not Changed Password Within 45 Days In All Domains:0 | 0 | Valid Accounts T1078 | IOE |
| Ensure UNC Paths for SYSVOL and NETLOGON are harderend | |
SYSVOL and Netlogon Hardening Missing on Total DCs:0 | 0 | Lateral Movement;SMB/Windows Admin Shares T1021.002 | IOE |
| Unsupported OS DCs | |
Total DCs running Unsupported Operating Systems:0 | 0 | Exploitation for Privilege Escalation T1068 | IOE |
| Event Log Config Not Correct DCs | |
Total DCs with Event Log misconfiguration:0 | 0 | Impair Defenses T1562 | |
| Event Log Size Not Optimized DCs | |
Total DCs with Event Log Size not optimal:0 | 0 | Impair Defenses T1562 | |
| Microsoft FTP service installed DCs | |
Total Domain Controllers have FTP Server Installed::0 | 0 | Initial Access;Exploit Public-Facing Application T1190 | IOE |
| Peer Name Resolution Protocol installed DCs | |
Total Domain Controllers have Peer Name Resolution Protocol Installed::0 | 0 | Lateral Movement;SMB/Windows Admin Shares T1021.002 | IOE |
| Simple TCP-IP Services installed DCs | |
Total Domain Controllers have Simple TCP/IP Services Installed::0 | 0 | Initial Access;Exploit Public-Facing Application T1190 | IOE |
| Telnet Client installed DCs | |
Total Domain Controllers have Telnet Client Installed::0 | 0 | Lateral Movement;Remote Services T1021 | IOE |
| TFTP Client installed DCs | |
Total Domain Controllers have TFTP Client Installed::0 | 0 | Exfiltration;Exfiltration Over Unencrypted Channel T1048.001 | IOE |
| Server Message Block (SMB) v1 protocol Installed DCs | |
Total Domain Controllers have SMB 1.0/CIFS File Sharing Support Installed::0 | 0 | Lateral Movement;SMB/Windows Admin Shares T1021.002 | IOE |
| Windows PowerShell 2.0 installed DCs | |
Total Domain Controllers have Windows PowerShell 2.0 Engine Installed::0 | 0 | Defense Evasion;Downgrade Attack T1562.010 | IOE |
| Managed Service Accounts Not Linked | |
Total Managed Service Accounts are not Linked:0 | 0 | Valid Accounts T1078 | IOE |
| TombstoneLifeTime Modified? | |
Current TombstoneLifeTime Value:180 | 180 | Defense Evasion T1562 | |
| Duplicate SPNs | |
Total Duplicate SPNs in AD Domains:0 | 0 | Kerberoasting T1558.003 | |
| Unauthenticated Servers | |
Total Servers Not Authenticated Within 90 Days in All Domains:0 | 0 | Valid Accounts T1078 | IOE IOC |
| Secrets not renewed Servers | |
Total Servers Not Changing Password within 45 days in all Domains:0 | 0 | Valid Accounts T1078 | IOE IOC |
| Found Unused Netlogon Scripts | |
Total Unused Scripts In All Domains:0 | 0 | Persistence;Logon Script T1037.001 | IOE IOC |
| Orphaned GPO Containers | |
Total Orphaned Group Policy Objects:0 | 0 | Defense Evasion T1562 | |
| No Group Policy Objects for Preventing passwords using reversible encryption | |
Total AD Domains Affected:0 | 0 | Credential Access;OS Credential Dumping T1003 | |
| GPO Preferences Containing Passwords | |
GPO Preferences Containing Password in All AD Domains:0 | 0 | Credential Access;Credentials in Files T1552.001 | |
| Domain member- Digitally encrypt or sign secure channel data (always) status | |
Setting Status:Found | Found | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Microsoft network server- Digitally sign communications (always) status | |
Setting Status:Found | Found | Lateral Movement;SMB/Windows Admin Shares T1021.002 | |
| Network security- Do not store LAN Manager hash value on next password change status | |
Setting Status:Found | Found | Credential Access;OS Credential Dumping T1003 | |
| Locked Out Accounts Found | |
Total Accounts Locked Out in All Domains:0 | 0 | Brute Force T1110 | |
| Group Policy Objects with Improper Permissions Found | |
Abusable GPO Permissions found in Total AD Domains:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| Group Policy Object Assignments with Improper Permissions Found | |
Total Abusable GPO Permissions in AD Domains:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| Dangerous Permissions Found on MicrosoftDNS Container | |
AD Domains Affected:0 | 0 | Privilege Escalation;Permission Groups Discovery T1069 | IOE IOC |
| Dangerous Permissions Found on Naming Contexts | |
AD Domains Affected:0 | 0 | Privilege Escalation;Permission Groups Discovery T1069 | IOE IOC |
| Pre-Windows 2000 Compatible Access Group is not empty | |
Number of AD Domains Affected:0 | 0 | Credential Access;Brute Force T1110 | IOE IOC |
| Found Groups with SID history Set | |
Total Groups With sIDHistory Affected domains:0 | 0 | Privilege Escalation;SID-History Injection T1134.005 | IOE IOC |
| Abusable Permissions Found on SYSVOL and NETLOGON | |
Abusable Permissions Found on SYSVOL and Netlogon Shares:Ok | Ok | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| LAPS SearchFlag modified | |
LAPS SearchFlags Modified:Not Modified | Not Modified | Credential Access;OS Credential Dumping T1003 | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain NC | |
AD Domains Affected:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain Controllers OU | |
AD Domains Affected:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| Unauthorized Users having GPLink Rights on AD Sites | |
AD Sites Affected:0 | 0 | Privilege Escalation;Domain Policy Modification T1484 | IOE IOC |
| Test | Severity | Items | Affected Objects | Zero Trust Pillar | IOC/IOE |
| Anonymous or EVERYONE in Pre-Windows 2000 Group | |
Number of Domains Affected:1 | 1 | Identity | IOE IOC |
| Admins Sending Bad Logons | |
Total Privileged Users With Bad Logon Attempts:1 | 1 | Identity | IOC |
| Misconfigured Administrative Accounts Found | |
Total Admins Misconfigured:4 | 4 | Identity | IOE IOC |
| Weak Password Policies Affected Admins | |
Total Privileged Account using Weak Password Policy:2 | 2 | Identity | IOE IOC |
| TLS 1.1 Enabled DCs | |
Total Domain Controllers with TLS 1.1 Protocol Enabled:1 | 1 | Network | IOE |
| NTLM Authentication Enabled DCs | |
Total Domain Controllers with NTLM Enabled:1 | 1 | Network | IOE |
| Missing DNS Scavenging DCs | |
Total DNS Servers Not Enabled with Server Level Scavenging:1 | 1 | Network | IOE |
| Print Spooler Service Running DCs | |
Total Domain Controllers with Print Spooler Service running:1 | 1 | Devices | IOE |
| Accounts with Extended Rights to Read LAPS Passwords Found | |
Illegal Accounts Found to read LAPS in AD Domains:1 | 1 | Identity | IOE IOC |
| Protected Users Group Status | |
Total Domains Not Using Protected Users Group:1 | 1 | Identity | |
| Missing Microsoft LAPS in AD Forest | |
Microsoft LAPS Status:Not Deployed | Not Deployed | Identity | |
| Anyone can Join Computers to Domain | |
Total Domains Allowing Normal Users to Join Computers to domain:1 | 1 | Identity | IOE |
| Service Accounts Supported Encryption Algorithms | |
Service account encryption types summary:1 | 1 | Identity | IOE |
| Found Smart Card Authentication Not Enforced for AD Users | |
Users without smart card enforcement:15137 | 15137 | Identity | IOE |
| Found Servers with Microsoft Defender Antivirus SmartScreen Disabled | |
Servers with SmartScreen disabled:1 | 1 | Devices | IOE |
| Found Servers with Secure Boot Disabled | |
Servers with Secure Boot Disabled:1 | 1 | Devices | IOE |
| Found Users With Empty Passwords | |
Users With No Password Required:15151 | 15151 | Identity | IOE |
| Found Non-DC Servers with Unconstrained Delegation | |
Non-DC Servers with Unconstrained Delegation:1 | 1 | Identity | IOE |
| Ensure GPO Setting Network security-Restrict NTLM-Outgoing NTLM traffic to remote servers is configured to DCs | |
Restrict NTLM Outgoing Traffic DC Setting:1 | 1 | Network | IOE |
| Ensure GPO Setting compound authentication and Kerberos armoring is enabled for DCs | |
Kerberos Armoring for DCs:1 | 1 | Identity | IOE |
| Ensure No vulnerabilities because of 2016-AD Prep | |
Enterprise Key Admins FullControl ACE:1 | 1 | Devices | IOE |
| Ensure Domain Controllers have Auditing Policies configured | |
Domain Controllers Auditing Policies:1 | 1 | Visibility and Analytics | IOE |
| Ensure RODCs have read-only access to SYSVOL folder | |
RODC access to SYSVOL checked:1 | 1 | Devices | IOE |
| Ensure Recovery console-Allow automatic administrative logon GPO setting is turned off | |
Recovery Console Admin Logon Setting:2 | 2 | Devices | IOE |
| Ensure Denied RODC Password Replication Group includes default members | |
Denied RODC PRG missing members:8 | 8 | Identity | IOE |
| Ensure RIGHT_DS_LIST_OBJECT is correctly configured to enforce isolation between OUs | |
DS List Object Mode Enforcement:1 | 1 | Identity | IOE |
| Ensure Admin Accounts have Emails configured | |
Admin Accounts Missing Email:1 | 1 | Identity | IOE |
| Ensure GPO Setting Turn off multicast name resolution is enabled to prevent LLMNR | |
Turn Off Multicast Name Resolution Setting:2 | 2 | Network | IOE |
| Found Computers with Unconstrained Delegation | |
Computers with Unconstrained Delegation:1 | 1 | Identity | IOE |
| Computers Without PowerShell Logging Enabled | |
Computers Without PowerShell Logging Enabled:1 | 1 | Visibility and Analytics | IOE |
| DC Computer Accounts with Unprivileged Owners | |
DC Computer Accounts with Unprivileged Owners:1 | 1 | Identity | IOE |
| Domain Controllers vulnerable to MS17-010-Patch Status | |
Domain Controllers without MS17-010 patch:1 | 1 | Devices | IOE |
| Domain Controllers vulnerable to MS14-068 | |
Domain Controllers without MS14-068 patch (KB3011780):1 | 1 | Devices | IOE |
| Denied RODC Password Replication Group missing Privileged Accounts | |
Total Missing Privileged Groups in Denied RODC Password Replication Group:8 | 8 | Identity | IOE |
| Schema Admin Group members | |
Schema Admins Group contains members:1 | 1 | Identity | IOE |
| Missing Domain Zones Scavenging | |
Total Domain Zones Not Enabled with Scavenging:1 | 1 | Network | IOC |
| AD Partitions Backup Status | |
Total AD Partitions not backed up since last 7 days:5 | 5 | Data | |
| Users with LastPasswordSet was never Set | |
Total Users with LastPasswordSet was never set in all Domains:15136 | 15136 | Identity | IOE |
| Users with PWDLastSet to ZERO | |
Total Users with PWDLastSet to ZERO in all Domains:15136 | 15136 | Identity | IOE |
| Stale User Accounts | |
Total Stale User Accounts in all Domains:15136 | 15136 | Identity | IOC |
| User Accounts Pass Never Expires | |
Total Users with Password Never Expires in all Domains:1 | 1 | Identity | IOC |
| Built-In Admin Account Not protected | |
Default Administrator Account not protected in all domains:1 | 1 | Identity | IOE IOC |
| Built-In Admin Account Not Disabled | |
Default Admin Account not disabled in Total Domains:1 | 1 | Identity | IOE IOC |
| Built-In Admin Account Not Renamed | |
Default Admin Account not renamed in Total Domains:1 | 1 | Identity | IOE |
| Built-In Admin Account Password Not Changed in 90 days | |
Total Domains in which Default Administrator password not changed since last 90 days:1 | 1 | Identity | IOE |
| Built-In Admin Account was used in last 10 days | |
Total Domains in which Default Administrator account was used in last 10 days:1 | 1 | Identity | IOC |
| Guest Account is not renamed | |
Guest Account not renamed in Total Domains:1 | 1 | Identity | IOE |
| Missing Privileged Groups in Protected Users Group | |
Total Missing Privileged Groups in Protected Users Group:Not In Use | Not In Use | Identity | IOE IOC |
| Too Many Privileged Accounts | |
Affected AD Domains:1 | 1 | Identity | IOC |
| Passwords Not Changed within 90 days | |
Total Admin Accounts Did Not Change Their Passwords Since Last 90 Days:4 | 4 | Identity | IOE |
| Password Do Not Expire | |
Total Admin Accounts set to PasswordNeverExpires:4 | 4 | Identity | IOE |
| Default Domain Policy-Minimum Password Length | |
Account Policies Not Configured correctly in Total Domains:1 | 1 | Identity | IOE |
| FGPP Policies-Minimum Password Length | |
FGPP Not Configured Correctly In Domains:Not Created | Not Created | Identity | IOE |
| FGPP Policies Not Applying | |
Total FGPP Not Applying in All Domains:Not Created | Not Created | Identity | IOE |
| AllowNT4Crypto DCs | |
Total DCs with AllowNT4Crypto Enabled:1 | 1 | Network | IOE |
| RC4 Encryption Enabled DCs | |
Total Domain Controllers With RC4 Encryption Enabled:1 | 1 | Identity | IOE |
| Missing Updates DCs | |
Total DCs Not Updated Since Last 45 Days:1 | 1 | Devices | IOE |
| Scheduled Tasks found on Domain Controllers | |
Total Scheduled Tasks on DCs:168 | 168 | Devices | IOC |
| Sites without Subnets Association | |
Total AD Sites Without Subnets:1 | 1 | Network | |
| PDC Emulator Time Source | |
Root PDC Time Source:Internal Source | Internal Source | Network | |
| No Group Policy Objects Defining Log Size and Retention | |
Total AD Domains Affected:1 | 1 | Visibility and Analytics | |
| No Group Policy Objects to Prevent Domain Admins from logging on to Workstations or Servers Found | |
Total AD Domains Affected:1 | 1 | Identity | |
| No Group Policy Objects to Block ISO Execution Found | |
Total AD Domains Affected:1 | 1 | Devices | |
| No Group Policy Objects to Mitigate SMBv1 Found | |
Total AD Domains Affected:1 | 1 | Devices | |
| No Group Policy Objects Enforcing UAC Prompt for Elevation Found | |
Total AD Domains Affected:1 | 1 | Identity | |
| No Group Policy Objects to Mitigate Accidental Script Execution | |
Total AD Domains Affected:1 | 1 | Devices | |
| No Group Policy Objects to Mitigate NTLMv1 Protocol | |
Total AD Domains Affected:1 | 1 | Identity | |
| Lock screen camera status | |
Setting Status:Missing | Missing | Devices | |
| Lock screen slide show status | |
Setting Status:Missing | Missing | Devices | |
| Passwords to be saved status | |
Setting Status:Missing | Missing | Identity | |
| Always prompt for password upon connection status | |
Setting Status:Missing | Missing | Identity | |
| Require secure RPC communication status | |
Setting Status:Missing | Missing | Network | |
| Set client connection encryption level status | |
Setting Status:Missing | Missing | Network | |
| Windows Defender SmartScreen status | |
Setting Status:Missing | Missing | Devices | |
| AutoPlay status | |
Setting Status:Missing | Missing | Devices | |
| Default behavior for AutoRun status | |
Setting Status:Missing | Missing | Devices | |
| UNC Paths Hardened status | |
Setting Status:Missing | Missing | Network | |
| Insecure guest logons status | |
Setting Status:Missing | Missing | Network | |
| Audit- Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings status | |
Setting Status:Missing | Missing | Visibility and Automation | |
| Domain controller- LDAP server signing requirements status | |
Setting Status:Missing | Missing | Network | |
| Domain controller- Refuse machine account password changes status | |
Setting Status:Missing | Missing | Identity | |
| Domain member- Digitally encrypt secure channel data (when possible) status | |
Setting Status:Missing | Missing | Network | |
| Domain member- Digitally sign secure channel data (when possible) status | |
Setting Status:Missing | Missing | Network | |
| Domain member- Disable machine account password changes status | |
Setting Status:Missing | Missing | Identity | |
| Domain member- Maximum machine account password age status | |
Setting Status:Missing | Missing | Identity | |
| Domain member- Require strong (Windows 2000 or later) session key status | |
Setting Status:Missing | Missing | Network | |
| Interactive logon- Machine inactivity limit status | |
Setting Status:Missing | Missing | Identity | |
| Microsoft network client- Digitally sign communications (always) status | |
Setting Status:Missing | Missing | Network | |
| Microsoft network client- Send unencrypted password to third-party SMB servers status | |
Setting Status:Missing | Missing | Network | |
| Network access- Do not allow anonymous enumeration of SAM accounts status | |
Setting Status:Missing | Missing | Network | |
| Network access- Do not allow anonymous enumeration of SAM accounts and shares status | |
Setting Status:Missing | Missing | Network | |
| Network security- Allow LocalSystem NULL session fallback status | |
Setting Status:Missing | Missing | Network | |
| Network security- Allow LocalSystem NULL session fallback status | |
Setting Status:Missing | Missing | Network | |
