Four scores, not one magic number
Security, operational health, administration and OU architecture, from 0 to 100. Every deducted point carries the rule and the evidence behind it.
AD Monitor
Your Active Directory, assessed with evidence
More than 50 security, health, GPO and OU controls, with every finding explained and a 90-day plan.
PowerShell script, nothing to install
More than 50 controls
What is wrong, where, how much it matters and what to do
Evidence in every finding
Control, impact, recommendation, owner and the exact domain controller data that proves it.
History and comparison
Every assessment is kept. Compare with the previous one and see what was fixed and what is new.
Findings by service and severity
Security, identity, administration, GPO, OU and health. Filter by severity or search by control or owner.
A 90-day remediation plan
Actions in three stages: 0 to 15 days for direct risk, 15 to 45 to stabilize and 45 to 90 for the target architecture.
Reports for engineers and leadership
Export the report to PDF and the domain architecture to SVG to open it in Visio.
What it checks in every domain
Security
SMBv1 and NTLMv1Unsigned LDAP and anonymous bindKerberos with RC4 or DESPrint spooler on DCsESC1, ESC2 and ESC3 certificate templatesPasswords in GPP (cpassword)Trusts without SID filtering
Identity and privilege
Domain Admins membershipDCSync rights outside the baselineUnconstrained delegationAS-REP roastable accountsKRBTGT not rotatedOrphaned adminCountLAPSBreak-glass accounts
GPO
GPOs without an ownerUnlinked or empty GPOsEditable by non-adminsToo many at the domain rootNot reviewed in two years
OU and administration
Hierarchy depthEmpty OUsInactive users and computersPasswords that never expireAdministrative tier modelNaming
Operational health
DC replication and servicesTime drift and KerberosSYSVOL and FRSDNS on domain controllersLegacy operating systemsBackups and AD recycle bin
Download, run, import
01
Download the script
A PowerShell script. No agents, services or binaries installed on the domain controller.
02
Run it on the DC
With read permissions on the domain. Works from Windows Server 2008 R2 to current versions.
03
Import the result
The JSON file is loaded into the portal by client, forest and domain. It can also be sent straight to the API.
04
Review and export
Findings with evidence, a remediation plan, a PDF for leadership and the architecture in Visio.
Also included
Multi-client portal
Separate clients, forests and domains, with users and roles per client.
Path to Entra Domain Services
A phased plan to move the domain to Microsoft Entra Domain Services.
SharePoint Server inventory
Farms, sites and permissions ready to plan the migration with Migration Monitor.
Frequently asked questions
Does it change anything in Active Directory?
No. The script only reads: domain configuration, domain controllers, GPOs and accounts. Changes come later, with the remediation plan.
What permissions does it need?
Read access to the domain and the ActiveDirectory PowerShell module (RSAT). It runs on a domain controller or a machine with RSAT.
Does it work without internet access?
Yes. The script produces a JSON file that is imported into the portal later; the DC needs no internet access.
Which Windows Server versions are supported?
From Windows Server 2008 R2 SP1 with PowerShell 2.0 to current versions. On older versions some checks are marked as not evaluated instead of being guessed.
Do you use it in your assessments?
Yes. It is the tool we use for Active Directory assessments in our consulting projects.
See the real state of your Active Directory
We show you a full assessment with sample data and then run it on your domain.