Active Directory health
and security, written up.
We review the health and security of your on-premises Active Directory using read-only command output and reports your administrators run and share, and give you a written report of what is healthy, what is risky and what to fix first.
Who it is for
Organisations running Windows Server domain controllers that have not had an independent check for a while, or that are planning a domain controller upgrade, a hybrid identity project or a security review.
What we review
- Replication health. replication status and errors between domain controllers, and site topology: sites, subnets and site links, as set out in Microsoft’s replication concepts.
- FSMO roles. where each of the five operations master roles sits (two forest-wide, three per domain), whether the holders are in places with reliable networks, whether the PDC emulator and RID master are consistently available, and whether standby role holders are planned.
- DNS for Active Directory. AD-integrated zones, domain controller locator records, scavenging, forwarders and the DNS client settings on domain controllers.
- Group Policy hygiene. unlinked, empty, disabled or duplicate GPOs, permissions on GPOs, and SYSVOL replication method.
- Privileged groups and tiering. membership of Domain Admins, Enterprise Admins, Schema Admins and Administrators, service accounts in privileged groups, and how far administration is separated by tier.
- krbtgt account. age of the krbtgt password and whether a documented, tested reset process exists. Microsoft’s forest recovery guide describes resetting it twice, with a wait between resets.
- Stale and risky objects. inactive users and computers, accounts with passwords that never expire, and old trusts.
- LDAP signing. the configured and effective LDAP signing settings on domain controllers. Microsoft notes that clients relying on unsigned binds stop working once signing is required, so the report lists what to test first. Check current Microsoft documentation.
- Certificate services inventory. whether Active Directory Certificate Services is deployed, the CA hierarchy and certificate expiry dates. This is an inventory only, not an AD CS security assessment.
- Backup and recovery of AD. system state backup coverage and age, evidence of a restore test, and whether a forest recovery plan exists.
- Operating system and functional levels. unsupported domain controller operating system versions, and the domain and forest functional levels in use.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A domain controller health table
- Findings with severity and the evidence behind each one
- A fix-first list with effort for each item
- A 30/60/90-day plan
- A list of what was not checked and why
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over the domain
- A list of read-only commands and reports we ask your administrator to run (for example replication and domain controller diagnostics, and directory queries for group membership and account age), with the output shared through an agreed channel
- Information about your sites and any domain controller plans
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the output you provide, taken from read-only commands. We do not connect to your network or domain controllers.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not connect to your domain controllers, change objects, reset passwords, edit Group Policy or run tools against your network. This is not a penetration test and we give no security guarantee.
What needs separate approval. Any change to the domain, resetting krbtgt, enforcing LDAP settings, removing accounts or groups, and any restore test.
Questions before an enquiry
Do you connect to our domain controllers?
No. Your administrator runs read-only commands that we specify and shares the output. We never receive credentials.
Will you reset krbtgt or fix replication?
No. The report explains what to do and in what order. Changes are yours to approve, or a separate written scope with a change record and rollback plan.
Does the output contain sensitive data?
It can list account and group names. The scope agrees what to redact and how the files are shared and kept before anything is sent. Never email credentials or password hashes.
Is this a penetration test?
No. It is a configuration and hygiene review of the evidence you share. It does not exploit anything.
We are moving to Entra ID. Is this still useful?
Yes. Most hybrid designs depend on a healthy Active Directory. See the hybrid identity review for the sync side.
Free tools, reading and vendor documentation
- Server inventory analyzer (free)
- Windows Server 2016 domain controller migration
- Windows Server 2016 AD CS migration
- On-premises Active Directory to Entra ID hybrid checklist
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.