| Network security- LAN Manager authentication level status | |
Setting Status:Missing | Missing | Identity | |
| Network security- LDAP client signing requirements | |
Setting Status:Missing | Missing | Network | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status | |
Setting Status:Missing | Missing | Network | |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status | |
Setting Status:Missing | Missing | Network | |
| System objects- Strengthen default permissions of internal system objects status | |
Setting Status:Missing | Missing | Identity | |
| User Account Control- Admin Approval Mode for the Built-in Administrator account status | |
Setting Status:Missing | Missing | Identity | |
| User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status | |
Setting Status:Missing | Missing | Identity | |
| User Account Control- Behavior of the elevation prompt for standard users status | |
Setting Status:Missing | Missing | Identity | |
| User Account Control- Detect application installations and prompt for elevation status | |
Setting Status:Missing | Missing | Applications and Workloads | |
| User Account Control- Only elevate UIAccess applications that are installed in secure locations status | |
Setting Status:Missing | Missing | Applications and Workloads | |
| User Account Control- Run all administrators in Admin Approval Mode status | |
Setting Status:Missing | Missing | Identity | |
| User Account Control- Virtualize file and registry write failures to per-user locations status | |
Setting Status:Missing | Missing | Devices | |
| Audit Credential Validation status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Computer Account Management status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Other Account Management Events status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Security Group Management status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit User Account Management status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit PNP Activity status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Process Creation status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Directory Service Access status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Directory Service Changes status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Group Membership status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Logon status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Other Logon/Logoff Events status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Special Logon status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Detailed File Share status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit File Share status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Other Object Access Events status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Removable Storage status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Audit Policy Change status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Authentication Policy Change status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit MPSSVC Rule-Level Policy Change status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Other Policy Change Events status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Sensitive Privilege Use status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Other System Events status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Security State Change status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit Security System Extension status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| Audit System Integrity status | |
Setting Status:Missing | Missing | Visibility and Analytics | |
| High Value Targets Found | |
Total High Value Targets Found:2 | 2 | Identity | IOE IOC |
| AD Recycle Bin Status | |
AD Recycle Bin Status:Disabled | Disabled | Data | |
| Managed Service Accounts Status | |
Managed Service Accounts Status:Are not in use | Are not in use | Applications and Workloads | |
| Users Sending Bad Logons | |
Total Users sending Bad Logons in all Domains:1 | 1 | Identity | IOC |
| Users Disabled | |
Total Disabled Users in all Domains:9 | 9 | Identity | IOC |
| Missing SSL Authentication DCs | |
Total DCs without SSL:1 | 1 | Network | IOE |
| Missing Enough DNS Servers in NIC DCs | |
Total DCs With inadequate Number Of DNS Servers in NIC Property:1 | 1 | Network | |
| Not Enough Local Disks DCs | |
Total DCs Not Configured With Recommended Disk Configuration:1 | 1 | Devices | |
| Missing AD Sites Coverage | |
Total AD Sites Not Covered:1 | 1 | Network | |
| Sites Missing Bridgehead Server | |
Number Of AD Sites Without Bridgehead Servers:1 | 1 | Network | |
| AD Sites Redundancy | |
Total AD Sites with Only One Domain Controller:1 | 1 | Devices | |
| Unprotected OUs | |
Total Ous not protected:1 | 1 | Data | |
| GPOs not Linked to OUs | |
Total OUs without GPO Linked:4 | 4 | Visibility and Automation | IOE |
| gMSA Accounts Status | |
Total Domains With gMSA Accounts:0 | 0 | Applications and Workloads | |
| Replication Interval Not Optimized Sites | |
Replication Interval is not optimized for Site Links:1 | 1 | Network | |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | Identity | IOE |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | Identity | |
| Security Groups without Objects | |
Total Empty Security Groups In All Domains:32 | 32 | Identity | |
| Users without UPN specified | |
Total Users with UPN Blank in all Domains:1 | 1 | Identity | |
| Missing Location Text in AD Sites | |
Total AD Sites Not Defined With Location:1 | 1 | Network | |
| GPO Description | |
Number of GPOs not set with Description:2 | 2 | Visibility and Automation | |
| Orphaned Admins on AdminSDHolder | |
Total Possible Orphaned Admins in all Domains on AdminSDHolder object:0 | 0 | Identity | IOC |
| Dangerous Permissions on AdminSDHolder | |
AD Domains Affected:0 | 0 | Identity | IOC |
| AdminSDHolder was Modified in last 30 days | |
AdminSDHolder Object was modified in total domains:0 | 0 | Visibility and Automation | IOC |
| Constrained delegation to domain controller service | |
Total Computers with Constrained Delegation in all Domains:0 | 0 | Identity | IOC |
| Resource-based constrained delegation on domain controllers | |
Total Computers with Resource-Based Delegation in all Domains:0 | 0 | Identity | IOC |
| Anonymous Access to Active Directory | |
Anonymous Access To Active Directory:0 | 0 | Network | IOE |
| Found Hidden Domain Controllers | |
Total Hidden Domain Controllers:0 | 0 | Devices | IOE |
| Successful Exploit Machine Accounts Found | |
Total Exploit Machine Accounts:0 | 0 | Identity | IOE |
| Possible User-based Service Accounts found | |
Total Possible User-Based Service Accounts:0 | 0 | Identity | IOC |
| Domain Trusts Found | |
Domain Trusts Status:Not Found | Not Found | Network | IOE IOC |
| Found Bitlocker Disabled Computers | |
Computers missing BitLocker Recovery Info in AD:0 | 0 | Devices | IOE |
| Found Computers Running Obsolete OS Versions | |
Computers running obsolete OS versions:0 | 0 | Devices | IOE |
| Found Service Accounts With Unchanged Passwords | |
Service accounts with unchanged passwords:0 | 0 | Identity | IOE |
| Found Inactive Service Accounts | |
Inactive service accounts (>90 days):0 | 0 | Identity | IOE |
| Found Computers With Anomalous Primary Group ID | |
Computers with incorrect PrimaryGroupID:0 | 0 | Identity | IOE |
| Found Computers With Unreadable Primary Group ID | |
Computers with unreadable or missing PrimaryGroupID:0 | 0 | Identity | IOE |
| Found Large Groups | |
AD Groups with >600 Members:0 | 0 | Identity | IOE |
| Found Shadow Admins | |
Accounts with powerful delegated rights:0 | 0 | Identity | IOE |
| Found Dangerous dsHeuristics Settings | |
Domains with dangerous dsHeuristics settings:0 | 0 | Identity | IOE |
| Found Servers with Remote Desktop Drive Redirection Enabled | |
Servers with RDP Drive Redirection Enabled:0 | 0 | Devices | IOE |
| Found Servers with Remote Desktop Connections Allowed Without Password Prompt | |
Servers allowing RDP without password prompt:0 | 0 | Devices | IOE |
| Found Servers with Automatic Sign-in After Restart Enabled | |
Servers with Automatic Sign-in enabled:0 | 0 | Devices | IOE |
| Found Servers with Backup Rights Assigned to Non-Administrators | |
Backup rights assigned to non-admin accounts:0 | 0 | Identity | IOE |
| Found Servers with Remote Desktop Client Saving Passwords | |
Remote Desktop Client Saving Passwords:0 | 0 | Devices | IOE |
| Found Servers with Print Driver Packages Downloaded Over HTTP | |
Print Driver Packages Downloaded Over HTTP:0 | 0 | Devices | IOE |
| Found Servers with Internet Printing Enabled | |
Servers with Internet Printing Enabled:0 | 0 | Devices | IOE |
| Found Duplicate SamAccountNames | |
Duplicate SamAccountNames:0 | 0 | Identity | IOE |
| Found Duplicate UPNs | |
Duplicate UserPrincipalNames:0 | 0 | Identity | IOE |
| Found Duplicate Emails | |
Duplicate Email Addresses:0 | 0 | Identity | IOE |
| Found Authenticated Users can create DNS records | |
Authenticated Users Can Create DNS Records:0 | 0 | Network | IOE |
| Found Historical SIDs on User Accounts | |
User Accounts with Historical SIDs:0 | 0 | Identity | IOE |
| Found Sensitive Group Members with Oldest Password Age | |
Sensitive Group Members With Old Passwords:0 | 0 | Identity | IOE |
| Found Admin Accounts with Unprivileged Owners | |
Admin Accounts With Unprivileged Owners:0 | 0 | Identity | IOE |
| Found gMSAs With Passwords Older Than 60 Days | |
gMSAs With Passwords Older Than 60 Days:0 | 0 | Identity | IOE |
| Found Users With Passwords Older Than a Year | |
Users With Passwords Older Than One Year:0 | 0 | Identity | IOE |
| Found users with Unconstrained Delegation | |
Users with Unconstrained Delegation:0 | 0 | Identity | IOE |
| Ensure Well Known Groups are not assigned Dangerious Privileges in GPOs. | |
Well Known Groups Dangerous Privileges:0 | 0 | Identity | IOE |
| Ensure no GPO is assigning Well Known Groups to Local Groups | |
Well-Known Groups assigned to Local Groups:0 | 0 | Identity | IOE |
| Ensure No GPOs are configured to allow LM Hash | |
LM Hash storage allowed:0 | 0 | Identity | IOE |
| Ensure Limit local account use of blank passwords to console logon only GPO Setting is enabled | |
LimitBlankPasswordUse Setting:0 | 0 | Identity | IOE |
| Ensure wellKnownObjects has not been modified | |
Modified wellKnownObjects Locations:0 | 0 | Identity | IOE |
| Ensure SIDHistory is enabled for trusts | |
SIDHistory enabled trusts:0 | 0 | Network | IOE |
| Ensure Membership in Allowed RODC Password Replication Group is limited | |
Allowed RODC PRG unauthorized members:0 | 0 | Identity | IOE |
| Ensure Dangerous Rights are detected on OUs and removed | |
Exploitable Delegation Rights on OUs:0 | 0 | Identity | IOE |
| Ensure Well Known Groups are not granted Dangerous Delegation on OUs | |
Well Known Groups granted Dangerous Delegation on OUs:0 | 0 | Identity | IOE |
| Ensure Do not require Kerberos preauthentication is unchecked for Admin Accounts | |
Admin Accounts with 'Do not require Kerberos preauthentication' enabled:0 | 0 | Identity | IOE |
| Ensure unixUserPassword and userPassword attributes are not set for user accounts | |
Users with unixUserPassword or userPassword attributes set:0 | 0 | Identity | IOE |
| Ensure Computers have changed their password in last 90 days | |
Computers with password older than 90 days:0 | 0 | Identity | IOE |
| Ensure DCs have no constrained Delegation | |
DCs with Constrained Delegation Configured:0 | 0 | Identity | IOE |
| Ensure DCs have no constrained Delegation with Protocol Transition | |
DCs with Constrained Delegation & Protocol Transition:0 | 0 | Identity | IOE |
| Ensure Stale users have no permissions to modify Group Memberships | |
Stale Users Group Modify Permissions:0 | 0 | Identity | IOE |
| Ensure Non-Default Principals do not have DCShadow rights | |
Non-Default Principals With DCShadow Rights:0 | 0 | Identity | IOE |
| Misconfigured CA Certificates Found | |
CA Signing Certificate Misconfiguration:0 | 0 | Identity | IOE |
| Dangerous Certificate Authority ACLs Found | |
Dangerous CA ACLs:0 | 0 | Identity | IOE |
| Ensure Admin Accounts do not have Unprivileged Owners | |
Admin Accounts With Unprivileged Owners:0 | 0 | Identity | IOE |
| Found Computers with Resource-Based Constrained Delegation | |
Computers with Resource-Based Constrained Delegation:0 | 0 | Identity | IOE |
| Found Service Accounts Configured with Constrained Delegation | |
Service Accounts with Constrained Delegation:0 | 0 | Identity | IOE |
| Found Objects with msds-AllowedToDelegateTo Attribute Populated | |
Objects with msds-AllowedToDelegateTo attribute populated:0 | 0 | Identity | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs | |
Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on DCs:0 | 0 | Identity | IOE |
| Users with Write Access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt | |
Users with write access to msDS-AllowedToActOnBehalfOfOtherIdentity on krbtgt account:0 | 0 | Identity | IOE |
| Resource-Based Constrained Delegation Enabled for KRBTGT | |
Resource-Based Constrained Delegation on KRBTGT Account:0 | 0 | Identity | IOE |
| NSPI Access Enabled | |
NSPI Access Enabled on Domain Controllers:0 | 0 | Identity | IOE |
| Foreign Security Principals in Administrative Groups | |
Foreign Security Principals in Administrative Groups:0 | 0 | Identity | IOE |
| Outbound Trust with SID History Enabled | |
Outbound trusts with SID History enabled:0 | 0 | Network | IOE |
| Ensure SDProp Process is Enabled for Critical Groups | |
SDProp Protection on Critical Groups:2 | 2 | Identity | IOE |
| Found Users using smart card with unchanged password for a long time | |
Smart Card Users with Old Passwords:0 | 0 | Identity | IOE |
| Users with AD Replication Permissions | |
Accounts with AD Replication Permissions:0 | 0 | Identity | IOE |
| Domain Controllers vulnerable to MS17-010 | |
Domain Controllers with SMBv1 Enabled:0 | 0 | Devices | IOE |
| Certificate Templates Editable by Everyone | |
Templates with Insecure Permissions:0 | 0 | Identity | IOE |
| Trusts SID Filtering Check | |
Trusts with SID Filtering Disabled:0 | 0 | Network | IOE |
| Replication Errors DCs | |
Total DCS in Replication Errors:0 | 0 | Network | IOE |
| Allowed RODC Password Replication Group is not empty | |
Total Members in RODC Replication Group:0 | 0 | Identity | IOE |
| Managed service accounts with passwords unchanged for more than 90 days | |
Total Managed Service Accounts Password Unchanged Since last 90 days:0 | 0 | Identity | IOE |
| msDS-NeverRevealGroupattribute RODC missing Privileged Accounts | |
Total Privileged Groups Not in PRP Denied List:0 | 0 | Identity | IOE |
| Unsecure Updates Zones | |
Total DNS Zones accepting non-secure updates:0 | 0 | Network | IOE IOC |
| Users with SPNs Configured | |
Total Users with SPN defined in all Domains:0 | 0 | Applications and Workloads | IOE |
| Password Expiration is missing for smart card users | |
AD Domains Affected:0 | 0 | Identity | IOE |
| Accounts vulnerable to Kerberoasting Found | |
Total Kerberoasting Accounts Found:0 | 0 | Identity | IOE |
| Users With DES encryption | |
Total Users with DES Encryption in all Domains:0 | 0 | Identity | IOE |
| Users With Reversible Encryption | |
Total Users with Reversible Encryption set in all Domains:0 | 0 | Identity | IOE |
| Users With Kerberos Pre-Authentication | |
Total Pre-Authentication Users in all domains:0 | 0 | Identity | IOE |
| Users Modified with PrimaryGroupID | |
Total Users with PrimaryGroupID Modified in all Domains:0 | 0 | Identity | IOC |
| Users Expired | |
Total Expired Users in all Domains:0 | 0 | Identity | IOC |
| User Accounts Pass Not Required | |
Total Users with Password Not Required set in all Domains:0 | 0 | Identity | IOC |
| Computers with SPNs Configured | |
Total Computers using ServicePrincipalNames in all Domains:0 | 0 | Applications and Workloads | IOE |
| Computers With Unconstrained Delegation | |
Total Computers with Unconstrained Delegation in all Domains:0 | 0 | Identity | IOE |
| Computers Modified with PrimaryGroupID | |
