SAMPLE-AD-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Active Directory Health and Security Review
Status: Fictional format sample · Domain label: corp.example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
One fictional forest with one domain, 3 domain controllers and 2 sites, from read-only command output supplied by the administrator.
Executive summary
Replication is healthy and roles are well placed. The main risks are administrative: too many accounts in privileged groups, a krbtgt password that has never been reset, and no evidence that an Active Directory restore has ever been tested.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Replication summary output | All 3 domain controllers | Provided |
| E-02 | Operations master role listing | 5 roles | Provided |
| E-03 | Privileged group membership export | 4 groups | Provided; names pseudonymised |
| E-04 | krbtgt and stale account queries | Password age, last logon | Provided |
| E-05 | Backup job report | System state, 30 days | Provided; no restore test record |
| E-06 | Domain controller settings report | LDAP signing settings | Provided |
| E-07 | GPO inventory list | Name, links, status | Provided; inventory only |
What was not checked
- Group Policy contents (inventory only)
- AD CS (not deployed according to the administrator)
- Network and firewall rules
- Client-side configuration
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | krbtgt password last set more than 5 years ago | E-04 | Plan a reset with monitoring in a maintenance window. Microsoft documents resetting krbtgt twice, with a wait between resets. |
| F-02 | High | 14 accounts in Domain Admins, including 3 service accounts | E-03 | Reduce to named administrators, remove service accounts, and use separate admin accounts. |
| F-03 | High | No evidence of an Active Directory restore test | E-05 | Run and record a restore test in an isolated environment and write a recovery runbook. |
| F-04 | Medium | LDAP signing not enforced on 1 of 3 domain controllers | E-06 | Test which clients use unsigned binds before enforcing signing, then align all controllers. Check current Microsoft documentation first. |
| F-05 | Medium | 31 unlinked or empty GPOs and 2 duplicates | E-07 | Back up, review and retire unused GPOs. |
| F-06 | Low | 212 computer accounts inactive for over 180 days | E-04 | Disable, then delete after a retention period. |
Fix first
- Reduce Domain Admins membership Effort: Medium.
- Run and record an AD restore test Effort: Medium.
- Plan the krbtgt reset (twice, with the documented wait) Effort: Medium.
- Align LDAP signing across controllers Effort: Medium.
- Clean up unused GPOs and stale computers Effort: Low.
30/60/90-day plan
- First 30 days: Cut privileged group membership; schedule the restore test; back up all GPOs.
- By 60 days: Run the restore test and write the runbook; reset krbtgt in a window; align LDAP signing.
- By 90 days: Clean up GPOs and stale objects; set a quarterly review of privileged groups.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.