🛡️ Active Directory Health Check v2.6
🇩🇪 Deutsch | 🇬🇧 English
A comprehensive PowerShell script for automated health and security checking of an Active Directory environment. With best-practice assessment, color-coded HTML report, and CSV export.
🇩🇪 Deutsch
📑 Table of Contents
✨ Features
- 🎯 54 best-practice checks organized by topic (DC baseline, security, structure, monitoring)
- 🖼️ Modern WPF GUI (light theme) with group selection, suite buttons, and output path selection
- 🎨 Color-coded HTML report with executive dashboard (OK / WARN / CRITICAL / INFO)
- 📊 CSV export of all check results
- 🖥️ Interactive start menu as fallback for console operation
- ⚡ Parameter-based execution for scheduled tasks / automation
- 📁 Freely selectable output path via GUI or
-OutputPath parameter
- 🔍 DCDiag with individual test parsing (DE/EN language-independent)
- 🔄 Loopback detection for local DCs (uses
localhost instead of FQDN)
- 📡 Ping skip logic for unreachable DCs with fallback to WinRM
- 🌍 Language-independent via well-known SIDs
- 🗣️ Automatic language detection & DE/EN language switcher – switchable live in the WPF GUI, overridable via parameter
-Language de|en
- 📝 Detailed logging (
C:\ScriptLog)
- 🔧 Modular design - individual checks can be run selectively
📋 The 54 Checks
🏗️ DC Baseline Infrastructure
| # | Check | Description |
|---|
| 1 | DC System Information | OS, RAM, uptime, hardware |
| 2 | Services | NTDS, DNS, Netlogon, KDC, W32Time, DFSR |
| 3 | DCDiag Tests | Detailed parsing of all DC diagnostic tests |
| 4 | Replication (Partners) | Status per DC partner |
| 4b | Replication Errors (Forest) | Forest-wide replication issues |
| 5 | FSMO Roles | All 5 FSMO role holders |
| 6 | DNS Configuration | Zones, AD integration, dynamic updates |
| 7 | SYSVOL & NETLOGON | Reachability |
| 8 | NTDS Database | Size, free disk space |
🔒 Security: Network Protocols
| # | Check | Description |
|---|
| 9 | TLS Protocols (SCHANNEL) | SSL 2.0/3.0, TLS 1.0/1.1/1.2/1.3 |
| 10 | Ciphers & Algorithms | RC4, DES, MD5 and other weak ciphers |
| 11 | SMB1 & SMB Signing | WannaCry protection, signing enforced |
| 12 | NTLM / LAN Manager Auth Level | LmCompatibilityLevel=5 best practice |
| 13 | LLMNR / NetBIOS / WPAD | Responder attack protection |
| 14 | LDAP Security | Signing + channel binding (ADV190023) |
| 15 | Windows Firewall | All 3 profiles active? |
👥 Security: Accounts & Kerberos
| # | Check | Description |
|---|
| 16 | Privileged Accounts | Domain/Enterprise/Schema Admins etc. |
| 17 | Password Policy | MinLen, history, max age, complexity, lockout |
| 18 | Kerberos / krbtgt | Password age (best practice: ≤180 days) |
| 19 | Kerberos Unconstrained Delegation | Domain takeover risk detection |
| 20 | Kerberoasting Risk | Analyze user accounts with SPN |
| 21 | LSA Protection (RunAsPPL) | Protection against credential dumping (Mimikatz) |
🛡️ Security: System Hardening
| # | Check | Description |
|---|
| 22 | Print Spooler on DCs | CVE-2021-34527 (PrintNightmare) |
| 23 | Secure Boot Certificate Update | Windows UEFI CA 2023 deployment status |
| 24 | Certificates | Expiration monitoring, EKU check |
🌐 AD Structure
| # | Check | Description |
|---|
| 25 | AD Sites | Site overview |
| 26 | AD Subnets | Subnet-to-site mapping |
| 27 | Trusts | Domain/forest trusts |
| 28 | AD Recycle Bin | Feature activation status |
| 29 | Tombstone Lifetime | Best practice ≥180 days |
| 30 | Forest/Domain Level | Functional level |
| 31 | GPO Health | Sysvol/DS version mismatch |
👤 Inactive Accounts
| # | Check | Description |
|---|
| 32a | Inactive Users | >90 days no login |
| 32b | Inactive Computers | >90 days no login |
| 32c | Password Never Expires | Flag check |
📊 Monitoring & Operations
| # | Check | Description |
|---|
| 33 | Event Log Analysis | System / Directory Service / DNS (last 24h) |
| 34 | Time Synchronization | PDC + domain DCs |
| 35 | AD Backup Status | via repadmin /showbackup |
| 36 | Installed Programs | Inventory per DC |
| 37 | Windows Updates | Last 20 updates, age assessment |
| 45 | Installed Windows Features | Installed roles & features per DC (ServerManager) |
| 46 | SMB Shares | All shares including paths, permissions, and encryption |
🧬 Identity & DNS (new)
| # | Check | Description |
|---|
| 38 | SPN Duplicates | Detection of multiply assigned SPNs (Kerberos conflicts) |
| 39 | AS-REP Roasting Risk | Users without Kerberos pre-authentication |
| 40 | AdminSDHolder / AdminCount Drift | AdminCount=1 without current protected group membership |
| 41 | Fine-Grained Password Policies | FGPP hardening, lockout, and target group assignment |
| 42 | DNS Hygiene (Aging / Scavenging) | Aging/scavenging, reverse zones, dynamic update risks |
| 43 | LAPS Configuration | Local Admin Password Solution - activation status, computer coverage (from Server 2019) |
| 44 | Accounts Without AES | Finds accounts with RC4-only or without AES encryption (security risk) |
🎯 Security: Attack Vectors 2025/2026
| # | Check | Description |
|---|
| 47 | RC4 → AES Migration Audit | Accounts without AES before the RC4 shutdown in 2026 (CVE-2026-20833) + KDC registry of the DCs |
| 48 | DCSync Permissions | Replication rights outside the DCs (password hash extraction risk) |
| 49 | RBCD & Constrained Delegation | msDS-AllowedToActOnBehalfOfOtherIdentity and msDS-AllowedToDelegateTo including protocol transition |
| 50 | dMSA / BadSuccessor | Delegated Managed Service Accounts (Server 2025) and superseding patterns |
| 51 | MachineAccountQuota | ms-DS-MachineAccountQuota (best practice: 0) |
| 52 | Anonymous LDAP Access | Anonymous bind test against PDC + dSHeuristics |
| 53 | GPP/cpassword in SYSVOL | Plaintext-decryptable passwords in GPP XMLs (MS14-025) |
| 54 | Protected Users Audit | All privileged accounts in the Protected Users group? |
💻 System Requirements
- Windows Server 2016 or newer
- PowerShell 5.1+
- RSAT / AD tools installed:
- ActiveDirectory module
- GroupPolicy module
- DnsServer module
- Domain Admin rights recommended
- WinRM enabled on all DCs (or DCOM fallback)
- Execution on a DC or management server with AD connectivity
🚀 Installation
# Repository klonen
git clone https://gitlab.com/RoccoAmmon/Active-Directory-Health-Check.git
cd Active-Directory-Health-Check
# Skript ausführen (interaktiv)
.\AD_Health_Check.ps1
roccoammon/active-directory-health-check