Total Computers modified with PrimaryGroupID:0 | 0 | Devices | IOC |
| Computers Sending Bad Logons | |
Total Computers sending Bad Logon Attempts in all Domains:0 | 0 | Devices | IOC |
| Computers Disabled | |
Total Disabled Computer Accounts in all Domains:0 | 0 | Devices | IOC |
| Stale Computer Accounts | |
Total Stale Computer Accounts in all Domains:0 | 0 | Identity | IOC |
| Unsupported Operating Systems | |
Total End Of Life-Unsupported Operating Systems:0 | 0 | Devices | IOE |
| Admins with SPNs Configured | |
Total Admin Accounts With ServicePrincipalName Identified:0 | 0 | Applications and Workloads | IOE |
| Domain Controllers not owned by Admins | |
Total Domain Controllers owned by non-privileged accounts:0 | 0 | Identity | IOC |
| Computer Objects not managed by Admins | |
Total Computers Not Managed By Admins in all Domains:0 | 0 | Devices | IOC |
| Organizational Units not managed by Admins | |
Total Organizational Units Not Managed By Admins:0 | 0 | Identity | IOC |
| Sensitive GPOs Modified | |
Sensitive GPOs Status in Last 10 Days:Not Modified | Not Modified | Visibility and Automation | IOC |
| Recently Created Privileged Admins | |
Total Privileged Accounts created in last 10 days in all domains:0 | 0 | Identity | IOC |
| Changes to Privileged Groups in Last 15 days | |
Total Privileged Groups Modified in Last 15 Days in All Domains:0 | 0 | Visibility and Automation | IOC |
| Users Identified with Privileged SIDs in sIDHistory | |
Total Users containing Admin Accounts in sIDHistory in all Domains:0 | 0 | Identity | IOC |
| Computers Identified with Privileged SIDs in sIDHistory | |
Total Computers containing Admin Accounts in sIDHistory in all Domains:0 | 0 | Devices | IOC |
| Found Excluded Groups by AdminSDHolder and SDProp | |
Total Excluded Groups by SDProp Process:0 | 0 | Identity | IOC |
| krbtgt Account with Resource-Based Constrained Delegation | |
Affected number of Domains:0 | 0 | Identity | IOC |
| KRBTGT Account Password Not Changed | |
Total Domains Using KRBTGT Old Password:0 | 0 | Identity | IOE |
| Guest Account is enabled | |
Total Guest Accounts Enabled in All Domains:0 | 0 | Identity | IOE |
| Administrator Account ServicePrincipalNames Found | |
Total AD Domains Affected:0 | 0 | Identity | IOE |
| Privileged Accounts Pass Never Expires | |
Total Privileged Accounts set to Password Never Expire in all Domains:0 | 0 | Identity | IOE IOC |
| Inactive Admins | |
Total Enabled Admin Accounts Not In Use Since Last 30 Days:0 | 0 | Identity | IOE |
| Privileged Groups Contain more than 20 members | |
Privileged Groups Contain More than 20 members:0 | 0 | Identity | IOE |
| Kerberos Pre-authentication Disabled | |
Total Pre-Authentication Admins in all domains:0 | 0 | Identity | IOE IOC |
| Disabled Admins part of Privileged Groups | |
Total Disabled Admins In Privileged Groups:0 | 0 | Identity | IOE |
| DNSAdmins Group has members | |
Total Members In DNSAdmins Group In All Domains:0 | 0 | Identity | IOE IOC |
| Privileged Groups Contained Computer Accounts | |
Total computer accounts part of privileged groups:0 | 0 | Identity | IOE IOC |
| Privileged Admins missing AdminCount=1 Flag | |
Total Admins not set with AdminCount=1 flag in all domains:0 | 0 | Identity | IOC |
| ForeignSecurityPrincipals In Privileged Groups | |
Total ForeignSecurityPrincipal in Privileged Groups:0 | 0 | Identity | IOE IOC |
| Operators Groups are not empty | |
Operators Groups containing total members in all domains:0 | 0 | Identity | IOE IOC |
| AdminsCount Flag set users not acting as Admins | |
Total Unknown Admins Found:0 | 0 | Identity | IOC |
| Domain Controllers Modified with PrimaryGroupID | |
Total Domain Controllers modified with PrimaryGroupID:0 | 0 | Devices | IOC |
| SMB 1 Protocol Enabled DCs | |
Total Domain Controllers with SMB1 Server Protocol Enabled:0 | 0 | Network | IOE |
| SMB 1 Client Protocol Enabled DCs | |
Total Domain Controllers with SMB1 Client Service Enabled:0 | 0 | Network | IOE |
| LAN Manager password hashes Enabled DCs | |
Total DCs with LAN Manager Password Hashes:0 | 0 | Identity | IOE |
| SMB Signing Disabled DCs | |
Total Domains Controller Without SMB Signing:0 | 0 | Network | IOE |
| LDAP Signing Disabled DCs | |
Total Domain Controllers Without LDAP Signing:0 | 0 | Network | IOE |
| Inconsistent DCs | |
Total Domain Controllers in Inconsistent State:0 | 0 | Devices | IOE |
| Unauthenticated DCs since last 45 Days | |
Total Domain Controllers Not Authenticated Within 45 days In All Domains:0 | 0 | Devices | IOE |
| Secrets not renewed DCs | |
Total Domain Controllers Not Changed Password Within 45 Days In All Domains:0 | 0 | Devices | IOE |
| Missed Reboot Cycles DCs | |
Total DCs Not Rebooted Since Last 30 Days:0 | 0 | Devices | IOE |
| No Contacts with Domain Controllers in Last Three Months | |
Total Domain Controllers not contacted since last three months:0 | 0 | Network | IOE |
| Ensure UNC Paths for SYSVOL and NETLOGON are harderend | |
SYSVOL and Netlogon Hardening Missing on Total DCs:0 | 0 | Network | IOE |
| Orphaned DCs | |
Total Orphaned Domain Controllers:0 | 0 | Devices | IOE |
| Missing DNS Forwarders DCs | |
Total DNS Servers Do Not Have Forwarders Configured:0 | 0 | Network | IOE |
| Missing Root Hints DCs | |
Total DNS Servers Do Not Have Root Hints Configured:0 | 0 | Network | IOE |
| Missing Host Records DCs | |
Total DCs Missing Host Records in DNS:0 | 0 | Network | IOE |
| Not Enough Free Space DCs | |
Total DCs with Low Disk Space:0 | 0 | Devices | IOE |
| Loopback Address Missing DCs | |
Total DCs not configured with Loopback Address:0 | 0 | Network | IOE |
| Multihomed DCs | |
Total DCS in Multihomed State:0 | 0 | Network | IOE |
| NTFS Replication DCs | |
Total Domain Controllers utilizing NTFRS for AD Replication:0 | 0 | Network | IOE |
| Strict Replication Disabled DCs | |
Total DCs with Strict Replication Consistency not enabled:0 | 0 | Network | IOE IOC |
| Out Of Default OUs DCs | |
Total DCs outside of it's Default OU:0 | 0 | Identity | |
| Unsupported OS DCs | |
Total DCs running Unsupported Operating Systems:0 | 0 | Devices | IOE |
| Missing DNS Dynmaic Registration on NIC DCs | |
Total DCS NIC Dynamic Updates Not Enabled:0 | 0 | Network | |
| Missing _msdcs Zone DCs | |
Total DNS Servers Missing _msdcs Zone:0 | 0 | Network | |
| Event Log Config Not Correct DCs | |
Total DCs with Event Log misconfiguration:0 | 0 | Visibility and Automation | |
| Event Log Size Not Optimized DCs | |
Total DCs with Event Log Size not optimal:0 | 0 | Visibility and Automation | |
| Fax Server role installed DCs | |
Total Domain Controllers have Fax Server Installed::0 | 0 | Devices | IOE |
| Microsoft FTP service installed DCs | |
Total Domain Controllers have FTP Server Installed::0 | 0 | Devices | IOE |
| Peer Name Resolution Protocol installed DCs | |
Total Domain Controllers have Peer Name Resolution Protocol Installed::0 | 0 | Devices | IOE |
| Simple TCP-IP Services installed DCs | |
Total Domain Controllers have Simple TCP/IP Services Installed::0 | 0 | Devices | IOE |
| Telnet Client installed DCs | |
Total Domain Controllers have Telnet Client Installed::0 | 0 | Devices | IOE |
| TFTP Client installed DCs | |
Total Domain Controllers have TFTP Client Installed::0 | 0 | Devices | IOE |
| Server Message Block (SMB) v1 protocol Installed DCs | |
Total Domain Controllers have SMB 1.0/CIFS File Sharing Support Installed::0 | 0 | Devices | IOE |
| Windows PowerShell 2.0 installed DCs | |
Total Domain Controllers have Windows PowerShell 2.0 Engine Installed::0 | 0 | Devices | IOE |
| ADWS Service Set to Manual DCs | |
Total DCs ADWS Not Set to Start Automatic:0 | 0 | Devices | IOE |
| DHCP Service Running DCs | |
Total Domain Controllers with DHCP Server running:0 | 0 | Devices | IOE |
| Additional Roles and Features DCs | |
Total Domain Controllers with Roles Processed:1 | 1 | Devices | IOE |
| AD Services not running DCs | |
Total DCs with Services Not Running:0 | 0 | Devices | IOE |
| Total Undefined Subnets | |
Total Undefined Subnets in AD Forest:0 | 0 | Network | |
| Sites without ISTG Role | |
Total AD Sites Do Not Have ISTG Defined:0 | 0 | Network | |
| Manual Replication Connection Objects | |
Total Manual Replication Connection Objects:0 | 0 | Network | |
| Missing Global Catalog Sites | |
Total AD Sites Without Global Catalog Servers or No Universal Group Caching Enabled:0 | 0 | Identity | |
| Duplicate Site Links | |
Total Duplicate Site Links:0 | 0 | Network | |
| Sites With Manual Bridgehead Server | |
Number Of AD Sites With Manual Bridgehead Servers:0 | 0 | Network | |
| Sites creating Mesh Topology | |
Total AD Site Links Containing More than Two AD Sites:0 | 0 | Network | |
| AD Sites without Site Link | |
Total AD Sites Not In Site Links:0 | 0 | Network | |
| AD Sites without Domain Controller | |
Total AD Sites Without Domain Controllers:0 | 0 | Devices | |
| Domain Controllers Time Source | |
Total DCs Not Defined With Correct Time-Source:0 | 0 | Network | |
| Domain FSMO Placement | |
AD FSMO Placement Status:FSMO Placement is correct. | FSMO Placement is correct. | Identity | |
| Domain Naming Master and Schema Master Placement | |
Status:Hosted on same computer | Hosted on same computer | Identity | |
| Managed Service Accounts Not Linked | |
Total Managed Service Accounts are not Linked:0 | 0 | Applications and Workloads | IOE |
| TombstoneLifeTime Modified? | |
Current TombstoneLifeTime Value:180 | 180 | Identity | |
| Check AD Forest Functional Level | |
AD Forest Functional Level:dp.net is Windows2016Forest | dp.net is Windows2016Forest | Identity | |
| Check AD Domain Functional Level | |
Status:Ok | Ok | Identity | |
| Ogranizational Units without Objects | |
Total Empty Organizational Units In All Domains:0 | 0 | Data | |
| Duplicate SPNs | |
Total Duplicate SPNs in AD Domains:0 | 0 | Applications and Workloads | |
| Unauthenticated Servers | |
Total Servers Not Authenticated Within 90 Days in All Domains:0 | 0 | Devices | IOE IOC |
| Secrets not renewed Servers | |
Total Servers Not Changing Password within 45 days in all Domains:0 | 0 | Devices | IOE IOC |
| AD Forest Schema Not upto date | |
Current Forest Schema Version Status:OK:88 | OK:88 | Identity | IOE |
| Found Unused Netlogon Scripts | |
Total Unused Scripts In All Domains:0 | 0 | Devices | IOE IOC |
| Disabled GPOs | |
Total Disabled GPOs:0 | 0 | Visibility and Automation | |
| GPOs not Applying | |
Total GPOs not applying correctly in All Domains:0 | 0 | Visibility and Automation | |
| Orphaned GPO Containers | |
Total Orphaned Group Policy Objects:0 | 0 | Visibility and Automation | |
| Found OUs with GPOs Block Inheritance | |
Total GPOs with Block Inheritance Defined:0 | 0 | Visibility and Automation | |
| GPO Naming Convention | |
Number Of GPOs do not follow Standard Naming Convention:0 | 0 | Visibility and Automation | |
| Found GPO with WMI Filters | |
Total GPO with WMI Filter:0 | 0 | Visibility and Automation | |
| Domain GPO Application Status | |
Total GPOs Not Applied:0 | 0 | Visibility and Automation | |
| No Group Policy Objects for Preventing passwords using reversible encryption | |
Total AD Domains Affected:0 | 0 | Identity | |
| GPO Preferences Containing Passwords | |
GPO Preferences Containing Password in All AD Domains:0 | 0 | Identity | |
| Inconsistent GPOs | |
Total GPOs with Replication Issues:0 | 0 | Visibility and Automation | |
| Too many DNS Static Records | |
Total Static Records:0 | 0 | Network | IOC |
| DNS Round-Robin Not Enabled | |
Total DNS Servers Not Enabled With Round Robin:0 | 0 | Network | |
| Domain member- Digitally encrypt or sign secure channel data (always) status | |
Setting Status:Found | Found | Network | |
| Microsoft network server- Digitally sign communications (always) status | |
Setting Status:Found | Found | Network | |
| Network security- Do not store LAN Manager hash value on next password change status | |
Setting Status:Found | Found | Identity | |
| Locked Out Accounts Found | |
Total Accounts Locked Out in All Domains:0 | 0 | Identity | |
| Group Policy Objects with Improper Permissions Found | |
Abusable GPO Permissions found in Total AD Domains:0 | 0 | Identity | IOE IOC |
| Group Policy Object Assignments with Improper Permissions Found | |
Total Abusable GPO Permissions in AD Domains:0 | 0 | Identity | IOE IOC |
| Dangerous Permissions Found on MicrosoftDNS Container | |
AD Domains Affected:0 | 0 | Network | IOE IOC |
| Dangerous Permissions Found on Naming Contexts | |
AD Domains Affected:0 | 0 | Identity | IOE IOC |
| Pre-Windows 2000 Compatible Access Group is not empty | |
Number of AD Domains Affected:0 | 0 | Identity | IOE IOC |
| Found Groups with SID history Set | |
Total Groups With sIDHistory Affected domains:0 | 0 | Identity | IOE IOC |
| Abusable Permissions Found on SYSVOL and NETLOGON | |
Abusable Permissions Found on SYSVOL and Netlogon Shares:Ok | Ok | Identity | IOE IOC |
| LAPS SearchFlag modified | |
LAPS SearchFlags Modified:Not Modified | Not Modified | Identity | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain NC | |
AD Domains Affected:0 | 0 | Identity | IOE IOC |
| Unauthorized Users having GPLink Rights on Domain Controllers OU | |
AD Domains Affected:0 | 0 | Identity | IOE IOC |
| Unauthorized Users having GPLink Rights on AD Sites | |
AD Sites Affected:0 | 0 | Identity | IOE IOC |
| Test | Severity | Impact | Recommendation |
| Lock screen camera status | |
If addressed: Enabling this policy prevents the use of cameras on the lock screen of Domain Controllers, reducing the risk of unauthorized surveillance or data leakage through image capture. If not addressed: Allowing the lock screen camera on Domain Controllers may expose sensitive environments to privacy breaches, insider threats, or accidental data leaks via unauthorized photography. | 1. Access Group Policy Management: Open the Group Policy Management Console (GPMC) on your domain controller. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to the Policy Setting: Go to Computer Configuration > Administrative Templates > Windows Components > Camera. 4. Locate the Setting: Find the policy named -revent enabling lock screen camera- 5. Enable the Policy: Set the policy to Enabled to disable camera access on the lock screen. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked specifically to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply the new setting immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied on domain controllers. 9. Audit Camera Usage: Monitor event logs or use endpoint management tools to verify cameras are disabled on lock screens. 10. Document the Policy: Maintain clear documentation of this security setting as part of your domain controller hardening standards. |
| Lock screen slide show status | |
If addressed: Enabling this policy disables the lock screen slideshow on Domain Controllers, reducing the risk of information leakage or distractions caused by unauthorized or inappropriate images. If not addressed: Allowing the lock screen slideshow can expose sensitive information through displayed images or cause unnecessary resource usage and potential security gaps on critical systems. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create/Edit GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Control Panel > Personalization. 4. Find the Setting: Locate -revent enabling lock screen slide show- 5. Enable the Policy: Set the policy to Enabled to disable lock screen slideshow functionality. 6. Link GPO to Domain Controllers OU: Ensure this GPO is linked to the Domain Controllers organizational unit for scope. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply the new settings immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the policy is applied on domain controllers. 9. Monitor and Audit: Check event logs or endpoint management systems to confirm slideshow is disabled. 10. Document the Configuration: Keep detailed records of this setting as part of your domain controller security baseline. |
| Passwords to be saved status | |
If addressed: Enabling this policy on Domain Controllers prevents passwords from being cached or saved, reducing the risk of credential theft through stored passwords and enhancing overall security. If not addressed: Allowing passwords to be saved on Domain Controllers increases the risk of attackers extracting cached credentials, leading to potential privilege escalation and domain compromise. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a management workstation or domain controller. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to the Policy: Go to Computer Configuration > Administrative Templates > System > Credentials Delegation. 4. Locate the Setting: Find -o not allow passwords to be saved-policy. 5. Enable the Policy: Set the policy to Enabled to prevent saving passwords on the Domain Controllers. 6. Link GPO to Domain Controllers OU: Make sure the GPO applies to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied correctly. 9. Audit and Monitor: Check security logs and use endpoint management tools to ensure no passwords are being saved. 10. Document Configuration: Maintain thorough documentation of the policy and its enforcement for compliance and security auditing. |
| Always prompt for password upon connection status | |
If addressed: Enabling this policy ensures that users must enter their password every time they connect to Domain Controllers, reducing the risk of unauthorized access through cached or saved credentials. If not addressed: Without this prompt, passwords may be cached or reused automatically, increasing the risk of credential theft or unauthorized access to critical systems. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > System > Credentials Delegation. 4. Locate the Setting: Find the policy named -lways prompt for password upon connection-or similar Remote Desktop/credential related settings. 5. Enable the Policy: Set the policy to Enabled to require password entry on every connection. 6. Link GPO to Domain Controllers OU: Ensure the policy applies specifically to Domain Controllers by linking the GPO to their OU. 7. Force Policy Update: Run gpupdate /force on all Domain Controllers to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is in effect. 9. Test Connectivity: Confirm that users are prompted for passwords upon connecting to Domain Controllers. 10. Document Configuration: Keep detailed records of this security control as part of your domain controller hardening process. |
| Require secure RPC communication status | |
If addressed: Enabling secure RPC communication on Domain Controllers ensures that Remote Procedure Calls are encrypted and authenticated, protecting sensitive data and preventing man-in-the-middle attacks. If not addressed: Without secure RPC, communications to Domain Controllers can be intercepted or tampered with, exposing the network to eavesdropping, credential theft, and potential compromise | 1. Open Group Policy Management Console (GPMC): Access GPMC on a domain controller or administrative workstation. 2. Create or Edit GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > System > Remote Procedure Call. 4. Locate Setting: Find the policy named -equire secure RPC communication-or similarly worded setting. 5. Enable the Policy: Set the policy to Enabled to enforce secure RPC on domain controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Update Group Policy: Run gpupdate /force on all domain controllers to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Test RPC Communication: Validate that RPC communication to Domain Controllers is functioning correctly and securely. 10. Document and Monitor: Record this configuration in your security baseline and monitor domain controller logs for any RPC-related issues. |
| Set client connection encryption level status | |
If addressed: Enabling and configuring the client connection encryption level on Domain Controllers ensures all Remote Desktop Protocol (RDP) sessions are encrypted, protecting data in transit from interception or tampering. If not addressed: Without enforced encryption, RDP sessions to Domain Controllers may transmit data in clear text, exposing sensitive credentials and information to attackers via network sniffing. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security. 4. Find the Setting: Locate -et client connection encryption level- 5. Enable the Policy: Set it to Enabled. 6. Configure Encryption Level: Choose the highest available encryption level, typically High Level or FIPS Compliant. 7. Link GPO to Domain Controllers OU: Ensure the GPO applies specifically to the Domain Controllers OU. 8. Force Group Policy Update: Run gpupdate /force on all Domain Controllers to apply the setting immediately. 9. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 10. Test RDP Connections: Verify that RDP sessions to Domain Controllers require encrypted connections and operate as expected. |
| Windows Defender SmartScreen status | |
If addressed: Enabling Windows Defender SmartScreen on Domain Controllers helps protect against phishing and malware by warning users about potentially malicious websites and files, enhancing overall security posture. If not addressed: Without SmartScreen enabled, domain controllers are more vulnerable to users inadvertently running malicious files or visiting harmful websites, increasing the risk of compromise. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > Windows Components > File Explorer. 4. Locate the Setting: Find -onfigure Windows Defender SmartScreen-or -onfigure Windows Defender SmartScreen prompts- 5. Enable the Policy: Set the policy to Enabled. 6. Choose SmartScreen Behavior: Configure to Warn or Block based on organizational risk tolerance. 7. Link GPO to Domain Controllers OU: Make sure the GPO is linked to the Domain Controllers organizational unit. 8. Force Group Policy Update: Run gpupdate /force on domain controllers to apply the settings immediately. 9. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is enforced. 10. Monitor and Educate: Monitor SmartScreen events via event logs and educate administrators on responding to SmartScreen warnings. |
| AutoPlay status | |
If addressed: Disabling AutoPlay on Domain Controllers prevents automatic execution of potentially malicious software from removable media, reducing the risk of malware infection and unauthorized access. If not addressed: Leaving AutoPlay enabled can allow malware or unauthorized programs to run automatically when removable devices are connected, posing a serious security risk to critical domain controller systems. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies. 4. Locate Setting: Find -urn off AutoPlay-policy. 5. Enable the Policy: Set it to Enabled and choose All drives in the options to disable AutoPlay on all drives. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm policy enforcement. 9. Test Removable Media: Connect removable drives to confirm AutoPlay does not start automatically. 10. Document and Monitor: Keep records of this setting and monitor endpoint security logs for any attempts to circumvent the policy |
| Default behavior for AutoRun status | |
If addressed: Setting the default behavior for AutoRun to disabled on Domain Controllers prevents automatic execution of scripts or programs from removable media, significantly reducing the risk of malware infections and unauthorized code execution. If not addressed: If AutoRun is enabled or misconfigured, attackers could exploit removable media to automatically run malicious code on Domain Controllers, leading to potential system compromise and domain-wide security breaches. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies. 4. Locate the Setting: Find -efault behavior for AutoRun-policy. 5. Configure the Policy: Set it to Enabled and configure the default behavior to -o not execute any autorun commands- 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test with Removable Media: Insert removable media to confirm AutoRun does not execute automatically. 10. Document and Monitor: Maintain documentation of this configuration and monitor security logs for any unauthorized execution attempts. |
| UNC Paths Hardened status | |
If addressed: Hardening UNC (Universal Naming Convention) paths on Domain Controllers strengthens network file share security by enforcing strict access controls and reducing exposure to man-in-the-middle and relay attacks. If not addressed: Unsecured UNC paths can be exploited by attackers to intercept, modify, or redirect network traffic, potentially leading to credential theft, lateral movement, and domain compromise. | 1. Identify UNC Shares: List all UNC paths and network shares used by or exposed on Domain Controllers. 2. Review Permissions: Audit and tighten permissions on these shares to follow the principle of least privilege. 3. Enable SMB Signing: Configure SMB signing on Domain Controllers to ensure integrity and authenticity of SMB communication. 4. Configure SMB Encryption: Where supported, enable SMB encryption for sensitive UNC paths. 5. Disable SMBv1: Ensure SMB version 1 is disabled to prevent exploitation of known vulnerabilities. 6. Use Group Policy to Harden UNC Access: In GPMC, navigate to relevant policies to control UNC path behavior and access restrictions. 7. Implement Credential Guard / Restricted Admin Mode: Use features like Credential Guard and restricted admin mode to protect credentials during UNC access. 8. Force Group Policy Update: Run gpupdate /force on Domain Controllers to apply policy changes. 9. Monitor Access Logs: Set up auditing on UNC paths to monitor access and detect suspicious activity. 10.Document and Review: Maintain documentation of hardened UNC paths and regularly review configurations for compliance. |
| Insecure guest logons status | |
If addressed: Disabling insecure guest logons on Domain Controllers prevents anonymous or unauthenticated access to network resources, reducing the risk of unauthorized access and potential lateral movement within the network. If not addressed: Allowing insecure guest logons exposes Domain Controllers to unauthorized users who can exploit this access for reconnaissance, privilege escalation, or launching attacks on the domain. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy: Go to Computer Configuration > Administrative Templates > Network > Lanman Workstation. 4. Locate the Setting: Find the policy -nable insecure guest logons- 5. Disable the Policy: Set the policy to Disabled to prevent guest logons. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU for enforcement. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Audit Network Access: Monitor event logs and network traffic to detect any unauthorized guest access attempts. 10. Document and Review: Keep records of this policy configuration and regularly review security settings for compliance. |
| Audit- Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings status | |
If addressed: Enabling this setting ensures that detailed audit policy subcategories take precedence over broader category settings, providing granular and accurate auditing essential for effective security monitoring and compliance. If not addressed: Without this enabled, audit policies might be inconsistent or overly broad, leading to gaps in security logging, missed critical events, and challenges in forensic investigations. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the appropriate OU (often Domain Controllers or the entire domain). 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -udit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO: Make sure the GPO is linked to the OU containing the computers where you want this enforced (e.g., Domain Controllers). 7. Update Group Policy: Run gpupdate /force on the target machines to immediately apply the policy. 8. Verify Policy Application: Use gpresult /r or secedit /export /cfg to confirm the setting is enabled. 9. Review Audit Policies: Check the configured audit subcategories under Advanced Audit Policy Configuration to ensure detailed logging is active. 10. Document and Monitor: Maintain records of the audit policy settings and regularly review security logs for completeness and accuracy. |
| Domain controller- LDAP server signing requirements status | |
If addressed: Enabling LDAP server signing on Domain Controllers enforces signing of LDAP traffic, protecting against man-in-the-middle attacks and ensuring the integrity and authenticity of LDAP communications. If not addressed: Without LDAP signing enforced, LDAP traffic can be intercepted or tampered with by attackers, leading to potential credential theft, unauthorized directory access, and domain compromise. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain controller: LDAP server signing requirements- 5. Configure the Setting: Set it to -equire signing-to enforce LDAP signing on the Domain Controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers OU to apply the policy. 7. Force Group Policy Update: Run gpupdate /force on all Domain Controllers to immediately apply the setting. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is active. 9. Test LDAP Connectivity: Validate LDAP client applications and services are able to connect securely with signing enforced. 10. Document and Monitor: Maintain records of this configuration and monitor security logs for LDAP-related anomalies. |
| Domain controller- Refuse machine account password changes status | |
If addressed: Enabling this setting prevents domain controllers from automatically changing their machine account passwords, ensuring stability and avoiding potential authentication issues in the domain. If not addressed: If this setting is disabled, domain controllers might attempt to change their machine account passwords, which can lead to replication errors, trust relationship failures, and authentication problems within the domain. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the Domain Controllers OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain controller: Refuse machine account password changes- 5. Enable the Setting: Set it to Enabled to refuse machine account password changes on domain controllers. 6. Link GPO to Domain Controllers OU: Ensure the GPO is linked to the Domain Controllers organizational unit. 7. Force Group Policy Update: Run gpupdate /force on all domain controllers. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied. 9. Monitor Domain Controller Health: Check event logs and replication status to ensure domain controllers are functioning correctly. 10. Document and Review: Keep records of this configuration and periodically review domain controller account status and policies. |
| Domain member- Digitally encrypt secure channel data (when possible) status | |
If addressed: Enabling this setting allows domain member machines to encrypt secure channel data when supported, enhancing the confidentiality and integrity of communications with domain controllers. If not addressed: If not enabled, secure channel data might be transmitted without encryption when possible, increasing the risk of interception and potential credential exposure during network communication. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Digitally encrypt secure channel data (when possible)- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units containing the domain member computers. 7. Force Group Policy Update: Run gpupdate /force on domain member machines to apply the policy. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is active. 9. Test Secure Channel Encryption: Use network monitoring tools or commands like nltest /sc_query to check encryption status. 10. Document and Monitor: Maintain documentation of this configuration and regularly review event logs for secure channel issues. |
| Domain member- Digitally sign secure channel data (when possible) status | |
If addressed: Enabling this setting allows domain member machines to digitally sign secure channel data when supported, ensuring data integrity and authenticity in communications with domain controllers. If not addressed: Without this enabled, secure channel data may be unsigned when possible, increasing the risk of data tampering or man-in-the-middle attacks that compromise authentication security. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation.
2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain member computers.
3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
4. Locate the Setting: Find -omain member: Digitally sign secure channel data (when possible)-
5. Enable the Setting: Set the policy to Enabled.
6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with domain member machines.
7. Force Group Policy Update: Run gpupdate /force on affected domain members to apply the setting immediately.
8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the policy is applied.
9. Test Secure Channel Signature: Use tools like nltest /sc_query: |
| Domain member- Disable machine account password changes status | |
If addressed (setting disabled): Allowing domain member machines to change their machine account passwords regularly enhances security by preventing stale or compromised credentials, maintaining trust with domain controllers. If not addressed (setting enabled): If machine account password changes are disabled, domain members won- update their passwords, which can lead to trust relationship failures and authentication problems over time. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Disable machine account password changes- 5. Set to Disabled: Ensure this policy is set to Disabled to allow automatic machine account password changes. 6. Link GPO to Target OU: Confirm the GPO is linked to the organizational units containing domain members. 7. Force Group Policy Update: Run gpupdate /force on domain member computers to apply the setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Monitor Machine Account Password Changes: Check event logs (Security event ID 4742) to verify regular password changes. 10. Document and Review: Keep records of this configuration and periodically audit machine account trust status. |
| Domain member- Maximum machine account password age status | |
If addressed: Setting a maximum machine account password age enforces regular password changes for domain member computer accounts, which helps prevent long-term credential exposure and maintains secure trust relationships with domain controllers. If not addressed: Without a defined maximum password age, machine account passwords may never change or change infrequently, increasing the risk of compromised credentials and domain trust failures. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Maximum machine account password age- 5. Set the Value: Define the maximum password age (e.g., 30 or 45 days) based on your organization- security policy. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units containing domain member machines. 7. Force Group Policy Update: Run gpupdate /force on domain member computers to apply the updated setting. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Monitor Password Changes: Check event logs (Security event IDs like 4742) to ensure machine account passwords are rotating within the defined period. 10. Document and Review: Keep records of the configured maximum password age and periodically audit machine account password status and trust relationships. |
| Domain member- Require strong (Windows 2000 or later) session key status | |
If addressed: Enabling this setting enforces the use of strong session keys for secure channel communications, enhancing cryptographic strength and protecting data integrity and confidentiality between domain members and domain controllers. If not addressed: Without this enforcement, weaker session keys may be used, increasing the risk of cryptographic attacks such as session hijacking or data tampering during authentication and communication. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the OU containing domain member computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -omain member: Require strong (Windows 2000 or later) session key- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Make sure the GPO is linked to the organizational units that include domain member machines. 7. Force Group Policy Update: Run gpupdate /force on domain members to immediately apply the setting. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Secure Channel Communication: Use tools like nltest /sc_verify to verify secure channel integrity with strong session keys. 10. Document and Monitor: Record the configuration and monitor event logs for related errors or warnings on secure channel security. |
| Interactive logon- Machine inactivity limit status | |
If addressed: Setting a machine inactivity limit ensures that inactive sessions automatically lock after a specified time, reducing the risk of unauthorized access from unattended logged-in computers. If not addressed: Without an inactivity timeout, machines remain accessible even when left unattended, increasing the chances of unauthorized use or data exposure. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU with the target computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -nteractive logon: Machine inactivity limit- 5. Set the Limit: Define the inactivity timeout in seconds (e.g., 300 seconds for 5 minutes). 6. Link GPO to Target OU: Ensure the GPO is linked to OUs containing target computers. 7. Force Group Policy Update: Run gpupdate /force on target machines to apply the setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test the Timeout: Leave a test machine idle and verify that it locks automatically after the defined period. 10. Document and Monitor: Record the configuration and monitor helpdesk or security logs for any related incidents or user feedback. |
| Microsoft network client- Digitally sign communications (always) status | |
If addressed: Enabling this setting ensures that all SMB communications from the client to servers are digitally signed, protecting data integrity and preventing man-in-the-middle attacks during file and resource sharing. If not addressed: Without mandatory digital signing, SMB traffic can be intercepted or tampered with, leading to potential data breaches or unauthorized access. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing the target client computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -icrosoft network client: Digitally sign communications (always)- 5. Enable the Setting: Set the policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with the client computers. 7. Force Group Policy Update: Run gpupdate /force on client machines to apply the change immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Test SMB Communication: Monitor SMB sessions or use network capture tools to verify digital signing. 10. Document and Monitor: Keep records of this configuration and regularly review security logs for any related SMB communication issues. |
| Microsoft network client- Send unencrypted password to third-party SMB servers status | |
If addressed: Disabling the sending of unencrypted passwords prevents sensitive credentials from being transmitted in clear text to third-party SMB servers, significantly reducing the risk of credential theft and man-in-the-middle attacks. If not addressed: Allowing unencrypted password transmission exposes user credentials to interception and compromise, increasing the risk of unauthorized access and lateral movement within the network. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the OU containing the target client computers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -icrosoft network client: Send unencrypted password to third-party SMB servers- 5. Set to Disabled: Configure the policy to Disabled to block unencrypted password transmissions. 6. Link GPO to Target OU: Ensure the GPO is linked to OUs with the client computers. 7. Force Group Policy Update: Run gpupdate /force on affected machines to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is in effect. 9. Test SMB Connections: Monitor SMB authentication attempts and verify no unencrypted passwords are sent. 10. Document and Monitor: Keep documentation of this setting and regularly review security logs for authentication anomalies. |
| Network access- Do not allow anonymous enumeration of SAM accounts status | |
If addressed: Enabling this setting prevents anonymous users from listing user accounts in the Security Accounts Manager (SAM), reducing information disclosure risks and protecting against reconnaissance attacks by unauthorized parties. If not addressed: Allowing anonymous enumeration exposes account details that attackers can use to plan targeted attacks such as password guessing or privilege escalation. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the target OU(s). 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork access: Do not allow anonymous enumeration of SAM accounts- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to OUs containing domain controllers or servers. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting. 9. Test Enumeration Attempts: Attempt anonymous enumeration (with tools or scripts) to verify it is blocked. 10. Document and Monitor: Keep records of the configuration and review security logs for any failed enumeration attempts. |
| Network access- Do not allow anonymous enumeration of SAM accounts and shares status | |
If addressed: Enabling this setting prevents anonymous users from enumerating both SAM accounts and network shares, protecting sensitive account information and shared resources from unauthorized discovery and potential exploitation. If not addressed: Allowing anonymous enumeration exposes user account details and shared folders to attackers, increasing the risk of reconnaissance activities that could lead to targeted attacks or unauthorized access. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the OU containing domain controllers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork access: Do not allow anonymous enumeration of SAM accounts and shares- 5. Enable the Setting: Set this policy to Enabled. 6. Link GPO to Target OU: Ensure the GPO is linked to the organizational units with the affected servers. 7. Force Group Policy Update: Run gpupdate /force on all affected machines to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Enumeration: Attempt anonymous enumeration of SAM accounts and shares to verify it is blocked. 10. Document and Monitor: Document the implementation and monitor security logs for unauthorized access or enumeration attempts. |
| Network security- Allow LocalSystem NULL session fallback status | |
If addressed (enabled): Allowing LocalSystem NULL session fallback can provide backward compatibility for legacy applications but significantly increases the risk of anonymous access to system resources, making the system vulnerable to unauthorized access and potential attacks. If not addressed (disabled): Disabling this setting enhances security by preventing the system from accepting NULL session fallback connections, reducing the attack surface and mitigating risks associated with anonymous access exploits. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the OU with the target computers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Allow LocalSystem NULL session fallback- 5. Set to Disabled: Configure the policy to Disabled to prevent fallback to NULL sessions. 6. Link GPO to Target OU: Ensure the GPO is linked to the relevant OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test Connectivity: Ensure legacy applications are tested to confirm they do not rely on NULL session fallback, or plan mitigation if necessary. 10.Document and Monitor: Document the change and monitor security logs for any unauthorized access attempts or issues related to authentication. |
| Network security- Allow LocalSystem NULL session fallback status | |
If addressed (enabled): Allowing LocalSystem NULL session fallback can provide backward compatibility for legacy applications but significantly increases the risk of anonymous access to system resources, making the system vulnerable to unauthorized access and potential attacks. If not addressed (disabled): Disabling this setting enhances security by preventing the system from accepting NULL session fallback connections, reducing the attack surface and mitigating risks associated with anonymous access exploits. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative machine. 2. Create or Edit a GPO: Create a new GPO or modify an existing one linked to the OU with the target computers or servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Allow LocalSystem NULL session fallback- 5. Set to Disabled: Configure the policy to Disabled to prevent fallback to NULL sessions. 6. Link GPO to Target OU: Ensure the GPO is linked to the relevant OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 9. Test Connectivity: Ensure legacy applications are tested to confirm they do not rely on NULL session fallback, or plan mitigation if necessary. 10.Document and Monitor: Document the change and monitor security logs for any unauthorized access attempts or issues related to authentication. |
| Network security- LAN Manager authentication level status | |
If addressed (properly configured): Configuring the LAN Manager authentication level enforces stronger authentication protocols, reducing vulnerabilities to downgrade attacks and ensuring only secure authentication methods are used. If not addressed (misconfigured or left default): Weak or default LAN Manager authentication settings allow fallback to insecure authentication methods, exposing systems to credential theft and man-in-the-middle attacks. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create or modify a GPO linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: LAN Manager authentication level- 5. Configure the Setting: Set it to Send NTLMv2 response only. Refuse LM & NTLM (recommended for highest security). 6. Link GPO to Target OU: Link the GPO to OUs containing domain controllers and member servers. 7. Force Group Policy Update: Run gpupdate /force on all targeted machines. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting. 9. Test Authentication: Ensure legacy applications or systems are compatible or updated, as they might not support NTLMv2 only. 10.Document and Monitor: Document the change and monitor authentication logs for failed logins or fallback attempts. |
| Network security- LDAP client signing requirements | |
If addressed (enabled): Enforcing LDAP client signing ensures that LDAP communication between clients and domain controllers is signed, protecting against man-in-the-middle attacks and data tampering. If not addressed (disabled): Lack of LDAP signing leaves LDAP traffic vulnerable to interception and modification, potentially exposing sensitive information and enabling credential theft or unauthorized access. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OUs or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: LDAP client signing requirements- 5. Set the Policy: Configure it to Require signing to enforce LDAP signing. 6. Link GPO to Target OU: Ensure the GPO is linked to organizational units with client machines. 7. Force Group Policy Update: Run gpupdate /force on affected clients to apply the policy immediately. 8. Verify Policy Application: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is active. 9. Test LDAP Connectivity: Verify that clients can still communicate with domain controllers without errors. 10. Document and Monitor: Document the implementation and monitor security logs for LDAP-related errors or authentication issues. |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) clients status | |
If addressed (properly configured): Configuring minimum session security enforces encryption and signing for NTLM SSP communication, protecting data integrity and confidentiality during authentication and RPC sessions. If not addressed (not configured or disabled): Lack of minimum session security leaves NTLM SSP communications vulnerable to interception, replay, and man-in-the-middle attacks, compromising sensitive authentication data. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target OUs or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Minimum session security for NTLM SSP based (including secure RPC) clients- 5. Configure the Setting: Enable options for Require NTLMv2 session security, Require 128-bit encryption, and Require session signing to enforce strong security. 6. Link GPO to Target OU: Ensure the GPO applies to the relevant client computers. 7. Force Group Policy Update: Run gpupdate /force on client machines to apply changes immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test Connectivity: Validate that NTLM authentication and RPC communication works correctly with the enforced session security. 10. Document and Monitor: Record the changes and monitor authentication and RPC logs for errors or potential issues. |
| Network security- Minimum session security for NTLM SSP based (including secure RPC) servers status | |
If addressed (properly configured): Enforcing minimum session security on NTLM SSP servers ensures that all incoming NTLM authentication and secure RPC sessions require encryption and signing, reducing the risk of man-in-the-middle attacks and data tampering. If not addressed (not configured or disabled): Without this enforcement, NTLM authentication and RPC sessions can occur without adequate protection, making servers vulnerable to interception, replay attacks, and unauthorized access. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OU or domain containing servers. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -etwork security: Minimum session security for NTLM SSP based (including secure RPC) servers- 5. Configure the Setting: Enable options to Require NTLMv2 session security, Require 128-bit encryption, and Require session signing to enforce strong session security on servers. 6. Link GPO to Target OU: Link the GPO to the OUs containing server computers. 7. Force Group Policy Update: Run gpupdate /force on the target servers to apply the new settings immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard on servers to confirm the policy is applied. 9. Test Authentication and RPC: Validate that server services relying on NTLM SSP and RPC continue functioning with the enforced session security. 10. Document and Monitor: Record the change and monitor security and system logs for any authentication or RPC errors. |
| System objects- Strengthen default permissions of internal system objects status | |
If addressed (enabled): Strengthening default permissions on internal system objects prevents unauthorized users or processes from modifying critical system objects, enhancing overall system security and stability. If not addressed (disabled or not configured): Weak default permissions can allow malicious actors or software to alter or exploit system objects, potentially leading to privilege escalation, system compromise, or denial of service. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target domain or OU. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ystem objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)- 5. Enable the Setting: Set this policy to Enabled to strengthen default permissions. 6. Link the GPO: Apply the GPO to the appropriate domain, sites, or OUs containing the target systems. 7. Force Group Policy Update: Run gpupdate /force on affected systems to apply the change immediately. 8. Verify the Setting: Use gpresult /r or the Group Policy Results Wizard to confirm the setting is applied. 9. Audit System Object Permissions: Optionally review permissions on internal system objects to ensure they reflect strengthened defaults. 10. Document and Monitor: Record the implementation and monitor event logs for unusual activity related to system object permissions. |
| User Account Control- Admin Approval Mode for the Built-in Administrator account status | |
If addressed (enabled): Enabling Admin Approval Mode for the built-in Administrator account enforces User Account Control (UAC) prompts for administrative actions, reducing the risk of unauthorized or accidental changes and limiting malware impact. If not addressed (disabled): Without Admin Approval Mode, the built-in Administrator account runs with full privileges all the time, increasing the risk of unmonitored administrative actions, privilege escalation, and malware persistence. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or management workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ser Account Control: Admin Approval Mode for the Built-in Administrator account- 5. Enable the Setting: Set it to Enabled. 6. Link the GPO: Ensure the GPO is linked to the domain or OU containing the systems where the built-in Administrator account is used. 7. Force Group Policy Update: Run gpupdate /force on affected systems to apply the new setting immediately. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active. 9. Test UAC Behavior: Log in as the built-in Administrator and verify that UAC prompts appear for administrative tasks. 10. Document and Monitor: Document the change and monitor for any administrative or system errors that may indicate policy conflicts. |
| User Account Control- Behavior of the elevation prompt for administrators in Admin Approval Mode status | |
If addressed (properly defined): Defining the elevation prompt behavior ensures that administrators receive consistent, secure prompts before performing tasks requiring elevated privileges, reducing the risk of accidental or unauthorized elevation. If not addressed (undefined or misconfigured): Undefined or insecure prompt behavior can lead to silent elevation, increasing the risk of unauthorized system changes, privilege escalation, and malware exploiting elevated privileges without user awareness. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the target OU or domain. 3. Navigate to Policy Path: Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting: Find -ser Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode- 5. Configure the Setting: Set the prompt behavior to a secure option such as Prompt for consent or Prompt for credentials, depending on your security requirements. 6. Link the GPO: Apply the GPO to the relevant OUs or domains containing administrator accounts. 7. Force Group Policy Update: Run gpupdate /force on target computers to immediately enforce the new policy. 8. Verify Policy Application: Use gpresult /r or Group Policy Results Wizard to ensure the setting is active. 9. Test Elevation Prompts: Log in as an administrator and perform tasks requiring elevation to confirm the prompt behaves as configured. 10. Document and Monitor: Record the configuration change and monitor logs or user feedback for any issues with elevation prompts. |
| User Account Control- Behavior of the elevation prompt for standard users status | |
If addressed (properly defined): Defining the elevation prompt behavior for standard users ensures that administrative tasks require explicit credentials, preventing unauthorized privilege escalation and reinforcing least privilege principles. If not addressed (undefined or misconfigured): If this setting is not defined, standard users may be allowed to bypass elevation prompts or receive inconsistent behavior, increasing the risk of security breaches and malware executing with elevated privileges. | 1. Open Group Policy Management Console (GPMC): Launch GPMC from a domain controller or an admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or modify an existing one linked to the appropriate OU or domain. 3. Navigate to the Setting Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find: -ser Account Control: Behavior of the elevation prompt for standard users- 5. Set the Policy:Configure the setting to Automatically deny elevation requests (recommended for most secure environments) or Prompt for credentials on the secure desktop if users should be allowed to elevate with credentials. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link GPO to Target OU or Domain: Attach the GPO to the organizational unit(s) that contain the target standard user computers. 8. Force Group Policy Update: Run gpupdate /force on client machines or wait for the next policy refresh cycle. 9. Verify the Policy: Use gpresult /r or the Group Policy Results Wizard to confirm the policy has applied correctly. 10. Document and Monitor: Log the policy change, and monitor audit and security logs for any denied elevation attempts or unexpected behavior. |
| User Account Control- Detect application installations and prompt for elevation status | |
If addressed (enabled): Enabling this setting ensures that application installation attempts are automatically detected and trigger an elevation prompt, helping prevent unauthorized or silent installations by non-admin users or malware. If not addressed (disabled or undefined): If this setting is not defined, standard users may install applications without administrative approval, increasing the risk of malware infections, software conflicts, or system instability. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one applied to the relevant domain or OU. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Detect application installations and prompt for elevation- 5. Enable the Setting:Set this policy to Enabled to ensure elevation prompts appear for app installs. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link the GPO to Target OU/Domain: Attach the GPO to the appropriate OU(s) where user workstations reside. 8. Force Group Policy Update: Run gpupdate /force on affected machines or allow automatic policy refresh. 9. Test Behavior: Attempt a non-admin software installation on a standard user account to ensure it prompts for admin credentials. 10. Document and Monitor: Record the change and review application logs for any unauthorized installation attempts or elevation denials. |
| User Account Control- Only elevate UIAccess applications that are installed in secure locations status | |
If addressed (enabled): Enabling this setting ensures that only UIAccess applications installed in secure directories (e.g., Program Files or Windows\System32) can be elevated, preventing unauthorized or malicious UIAccess apps from gaining elevated privileges. If not addressed (disabled or not configured): If this setting is not enabled, attackers could place UIAccess applications in non-secure locations (like temp folders or user profiles) to exploit UAC and gain elevated access. | 1. Open Group Policy Management Console (GPMC): Launch the GPMC from a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to user computers or the domain. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Only elevate UIAccess applications that are installed in secure locations- 5. Enable the Setting:Set it to Enabled to enforce secure location requirements for UIAccess apps. 6. Apply the Setting: Click Apply and then OK to confirm. 7. Link the GPO to the Correct Scope: Attach the GPO to the organizational unit (OU) or domain containing the applicable machines. 8. Force Group Policy Update: Run gpupdate /force on target systems to apply the new policy immediately. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active on client systems. 10. Audit UIAccess Usage: Review systems to ensure UIAccess applications are only installed in secure paths, and adjust deployments if necessary. |
| User Account Control- Run all administrators in Admin Approval Mode status | |
If addressed (enabled): Enabling this setting ensures that only UIAccess applications installed in secure directories (e.g., Program Files or Windows\System32) can be elevated, preventing unauthorized or malicious UIAccess apps from gaining elevated privileges. If not addressed (disabled or not configured): If this setting is not enabled, attackers could place UIAccess applications in non-secure locations (like temp folders or user profiles) to exploit UAC and gain elevated access. | 1. Open Group Policy Management Console (GPMC): Launch the GPMC from a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to user computers or the domain. 3. Navigate to the Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. 4. Locate the Setting:Find -ser Account Control: Only elevate UIAccess applications that are installed in secure locations- 5. Enable the Setting:Set it to Enabled to enforce secure location requirements for UIAccess apps. 6. Apply the Setting: Click Apply and then OK to confirm. 7. Link the GPO to the Correct Scope: Attach the GPO to the organizational unit (OU) or domain containing the applicable machines. 8. Force Group Policy Update: Run gpupdate /force on target systems to apply the new policy immediately. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is active on client systems. 10. Audit UIAccess Usage: Review systems to ensure UIAccess applications are only installed in secure paths, and adjust deployments if necessary. |
| User Account Control- Virtualize file and registry write failures to per-user locations status | |
If addressed (enabled): Enabling this setting ensures that legacy applications that try to write to protected system locations (like Program Files or HKLM) are redirected (virtualized) to per-user locations, allowing them to function without compromising system security. If not addressed (disabled): Disabling this setting can cause legacy or poorly written applications to fail when attempting restricted writes, potentially leading to application crashes or user complaints, or worse-ncouraging users to run apps with full admin rights, increasing security risk. | 1. Open Group Policy Management Console (GPMC): Launch GPMC from a domain controller or an administrative machine. 2. Create or Edit a GPO: Create a new Group Policy Object or edit an existing one linked to the appropriate OU or domain. 3. Navigate to Policy Path:Go to:Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options 4. Find the Setting:Locate -ser Account Control: Virtualize file and registry write failures to per-user locations-5. Enable the Setting:Set the policy to Enabled. 6. Click Apply and OK: Save the configuration changes. 7. Link the GPO: Attach the GPO to the OU or domain where target systems reside. 8. Force Group Policy Update: On target machines, run gpupdate /force or wait for the next refresh cycle. 9. Verify the Setting: Use gpresult /r or Group Policy Results Wizard to confirm the setting is applied. 10. Test with Legacy Applications: Run older applications to ensure they operate correctly without requiring elevated privileges, confirming virtualization is functioning. |
| Audit Credential Validation status | |
If addressed (configured): Configuring audit for Credential Validation allows security teams to monitor and detect credential-based attacks (e.g., brute force, pass-the-hash, or account lockouts) through detailed logon event records. If not addressed (not configured): Without this audit, malicious authentication attempts may go unnoticed, making it difficult to identify or respond to credential misuse, compromise, or policy violations. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the domain or OU where systems reside. 3. Navigate to the Audit Policy Location:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Find the Setting:Locate -udit Credential Validation- 5. Configure the Setting:Set the policy to Success and Failure to log both successful and failed credential validations. 6. Apply the Setting: Click Apply and OK to save the configuration. 7. Link the GPO to the Correct Scope: Attach the GPO to the appropriate domain or organizational unit (OU). 8. Force Group Policy Update: Run gpupdate /force on the target systems or allow the policy to refresh naturally. 9. Verify via Event Viewer:After policy application, confirm the setting is active by checking for Event ID 4776 in the Security Log on the system under Event Viewer > Windows Logs > Security. 10. Monitor and Alert:Configure your SIEM or log management system to alert on suspicious patterns in credential validation events (e.g., repeated failures or unusual account activity). |
| Audit Computer Account Management status | |
If addressed (configured): Enabling auditing for Computer Account Management ensures that creation, deletion, modification, or renaming of computer accounts in Active Directory is logged, supporting security auditing, incident response, and change tracking. If not addressed (not configured): Without this audit policy, changes to computer accounts may go undetected, increasing the risk of unauthorized device registrations or malicious tampering within AD. | 1. Open Group Policy Management Console (GPMC): Open GPMC from a domain controller or admin system. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the domain or appropriate OU. 3. Navigate to Audit Policy Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Setting:Locate -udit Computer Account Management- 5. Enable the Setting:Set it to Success and Failure to capture both successful and failed attempts to manage computer accounts. 6. Apply the Setting: Click Apply and OK. 7. Link the GPO Appropriately: Attach the GPO to OUs or domains that contain systems and administrative workstations managing AD accounts. 8. Force Group Policy Update: On client systems, run gpupdate /force or allow policies to refresh on schedule. 9. Verify with Event Viewer:After changes, open Event Viewer and look for logs under Security with: -- Event ID 4741: A computer account was created -- Event ID 4742: A computer account was changed -- Event ID 4743: A computer account was deleted 10. Integrate with Monitoring Tools: Configure your SIEM or log management tool to alert on these event IDs for better oversight and incident response. |
| Audit Other Account Management Events status | |
If addressed (configured): Enabling Audit Other Account Management Events ensures actions such as password resets, user account disablement, or changes to user group memberships are logged, which is critical for tracking administrative changes and detecting insider threats. If not addressed (not configured): Without this auditing, important account changes could go unnoticed, reducing visibility into potential misuse of privileges and hampering forensic investigations. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Create a new GPO or edit an existing one applied to the relevant OU or domain. 3. Navigate to the Audit Settings Path:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Setting:Locate -udit Other Account Management Events- 5. Enable the Setting:Set it to Success and Failure to log both successful and failed attempts. 6. Apply the Setting: Click Apply and OK to save. 7. Link the GPO to Target Systems: Attach the GPO to the OU or domain containing the systems where auditing is required. 8. Update Group Policy on Clients: Run gpupdate /force on affected machines or allow the policy to apply at the next refresh cycle. 9. Verify via Event Viewer:Look for relevant events in Event Viewer under Security, such as: -1. Event ID 4724: Password reset -2. Event ID 4725: User account disabled -3. Event ID 4726: User account deleted -4. Event ID 4738: User account changed 10. Integrate with SIEM or Alerts: Set up log monitoring and alerting in your SIEM solution for these events to detect abnormal or unauthorized account activity |
| Audit Security Group Management status | |
If addressed (configured): Enabling Audit Security Group Management ensures all changes to security groups (creation, deletion, membership changes) are logged, which is essential for detecting privilege escalation, unauthorized access, and compliance tracking. If not addressed (not configured): Without this audit, malicious or accidental changes to security groups (e.g., adding a user to Domain Admins) may go unnoticed, leading to potential data breaches or administrative misuse. | 1. Open Group Policy Management Console (GPMC): Open GPMC on a domain controller or a system with RSAT tools installed. 2. Create or Edit a GPO: Create a new GPO or edit an existing one that is linked to the relevant OU or domain. 3. Navigate to Audit Policy Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Locate the Setting:Find -udit Security Group Management- 5. Enable the Setting:Set it to Success and Failure to capture both successful and failed group management events. 6. Apply the Policy: Click Apply and OK to save your changes. 7. Link the GPO: Attach the GPO to the domain or OU where the target systems reside. 8. Force a Group Policy Update: Run gpupdate /force on affected systems or wait for the next policy refresh cycle. 9. Verify via Event Viewer:On a domain controller or relevant system, check Event Viewer > Security Logs for: -1. Event ID 4731: Security group created -2. Event ID 4732: Member added to a security group -3. Event ID 4733: Member removed from a security group -4. Event ID 4735/4734/4737/4755 for other related changes 10. Enable Monitoring or Alerting: Configure your SIEM or monitoring tools to trigger alerts on group changes-specially to privileged groups like Domain Admins or Enterprise Admins. |
| Audit User Account Management status | |
If addressed (configured): Enabling Audit User Account Management ensures that key changes to user accounts-uch as creation, deletion, password resets, and account disables-re logged for accountability, forensic investigations, and compliance. If not addressed (not configured): Without this setting, unauthorized or accidental modifications to user accounts may go undetected, increasing the risk of privilege misuse, insider threats, or audit failures. | 1. Open Group Policy Management Console (GPMC): On a domain controller or admin workstation, open GPMC. 2. Create or Edit a GPO: Either create a new Group Policy Object or edit an existing one linked to the relevant OU or domain. 3. Navigate to Audit Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management 4. Find the Policy Setting:Locate -udit User Account Management-in the right pane. 5. Configure the Setting:Set it to Success and Failure to audit both successful and failed attempts. 6. Apply the Setting: Click Apply and then OK to save your changes. 7. Link the GPO: Attach the GPO to the domain or OU where the target systems (e.g., domain controllers) reside. 8. Update Group Policy: Run gpupdate /force on affected systems to apply the changes immediately, or wait for the standard refresh cycle. 9. Verify in Event Viewer:On domain controllers, check Event Viewer > Security Logs for the following IDs: -1. 4720: A user account was created -2. 4722: A user account was enabled -3. 4723/4724: Password change/reset -4. 4725: A user account was disabled -5. 4726: A user account was deleted -6. 4738: A user account was changed 10. Enable Log Monitoring: Use your SIEM or log monitoring tool to trigger alerts for high-impact changes |
| Audit PNP Activity status | |
If addressed (configured): Enabling Audit PnP (Plug and Play) Activity helps track device installations and removals on systems, allowing detection of unauthorized or suspicious hardware changes that could indicate security breaches or policy violations. If not addressed (not configured): Without auditing PnP activity, unauthorized devices might be connected without detection, increasing the risk of data exfiltration, malware introduction, or hardware-based attacks. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Choose an existing Group Policy Object linked to relevant systems or create a new one. 3. Navigate to Audit Settings:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking 4. Locate the Setting: Find -udit PNP Activity- 5. Configure Audit PNP Activity: Set this policy to Success and Failure to capture all Plug and Play device events. 6. Apply and Save: Click Apply and OK to save the configuration. 7. Link the GPO: Ensure the GPO is linked to the appropriate organizational units or domain containing target machines. 8. Force Group Policy Update: Run gpupdate /force on client systems or wait for the automatic policy refresh. 9. Verify Audit Logs: On audited systems, check Event Viewer > Security Logs for events related to device installation/removal, typically Event IDs like 20001 (PnP Device Install). 10. Monitor and Alert: Configure your SIEM or monitoring tool to flag unusual or unauthorized device activity for timely investigation. |
| Audit Process Creation status | |
If addressed (configured): Enabling Audit Process Creation provides detailed logging of every process started on a system, which is crucial for detecting malicious activities, forensic analysis, and understanding system behavior. If not addressed (not configured): Without auditing process creation, attackers could execute malicious programs undetected, making it difficult to investigate security incidents or identify unauthorized software execution. | 1. Open Group Policy Management Console (GPMC): On a domain controller or admin workstation, launch GPMC. 2. Create or Edit a GPO: Select an existing Group Policy Object linked to the target systems or create a new one. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking 4. Find Audit Process Creation: Locate the policy named -udit Process Creation- 5. Enable Auditing: Set the policy to Success (and optionally Failure) to log when processes start. 6. Apply and Save: Click Apply and then OK. 7. Link the GPO: Ensure the GPO is linked to the relevant OUs or domain to apply to intended machines. 8. Force Policy Update: Run gpupdate /force on target machines or wait for the next group policy refresh. 9. Verify Event Logs: On systems, check Event Viewer > Security Logs for Event ID 4688, which records process creation details. 10. Set Up Monitoring: Configure your SIEM or security monitoring tool to alert on suspicious or unexpected process executions. |
| Audit Directory Service Access status | |
If addressed (configured): Enabling Audit Directory Service Access allows monitoring and logging of access to Active Directory objects, which helps detect unauthorized changes or access attempts to sensitive directory data. If not addressed (not configured): Without auditing Directory Service access, malicious or accidental changes to AD objects could go unnoticed, increasing the risk of privilege escalation, data compromise, and compliance violations. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Directory Service Access: Set -udit Directory Service Access-to Success and Failure to log all access attempts. 5. Apply and Save: Click Apply and OK. 6. Enable Object Access Auditing: Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policyand ensure -udit Object Access-is enabled. 7. Configure Auditing on AD Objects: Using Active Directory Users and Computers (ADUC), enable auditing on sensitive AD objects by setting their Auditing tab permissions (Advanced Security Settings). 8. Link the GPO: Ensure the GPO is linked to the OU containing your domain controllers. 9. Force Policy Update: Run gpupdate /force on domain controllers or wait for automatic refresh. 10. Review Logs: Check Event Viewer > Security Logs on domain controllers for Event IDs like 4662 that indicate directory service object access. |
| Audit Directory Service Changes status | |
If addressed (configured): Enabling Audit Directory Service Changes ensures that all modifications to Active Directory objects (such as user accounts, groups, and policies) are logged, helping detect unauthorized or accidental changes that could compromise security. If not addressed (not configured): Without auditing directory service changes, malicious modifications could occur without detection, increasing the risk of privilege escalation, data breaches, and compliance failures. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Directory Service Changes: Set -udit Directory Service Changes-to Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Enable Audit Object Access: Ensure that Audit Object Access is enabled under:Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy 7. Configure Auditing on AD Objects: Using Active Directory Users and Computers (ADUC), enable auditing on the directory objects where changes must be tracked by modifying the Auditing tab in the object- properties. 8. Link the GPO: Link the GPO to the Organizational Units containing domain controllers. 9. Force Group Policy Update: Run gpupdate /force on domain controllers or wait for the next automatic refresh cycle. 10. Review Event Logs: Monitor the Security event logs on domain controllers for event IDs like 5136 which capture directory service changes. |
| Audit Group Membership status | |
If addressed (configured): Enabling Audit Group Membership provides detailed logging of changes to group memberships, which helps detect unauthorized privilege escalations and maintain the integrity of access controls. If not addressed (not configured): Without auditing group membership changes, malicious additions or removals of users from sensitive groups can go unnoticed, increasing risk of insider threats and security breaches. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or administrative workstation. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access 4. Enable Audit Group Membership: Set -udit Group Membership-to Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Enable Audit Directory Service Access: Confirm that Audit Directory Service Access is enabled to capture detailed changes. 7. Configure Object-level Auditing: Use Active Directory Users and Computers (ADUC) to enable auditing on critical groups by configuring the Auditing tab on group objects. 8. Link the GPO: Ensure the GPO is linked to the OU containing the domain controllers. 9. Force Group Policy Update: Run gpupdate /force on domain controllers or wait for the next policy refresh. 10. Review Event Logs: Monitor Security logs for event IDs such as 4728, 4729, 4732, and 4733 which indicate changes in group memberships. |
| Audit Logon status | |
If addressed (configured): Enabling Audit Logon provides visibility into all user logon and logoff activities, enabling detection of unauthorized access attempts and forensic investigations. If not addressed (not configured): Without auditing logon events, suspicious or malicious login attempts may go unnoticed, increasing the risk of undetected breaches and insider threats. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or an administrative machine. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the domain controllers-OU. 3. Navigate to Audit Policies:Go to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Logon: Configure -udit Logon-for both Success and Failure. 5. Apply and Save: Click Apply and then OK. 6. Verify Related Audit Policies: Ensure Audit Account Logon and Audit Logon/Logoff policies are also enabled for comprehensive tracking. 7. Link the GPO: Ensure the GPO is linked to the OU that contains the relevant systems (especially domain controllers). 8. Force Group Policy Update: Run gpupdate /force on affected machines or wait for the automatic update. 9. Monitor Event Logs: Check the Security event log for event IDs such as 4624 (successful logon) and 4625 (failed logon). 10. Configure Alerting and Reporting: Set up SIEM or monitoring tools to alert on unusual logon activity patterns, like multiple failed logins or logins outside business hours. |
| Audit Other Logon/Logoff Events status | |
If addressed (configured): Enabling Audit Other Logon and Logoff Events provides comprehensive logging of additional logon and logoff activities such as network connections, remote desktop sessions, and special system logons, improving detection of suspicious or unauthorized access. If not addressed (not configured): Without auditing these events, certain types of access may not be tracked, creating blind spots that attackers could exploit to move laterally or maintain persistence unnoticed. | orkstation, launch GPMC. 2. Create or Edit a GPO: Select or create a Group Policy Object linked to the relevant Organizational Unit (OU), especially where domain controllers or critical servers reside. 3. Navigate to Audit Policies:Path:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Other Logon/Logoff Events: Set this policy to audit Success and Failure. 5. Apply and Save: Click Apply and OK to save the settings. 6. Verify Related Audit Policies: Confirm Audit Logon and Audit Account Logon policies are also configured for full coverage. 7. Link the GPO: Ensure the policy is linked to OUs containing domain controllers and servers where auditing is critical. 8. Force Group Policy Update: Execute gpupdate /force on target machines to immediately apply changes. 9. Review Event Logs: Monitor Security logs for event IDs like 4647 (user initiated logoff), 4634 (logoff), and other relevant logon/logoff events. 10. Configure Alerts: Integrate with SIEM solutions or monitoring tools to alert on unusual or suspicious logon/logoff behaviors for timely incident response. |
| Audit Special Logon status | |
If addressed (configured): Enabling Audit Special Logon captures important events such as logons by users with elevated privileges (e.g., administrators) or service accounts, helping detect unauthorized privilege escalation or suspicious activities. If not addressed (not configured): Without auditing special logons, malicious use of privileged accounts or service accounts can go unnoticed, increasing the risk of undetected attacks and privilege misuse. | 1. Open Group Policy Management Console (GPMC): Launch GPMC on a domain controller or admin workstation. 2. Create or Edit a GPO: Choose an existing Group Policy Object linked to domain controllers or create a new one. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff 4. Enable Audit Special Logon: Set the policy to audit both Success and Failure events. 5. Apply and Save: Confirm changes by clicking Apply and OK. 6. Link GPO Appropriately: Make sure this GPO is linked to the OU containing your domain controllers and critical servers. 7. Force Group Policy Update: Run gpupdate /force on affected machines to apply immediately. 8. Verify Event Log Entries: Look for Security event ID 4672, which indicates special logon events. 9. Configure Monitoring: Set up alerts in your SIEM to flag unusual or unexpected special logons for further investigation. Review Regularly: Periodically audit and review special logon events to detect possible unauthorized privileged access. |
| Audit Detailed File Share status | |
If addressed (configured): Enabling detailed file share auditing provides visibility into access and changes to shared files and folders, helping detect unauthorized or malicious activity on critical data. If not addressed (not configured): Lack of detailed auditing on file shares can lead to undetected unauthorized access or data leakage, increasing the risk of data breaches and non-compliance with security policies. | 1. Open Group Policy Management Console (GPMC): Access GPMC on a domain controller or admin machine. 2. Create or Edit a GPO: Select an existing GPO linked to file servers or create a new one. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Enable Audit Detailed File Share: Configure Audit File Share for both Success and Failure. 5. Apply and Save: Click Apply and OK to save the settings. 6. Enable Auditing on Shared Folders: On each file server, right-click the shared folder > Properties > Security tab > Advanced > Auditing tab. 7. Add Auditing Entries: Add the users or groups to audit (e.g., Everyone), and select successful and failed accesses like read, write, delete, etc. 8. Force Group Policy Update: Run gpupdate /force on the file servers to enforce the policy immediately. 9. Verify Event Logs: Check the Security logs for event IDs such as 5140 (a network share object was accessed). 10. Set up Monitoring: Configure SIEM or alerting tools to monitor suspicious or unauthorized file share activity. |
| Audit File Share status | |
If addressed: Enabling Audit File Share allows organizations to track access to shared folders and files, which helps detect unauthorized access, data exfiltration attempts, and supports compliance requirements. If not addressed: Without auditing, malicious or accidental access to sensitive shared data may go unnoticed, increasing the risk of data breaches and non-compliance with security standards. | 1. Open Group Policy Management Console (GPMC): Log in to a domain controller or management workstation. 2. Create or edit a Group Policy Object (GPO): Target the policy to computers hosting file shares. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Enable -udit File Share-policy: Configure it for Success and Failure to capture all access attempts. 5. Apply and close the GPO editor: Save the settings. 6. Force a Group Policy update: Run gpupdate /force on affected file servers. 7. Enable auditing on specific shared folders: Right-click the folder > Properties > Security tab > Advanced > Auditing tab. 8. Add auditing entries: Add relevant users/groups (e.g., Everyone or specific groups) and select the types of access to audit (e.g., Read, Write). 9. Verify audit logs: Use Event Viewer on file servers to review Security logs for event ID 5140 (network share object access). 10. Integrate with monitoring tools: Set up alerts in your SIEM or security monitoring platform to detect suspicious or unauthorized access events. |
| Audit Other Object Access Events status | |
If addressed: Configuring audit for other object access events ensures that access and modifications to system objects like registry keys, printers, or kernel objects are logged, improving visibility into potentially malicious or unauthorized activities. If not addressed: Lack of auditing for these object types can result in blind spots where critical system changes go unnoticed, increasing the risk of undetected compromises or policy violations. | 1. Open Group Policy Management Console (GPMC): On a domain controller or management workstation. 2. Create or edit a Group Policy Object (GPO): Target it to relevant computers (e.g., domain controllers, servers). 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Locate -udit Other Object Access Events- This policy controls auditing for object types not covered by other audit policies. 5. Enable this policy: Configure for Success and Failure to capture all relevant events. 6. Apply and close the GPO editor: Save the settings. 7. Force Group Policy update: Run gpupdate /force on target systems. 8. Verify local security policy: Check under Local Security Policy > Advanced Audit Policy Configuration to confirm the setting is applied. 9. Review Event Viewer logs: Look for relevant event IDs (e.g., 4656, 4663) related to object access under the Security log. 10. Integrate with monitoring systems: Configure alerts or dashboards in SIEM tools to detect suspicious object access or changes. |
| Audit Removable Storage status | |
If addressed: Enabling audit for removable storage devices helps track usage of USB drives, external hard disks, and other removable media, providing visibility into potential data exfiltration or malware introduction vectors. If not addressed: Without auditing removable storage, organizations risk undetected unauthorized data transfers or malware infections via external devices, leading to data breaches or system compromises. | 1. Open Group Policy Management Console (GPMC): On a domain controller or management machine. 2. Create or edit a Group Policy Object (GPO): Target the computers or organizational units where you want to enforce the setting. 3. Navigate to Audit Policies:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access 4. Find and select -udit Removable Storage- This policy audits events related to removable storage device access. 5. Enable the policy: Set to audit Success and Failure events to capture all access attempts. 6. Apply and close the Group Policy editor. 7. Force Group Policy update: Run gpupdate /force on the targeted systems to apply changes immediately. 8. Verify the setting on target machines: Use auditpol /get /subcategory:Removable Storage in Command Prompt to confirm. 9. Monitor Security Event Logs: Look for event IDs like 4663, which indicate access to removable storage devices. 10.Integrate logs with SIEM or monitoring tools: Set up alerts for suspicious removable media usage to detect potential data leaks or malware introduction. |
| Audit Audit Policy Change status | |
If addressed: Configuring audit for policy changes ensures that any modifications to audit policies are logged, providing visibility into potential tampering or unauthorized changes that could hide malicious activity. If not addressed: Without auditing audit policy changes, attackers or insiders can alter or disable audit settings to avoid detection, increasing the risk of undetected security breaches. | 1. Open Group Policy Management Console (GPMC): Access this on a domain controller or management workstation. 2. Create or edit an existing Group Policy Object (GPO): Target the domain or organizational units as needed. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Locate -udit Audit Policy Change- This controls logging of changes to audit policies. 5. Enable auditing: Configure both Success and Failure audit settings to log all changes. 6. Apply and save the GPO. 7. Force update Group Policy: Run gpupdate /force on affected computers. 8. Verify the policy application: Use auditpol /get /category:Policy Change to confirm settings on target machines. 9. Monitor Security Event Logs: Check for event ID 4719 which logs audit policy changes. 10.Set up alerts: Integrate with SIEM or monitoring tools to notify admins of any changes to audit policies. |
| Audit Authentication Policy Change status | |
If addressed: Enabling auditing for authentication policy changes provides visibility into modifications of authentication methods, helping detect unauthorized or malicious alterations that could weaken security. If not addressed: Without this audit, attackers may change authentication policies undetected, potentially allowing easier unauthorized access and increasing risk of credential compromise. | 1. Open Group Policy Management Console (GPMC): On a domain controller or administrative workstation. 2. Create or edit a Group Policy Object (GPO): Apply it to the domain or specific OUs as needed. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Find -udit Authentication Policy Change- This setting controls auditing of authentication policy changes. 5. Enable auditing for both Success and Failure events: This ensures all changes are logged. 6. Apply and save the GPO. 7. Force Group Policy update: Run gpupdate /force on target computers. 8. Verify policy settings: Use the command auditpol /get /subcategory:Authentication Policy Change to confirm the audit is enabled. 9. Monitor Security Event Logs: Look for Event ID 4704, which records changes to authentication policies. 10. Implement alerting: Set up alerts in SIEM or monitoring tools for immediate notification on authentication policy changes. |
| Audit MPSSVC Rule-Level Policy Change status | |
If addressed: Enabling audit for MPSSVC (Microsoft Protection Service) rule-level policy changes ensures that any modifications to Windows Firewall rules are logged, helping detect unauthorized or accidental security changes. If not addressed: Without auditing, changes to firewall rules may go unnoticed, potentially exposing systems to attacks or allowing malicious traffic through, increasing the risk of breaches. | 1. Open Group Policy Management Console (GPMC): On a domain controller or admin machine. 2. Create or edit a Group Policy Object (GPO): Target it to the relevant organizational units or computers. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Locate -udit MPSSVC Rule-Level Policy Change- This controls auditing for Windows Firewall rule changes. 5. Enable auditing for both Success and Failure events: To track all changes effectively. 6. Save and apply the GPO. 7. Force Group Policy update: Run gpupdate /force on the target computers. 8. Verify the audit setting: Use the command auditpol /get /subcategory:MPSSVC Rule-Level Policy Change to confirm it is enabled. 9. Monitor Security Event Logs: Watch for Event ID 4946 and related events indicating rule-level changes. 10. Set up alerts or automated notifications: Use SIEM tools to get immediate alerts on policy changes for faster incident response. |
| Audit Other Policy Change Events status | |
If addressed: Configuring audit for Other Policy Change Events ensures that any modifications to security or system policies not covered by other audit categories are logged, providing comprehensive visibility into policy changes. If not addressed: Lack of auditing may allow unauthorized or accidental policy changes to go undetected, increasing the risk of security misconfigurations and potential breaches. | 1. Open Group Policy Management Console (GPMC): On a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO): Target the appropriate OU or domain. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Policy Change 4. Find and select -udit Other Policy Change Events- This setting covers policy changes not included in other categories. 5. Enable auditing for Success and Failure: Ensuring all policy change attempts are logged. 6. Apply and save the GPO. 7. Force Group Policy update on target systems: Run gpupdate /force. 8. Verify audit settings: Use auditpol /get /subcategory:Other Policy Change Events to confirm it- enabled. 9. Review Security Event Logs regularly: Look for event IDs related to policy changes (e.g., 4739 or similar). 10. Implement monitoring and alerting: Use SIEM or Windows Event Forwarding to detect and respond to suspicious policy changes. |
| Audit Sensitive Privilege Use status | |
If addressed: Enabling auditing for sensitive privilege use allows organizations to monitor and log whenever critical privileges (like SeDebugPrivilege, SeTakeOwnershipPrivilege) are used, enhancing detection of potential privilege abuse or malicious activity. If not addressed: Without auditing, unauthorized or malicious use of sensitive privileges may go unnoticed, increasing the risk of privilege escalation attacks and insider threats. | 1. Open Group Policy Management Console (GPMC): On a domain controller or an administrative workstation. 2. Create or edit a Group Policy Object (GPO): Apply it to the desired domain, site, or OU. 3. Navigate to Advanced Audit Policy Configuration:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Privilege Use 4. Locate Audit Sensitive Privilege Use: This controls logging of usage of sensitive privileges. 5. Enable auditing for both Success and Failure events: To log both successful and failed attempts. 6. Apply and save the GPO changes. 7. Force policy update on target machines: Run gpupdate /force from command prompt. 8. Verify auditing is enabled: Use the commandauditpol /get /subcategory:Sensitive Privilege Useto confirm. 9. Regularly monitor Security Event Logs: Look for event ID 4674 which logs sensitive privilege usage. 10. Implement alerts and integrate with SIEM: Set up monitoring tools to notify administrators of suspicious privilege use for rapid response. |
| Audit Other System Events status | |
If addressed: Configuring auditing for other system events ensures that important but less common system activities (like system shutdowns, driver installations, or changes in system state) are logged, aiding in comprehensive security monitoring and forensic investigations. If not addressed: Failure to audit these events can result in missing critical indicators of system compromise or improper changes, weakening overall security posture and incident detection. | 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit a Group Policy Object (GPO) linked to the relevant OU, domain, or site. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Find and select Audit Other System Events. 5. Enable auditing for both Success and Failure events to capture all relevant activity. 6. Apply and save the GPO changes. 7. On target systems, run gpupdate /force in Command Prompt to enforce the policy immediately. 8. Verify auditing status using the command:auditpol /get /subcategory:Other System Events 9. Review Security Event Logs regularly for event IDs related to system events (e.g., event IDs 4608, 4609, 4616). 10. Integrate logs with a SIEM or monitoring tool to alert on suspicious or unusual system event activity promptly. |
| Audit Security State Change status | |
If addressed: Enabling auditing for Security State Changes provides visibility into critical changes to the security subsystem, such as security policy modifications or security system shutdowns, which helps detect unauthorized or malicious activity. If not addressed: Without auditing Security State Changes, important security modifications may go unnoticed, increasing the risk of undetected breaches or policy tampering that could compromise system integrity. | 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO) linked to the domain, OU, or site where target systems reside. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Locate Audit Security State Change subcategory. 5. Enable auditing for both Success and Failure events to capture all security state changes. 6. Apply and save the GPO. 7. On target systems, run gpupdate /force to immediately enforce the new audit settings. 8. Verify the audit policy is applied by running:auditpol /get /subcategory:Security State Change 9. Regularly monitor the Security Event Logs for relevant event IDs such as 5038, which indicates security state changes. 10. ntegrate logs into a Security Information and Event Management (SIEM) tool to generate alerts for suspicious or unauthorized security state changes. |
| Audit Security System Extension status | |
If addressed: Enabling auditing for Security System Extensions helps track the loading and unloading of security-related system extensions, aiding in detecting unauthorized or malicious components that could compromise system security. If not addressed: Without this auditing, malicious or unauthorized security extensions might be installed or removed without detection, increasing the risk of persistent threats or system compromise. | 1. Open the Group Policy Management Console (GPMC) on a domain controller or administrative workstation. 2. Create or edit an existing Group Policy Object (GPO) linked to the relevant domain, OU, or site. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Find the subcategory Audit Security System Extension. 5. Set auditing to Success and Failure to capture all relevant events. 6. Click Apply and OK to save the settings. 7. On target machines, run gpupdate /force to immediately apply the updated policy. 8. Confirm the setting by running:auditpol /get /subcategory:Security System Extension 9. Monitor Security Event Logs for event IDs related to security system extension loading/unloading. 10.Use a SIEM solution to analyze these logs and alert on any suspicious or unauthorized activity. |
| Audit System Integrity status | |
If addressed: Enabling Audit System Integrity helps detect and log attempts to violate system integrity, such as kernel code injections, unauthorized driver loads, or other tampering activities, improving early detection of attacks on core system components. If not addressed: Without this auditing, critical system integrity violations may go unnoticed, allowing attackers to compromise system trustworthiness and persist undetected. | 1. Open Group Policy Management Console (GPMC) on a domain controller or administrative system. 2. Create a new or edit an existing Group Policy Object (GPO) linked to the appropriate domain or OU. 3. Navigate to:Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > System 4. Locate the subcategory Audit System Integrity. 5. Configure it to audit Success and Failure events. 6. Apply and save the changes. 7. On target machines, run gpupdate /force to immediately update the policy. 8. Verify the audit policy by running:auditpol /get /subcategory:System Integrity 9. Review Windows Security Event Logs for events related to system integrity violations (e.g., Event ID 4611, 4612). 10. Implement monitoring and alerting via SIEM tools to detect and respond to integrity violations promptly. |
| Domain member- Digitally encrypt or sign secure channel data (always) status | |
Test has passed. | NA |
| Microsoft network server- Digitally sign communications (always) status | |
Test has passed. | NA |
| Network security- Do not store LAN Manager hash value on next password change status | |
Test has passed. | NA |
| Locked Out Accounts Found | |
Test has passed. | NA |
| Test | Severity | Items | Affected Objects | IOC/IOE |
| Missing DNS Scavenging DCs | |
Total DNS Servers Not Enabled with Server Level Scavenging:1 | 1 | IOE |
| Missing Domain Zones Scavenging | |
Total Domain Zones Not Enabled with Scavenging:1 | 1 | IOC |
| Default Domain Policy-Minimum Password Length | |
Account Policies Not Configured correctly in Total Domains:1 | 1 | IOE |
| FGPP Policies-Minimum Password Length | |
FGPP Not Configured Correctly In Domains:Not Created | Not Created | IOE |
| FGPP Policies Not Applying | |
Total FGPP Not Applying in All Domains:Not Created | Not Created | IOE |
| Sites without Subnets Association | |
Total AD Sites Without Subnets:1 | 1 | |
| PDC Emulator Time Source | |
Root PDC Time Source:Internal Source | Internal Source | |
| AD Recycle Bin Status | |
AD Recycle Bin Status:Disabled | Disabled | |
| Managed Service Accounts Status | |
Managed Service Accounts Status:Are not in use | Are not in use | |
| Missing AD Sites Coverage | |
Total AD Sites Not Covered:1 | 1 | |
| Sites Missing Bridgehead Server | |
Number Of AD Sites Without Bridgehead Servers:1 | 1 | |
| AD Sites Redundancy | |
Total AD Sites with Only One Domain Controller:1 | 1 | |
| GPOs not Linked to OUs | |
Total OUs without GPO Linked:4 | 4 | IOE |
| Replication Interval Not Optimized Sites | |
Replication Interval is not optimized for Site Links:1 | 1 | |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | IOE |
| Found Orphaned Foreign Security Principals | |
Total Orphaned FSPs:0 | 0 | |
| Security Groups without Objects | |
Total Empty Security Groups In All Domains:32 | 32 | |
| Users without UPN specified | |
Total Users with UPN Blank in all Domains:1 | 1 | |
| Missing Location Text in AD Sites | |
Total AD Sites Not Defined With Location:1 | 1 | |
| GPO Description | |
Number of GPOs not set with Description:2 | 2 | |
| Unsecure Updates Zones | |
Total DNS Zones accepting non-secure updates:0 | 0 | IOE IOC |
| Unsupported Operating Systems | |
Total End Of Life-Unsupported Operating Systems:0 | 0 | IOE |
| Domain Controllers not owned by Admins | |
Total Domain Controllers owned by non-privileged accounts:0 | 0 | IOC |
| Missing DNS Forwarders DCs | |
Total DNS Servers Do Not Have Forwarders Configured:0 | 0 | IOE |
| Missing Root Hints DCs | |
Total DNS Servers Do Not Have Root Hints Configured:0 | 0 | IOE |
| NTFS Replication DCs | |
Total Domain Controllers utilizing NTFRS for AD Replication:0 | 0 | IOE |
| Strict Replication Disabled DCs | |
Total DCs with Strict Replication Consistency not enabled:0 | 0 | IOE IOC |
| Out Of Default OUs DCs | |
Total DCs outside of it's Default OU:0 | 0 | |
| Unsupported OS DCs | |
Total DCs running Unsupported Operating Systems:0 | 0 | IOE |
| Event Log Config Not Correct DCs | |
Total DCs with Event Log misconfiguration:0 | 0 | |
| Event Log Size Not Optimized DCs | |
Total DCs with Event Log Size not optimal:0 | 0 | |
| ADWS Service Set to Manual DCs | |
Total DCs ADWS Not Set to Start Automatic:0 | 0 | IOE |
| DHCP Service Running DCs | |
Total Domain Controllers with DHCP Server running:0 | 0 | IOE |
| Additional Roles and Features DCs | |
Total Domain Controllers with Roles Processed:1 | 1 | IOE |
| Total Undefined Subnets | |
Total Undefined Subnets in AD Forest:0 | 0 | |
| Sites without ISTG Role | |
Total AD Sites Do Not Have ISTG Defined:0 | 0 | |
| Manual Replication Connection Objects | |
Total Manual Replication Connection Objects:0 | 0 | |
| Missing Global Catalog Sites | |
Total AD Sites Without Global Catalog Servers or No Universal Group Caching Enabled:0 | 0 | |
| Duplicate Site Links | |
Total Duplicate Site Links:0 | 0 | |
| Sites With Manual Bridgehead Server | |
Number Of AD Sites With Manual Bridgehead Servers:0 | 0 | |
| Sites creating Mesh Topology | |
Total AD Site Links Containing More than Two AD Sites:0 | 0 | |
| AD Sites without Site Link | |
Total AD Sites Not In Site Links:0 | 0 | |
| AD Sites without Domain Controller | |
Total AD Sites Without Domain Controllers:0 | 0 | |
| Domain Controllers Time Source | |
Total DCs Not Defined With Correct Time-Source:0 | 0 | |
| Domain FSMO Placement | |
AD FSMO Placement Status:FSMO Placement is correct. | FSMO Placement is correct. | |
| Domain Naming Master and Schema Master Placement | |
Status:Hosted on same computer | Hosted on same computer | |
| Managed Service Accounts Not Linked | |
Total Managed Service Accounts are not Linked:0 | 0 | IOE |
| TombstoneLifeTime Modified? | |
Current TombstoneLifeTime Value:180 | 180 | |
| Check AD Forest Functional Level | |
AD Forest Functional Level:dp.net is Windows2016Forest | dp.net is Windows2016Forest | |
| Check AD Domain Functional Level | |
Status:Ok | Ok | |
| Ogranizational Units without Objects | |
Total Empty Organizational Units In All Domains:0 | 0 | |
| Disabled GPOs | |
Total Disabled GPOs:0 | 0 | |
| GPOs not Applying | |
Total GPOs not applying correctly in All Domains:0 | 0 | |
| Orphaned GPO Containers | |
Total Orphaned Group Policy Objects:0 | 0 | |
| Found OUs with GPOs Block Inheritance | |
Total GPOs with Block Inheritance Defined:0 | 0 | |
| GPO Naming Convention | |
Number Of GPOs do not follow Standard Naming Convention:0 | 0 | |
| Found GPO with WMI Filters | |
Total GPO with WMI Filter:0 | 0 | |
| Inconsistent GPOs | |
Total GPOs with Replication Issues:0 | 0 | |
| Too many DNS Static Records | |
Total Static Records:0 | 0 | IOC |
| DNS Round-Robin Not Enabled | |
Total DNS Servers Not Enabled With Round Robin:0 | 0 |
| Test | Severity | Items | Affected Objects | IOC/IOE |
| AD Partitions Backup Status | |
Total AD Partitions not backed up since last 7 days:5 | 5 | |
| Missing SSL Authentication DCs | |
Total DCs without SSL:1 | 1 | IOE |
| Missing Enough DNS Servers in NIC DCs | |
Total DCs With inadequate Number Of DNS Servers in NIC Property:1 | 1 | |
| Not Enough Local Disks DCs | |
Total DCs Not Configured With Recommended Disk Configuration:1 | 1 | |
| Replication Errors DCs | |
Total DCS in Replication Errors:0 | 0 | IOE |
| Missed Reboot Cycles DCs | |
Total DCs Not Rebooted Since Last 30 Days:0 | 0 | IOE |
| Orphaned DCs | |
Total Orphaned Domain Controllers:0 | 0 | IOE |
| Missing Host Records DCs | |
Total DCs Missing Host Records in DNS:0 | 0 | IOE |
| Not Enough Free Space DCs | |
Total DCs with Low Disk Space:0 | 0 | IOE |
| Loopback Address Missing DCs | |
Total DCs not configured with Loopback Address:0 | 0 | IOE |
| Multihomed DCs | |
Total DCS in Multihomed State:0 | 0 | IOE |
| Missing DNS Dynmaic Registration on NIC DCs | |
Total DCS NIC Dynamic Updates Not Enabled:0 | 0 | |
| Missing _msdcs Zone DCs | |
Total DNS Servers Missing _msdcs Zone:0 | 0 | |
| AD Services not running DCs | |
Total DCs with Services Not Running:0 | 0 | IOE |
| Domain GPO Application Status | |
Total GPOs Not Applied:0 | 0 |
| Short Test Name | Full Test Name | Severity | Justification |
X
OBJECTS
OBJTITLENAME
GPO-Info#FGPP-Info#Client-OS-Info#Server-OS-Info#Admin-Groups#
REPLTABLENAME
| Disabled | DomainName | Enabled | GroupName | Inactive | LastLoginDate | MemberName | PasswordNeverExpires | WhenCreated |
False | dp.net | True | Administrators | False | 5/20/2026 12:01:33 AM | Administrator | True | 2/3/2026 8:59:02 PM |
False | dp.net | True | Schema Admins | False | 5/20/2026 12:01:33 AM | Administrator | True | 2/3/2026 8:59:02 PM |
False | dp.net | True | Enterprise Admins | False | 5/20/2026 12:01:33 AM | Administrator | True | 2/3/2026 8:59:02 PM |
False | dp.net | True | Domain Admins | False | 5/20/2026 12:01:33 AM | Administrator | True | 2/3/2026 8:59:02 PM |
| AD_Domain | DistinguishedName | EnabledStatus | InactiveStatus | LastLogonDate | ServerName |
dp.net | CN=WIN-R21FG8USEKP,OU=Domain Controllers,DC=dp,DC=net | Enabled | Active | 5/19/2026 10:26:35 PM | WIN-R21FG8USEKP |
| AD Domain | GPO Name | Status |
| dp.net | Default Domain Controllers Policy | AllSettingsEnabled |
| dp.net | Default Domain Policy | AllSettingsEnabled |